How do I resolve IP addresses that Amazon EC2 doesn't list for my Network Load Balancer?

Short description

Network Load Balancers have a single static IP address per Availability Zone. If the Network Load Balancer is public, then each zone has a static private IP address and a static public IP address. When you add additional zones, Amazon EC2 adds IP addresses to the DNS name of the Network Load Balancer. To view your Network Load Balancer IP addresses, perform a DNS lookup on the Network Load Balancer DNS name.

A load balancer that operates across multiple Availability Zones returns IP addresses only from healthy zones in its DNS responses.

For example, if only 2 out of 3 Availability Zones are healthy, then the DNS returns only 2 IP addresses. However, if all zones are unhealthy, then the DNS fails open and returns IP addresses from all zones. If Network Load Balancers have cross-zone load balancing turned off, the DNS normally returns IP addresses from zones that contain active targets. However, in a fail-open scenario, the DNS returns IP addresses from all zones regardless of target presence.

Resolution

Make sure that you have at least one healthy target per Availability Zone. If you have a target in us-east-1a and target-2 in us-east-1b for target-group-1, then both Network Load Balancer IP addresses are reachable. Then, you can find the IP addresses in a DNS lookup with cross-zone on or off.

If you don't have at least one healthy target per zone in each target group, then your design might result in intermittent connectivity. For example, you have target-1 listen on port 80 in us-east-1a for target-group-1 and target-2 listen on port 8080 in us-east-1b for target-group-2. Then, in target group 1, a target for us-east-1b is missing, and in target group 2, a target for us-east-1b is missing. The Network Load Balancer DNS can fail open, and then all IP addresses appear in Amazon EC2.

To resolve this issue, add another target for each zone in each target group. Or, turn on cross-zone for your Network Load Balancer to connect across different zones.

If you have a target in us-east-1a for target-group-1, then only the IP address in us-east-1a appears in Amazon EC2 because there are no healthy targets in us-east-1b. To resolve, add another target for us-east-1b in the same target group. Or, turn on cross-zone.