How do I troubleshoot connections that don't establish with my Network Load Balancer?

Short description

Your client might not be able to establish a connection through a Network Load Balancer for the following reasons:

• The targets are unhealthy.
• There are security groups or network access control lists (network ACLs) configuration issues.
• There are TLS listener configuration issues
• There are routing configuration issues.

Resolution

Troubleshoot health check failures and unreachable targets

If all targets in a target group are unhealthy, then traffic goes to all Availability Zones that the Network Load Balancer is deployed in. If an Availability Zone subnet has a route table without the required routes, then traffic sent to that Availability Zone can't connect.

If you deactivate cross-Zone load balancing and all targets in an Availability Zone become unhealthy, then the Network Load Balancer removes that Availability Zone from DNS. Traffic then shifts to other Availability Zone and increases load on the remaining targets.

To resolve these issues, complete the following steps:

1. Make sure that all target groups have at least one healthy target.
2. Review the health check configuration. Confirm that the health check port, protocol, path for HTTP/HTTPS health checks, interval, and threshold settings match your application's behavior.
3. If a target is unhealthy, then check that the application responds on the health check port. Connect directly to the target, and then run the following command to test the application's response and SSH into the target:

   curl http://localhost:HEALTH_CHECK_PORT/HEALTH_CHECK_PATH

   Note: Replace HEALTH_CHECK_PORT with your health check port and HEALTH_CHECK_PATH with your health check path.
4. For targets in the same virtual private cloud (VPC), confirm that the subnet route table configuration includes a local route. For targets in a different VPC, confirm that the route table has routes through VPC peering or AWS Transit Gateway.
5. Confirm that target security groups allow outbound health check traffic from the private IP addresses of the Network Load Balancer to targets on the health check port.
   Note: Health check traffic originates from the private IP addresses of the Network Load Balancer, even if you activate client IP address preservation.

Check your security group and network ACL configuration

Make sure that the security group for the Network Load Balancer allows traffic from all source IP addresses or CIDR ranges on the required port. Also, make sure that the target's security groups allow inbound traffic from the Network Load Balancer subnet or client IP address.

Check the network ACLs for both the Network Load Balancer and target subnets. Make sure that the network ACLs allow both inbound and outbound traffic on the required ports. Typically, you use ephemeral ports 1024–65535.

Note: Traffic can also depend on client IP address preservation settings.

TLS listeners terminate TLS connections at the load balancer and establish new connections to targets. If your TLS connections fail, then check the tls_cipher and tls_protocol_version fields in the Network Load Balancer access logs. If a TLS negotiation fails, then the field value is -.

To resolve TLS issues, confirm that the security policy on the TLS listener includes the TLS versions and cipher suites that your clients support.

Also, confirm that the certificate that's associated with the TLS listener is valid and not expired. If the certificate expired, then request or import a new certificate in AWS Certificate Manager (ACM) and update the listener.

Note: You must manually review and import certificates in ACM before they expire. Certificates that ACM issues are eligible for automatic renewal. For private certificates, see Request a private certificate in AWS Certificate Manager.

Check for protocols that negotiate TLS at the application level. These protocols include SMTP with the Start Transport Layer Security (STARTTLS) protocol command, or MS-SQL with the Tabular Data Stream (TDS) protocol. For these protocols, use a TCP listener and terminate TLS on the target instead. Remove the existing TLS listener, and then create a new listener with TCP as the protocol on the same port. Also, configure TLS termination on the targets. For example, install certificates and configure TLS in your application or reverse proxy.

Fix the routing configuration for internet-facing Network Load Balancers

To create an internet-facing Network Load Balancer, the VPC must have an internet gateway attached. Make sure that the route table for the Network Load Balancer subnets has a 0.0.0.0/0 route to the internet gateway.

Related information

Troubleshoot your Network Load Balancer

Health checks for Network Load Balancer target groups

Update the security groups for your Network Load Balancer

How do I identify the source of connectivity issues with my Network Load Balancer?

How do I troubleshoot connections that drop or intermittently fail with my Network Load Balancer?