How do I troubleshoot Network Load Balancer IP addresses when I add or remove Availability Zones?

Short description

Network Load Balancer IP addresses are static. You assign them when you create the load balancer. When you add or remove Availability Zones on your Network Load Balancer, IP address behavior depends on whether you're using public or private IP addresses. It also depends on whether Amazon Elastic Compute Cloud (Amazon EC2) automatically assigns them or you explicitly specify them.

Resolution

Network Load Balancers maintain one static IP address per active Availability Zone. You can't modify the IP addresses of subnets after you create the Network Load Balancer.

IP address assignment types

Network Load Balancers support two types of IP address assignment:

• Automatic assignment by AWS: When you don't specify IP addresses, AWS automatically assigns IP addresses from your subnet's Classless Inter-Domain Routing (CIDR) range. For internet-facing Network Load Balancers, AWS also automatically assigns public IP addresses. These automatically assigned addresses remain static throughout the lifetime of the Network Load Balancer unless you change the associated subnet.
• Explicit assignment from CIDR: For internal Network Load Balancers, you can specify private IPv4 addresses from your subnet's CIDR range during creation. After creation, you can't change these IP addresses. For internet-facing Network Load Balancers, assign Elastic IP addresses to provide static public IP addresses. You must pre-allocate Elastic IP addresses in the same AWS Region before you create the Network Load Balancer. During subnet configuration, pre-allocated Elastic IP addresses appear as available selection options.

Locate IP addresses for your Network Load Balancer

For explicitly specified IP addresses

When you specify IP addresses during Network Load Balancer creation, the addresses display on the Network mapping tab of the Load balancers page.

For automatically assigned IP addresses

When Amazon EC2 automatically assigns IP addresses, follow these steps to locate them:

1. Open the Amazon EC2 console.
2. In the navigation pane, under Network & Security, choose Network Interfaces.
3. In the search box, enter the Network Load Balancer name.
4. Locate the Network interface ID in the search results.
5. Scroll horizontally through the columns to view the IP address information.

Each active Availability Zone has a network interface ID and assigned IP address.

What happens when you remove an Availability Zone

When you remove a subnet to remove an Availability Zone from your Network Load Balancer, the IP address returns to the subnet pool. The IP address becomes available for assignment to other resources in the subnet.

What happens when you add an Availability Zone

When you add an Availability Zone to your Network Load Balancer, the Network Load Balancer creates new network resources. When you add a subnet to a Network Load Balancer, you can either specify a particular IP address or let AWS automatically assign one. For internet-facing Network Load Balancers, you can also specify an Elastic IP address for the new subnet.

How to change IP addresses on Network Load Balancers

You can't modify Network Load Balancer IP addresses after you create them. If you can accept downtime, then choose one of the following two approaches to replace the IP addresses.

Option 1: Replace the subnet in a specific Availability Zone

If you need to change the IP address in an Availability Zone and can tolerate a traffic disruption, then replace the subnet. For more information, see Update the Availability Zones for your Network Load Balancer.

Note: Replacement of a subnet is a lighter operation than replacement of the entire Network Load Balancer.

Complete the following steps:

1. Make sure that a secondary subnet exists in the target Availability Zone, or create a new one within the same Amazon Virtual Private Cloud (Amazon VPC). For Elastic IP address changes on internet-facing Network Load Balancers, allocate the new Elastic IP address in advance.
2. Run the set-subnets command without the target Availability Zone's subnet to remove it. Include the subnet mappings for all other Availability Zones you want to keep. Example for internal Network Load Balancers:

   aws elbv2 set-subnets --load-balancer-arn nlb-arn --subnet-mappings SubnetId=subnet-in-other-az,PrivateIPv4Address=10.0.2.100

   Note: Replace nlb-arn with your Amazon Resource Name (ARN) and subnet-in-other-az with the SubnetID for the Availability Zone that you want to keep.
3. Wait up to 3 minutes for the subnet removal to finish.
4. To add the new subnet in the target Availability Zone, run the set-subnets command again. Specify PrivateIPv4Address for internal Network Load Balancers or AllocationId for internet-facing Network Load Balancers. Include all other Availability Zones in the mapping.
   Example for internal Network Load Balancers:

   aws elbv2 set-subnets --load-balancer-arn nlb-arn --subnet-mappings SubnetId=new-subnet,PrivateIPv4Address=10.0.3.200 SubnetId=subnet-in-other-az>,PrivateIPv4Address=10.0.2.100
   

   Note: Replace nlb-arn with your ARN and new-subnet with your new SubnetID. Also replace subnet-in-other-az with the SubnetID for the Availability Zone that you want to keep. 
   Note: For internet-facing Network Load Balancers, replace PrivateIPv4Address=... with AllocationId= to assign a pre-allocated Elastic IP address.
   Note: When you remove a subnet, AWS deletes the Elastic Network Interface (ENI) and terminates all active connections in that Availability Zone. When you add the replacement subnet, AWS creates a new ENI with a different ID.

Option 2: Create a new Network Load Balancer and migrate traffic

To minimize disruption during the change, create a new Network Load Balancer with the desired IP addresses and migrate traffic to it. Complete the following steps:

1. Create a new Network Load Balancer with the desired IP address configuration.
2. Create new target groups with the same configuration as the original Network Load Balancer, and then configure listeners on the new Network Load Balancer. You can register the same targets in both the old and new target groups during the migration.
3. Replicate any additional configurations from the old Network Load Balancer to the new Network Load Balancer, such as security groups, tags, and attributes.
4. Update DNS records or client configurations to point to the new Network Load Balancer.
5. Monitor traffic migration to the new Network Load Balancer.
6. Delete the old Network Load Balancer after you confirm that traffic has shifted to the new Network Load Balancer.
   Note: Network Load Balancers have a 60-second DNS time to live (TTL). Clients that cache the DNS name might continue to connect to the old Network Load Balancer until their cache expires. Plan the migration window accordingly and don't delete the old Network Load Balancer until traffic has fully shifted.

How to temporarily reassign Network Load Balancer IP addresses to other resources

To temporarily use an IP address that's currently assigned to a Network Load Balancer, complete the following steps:

1. Create a new Network Load Balancer with different IP addresses to maintain service during the transition.
2. Create new target groups with the same configuration and configure listeners on the new Network Load Balancer.
3. Update DNS records or client configurations to point to the new Network Load Balancer.
4. Delete the old Network Load Balancer to release the desired IP address. The IP address might take a few minutes to become available.
5. Use the now available IP address to launch your EC2 instance or other resource.
6. After you complete your testing or temporary use, release the IP address from the resource. Delete the temporary Network Load Balancer and its target groups, then recreate the original Network Load Balancer with the original IP address and configuration.
   Note: After you release the IP address, there's no reservation mechanism. Other resources in the subnet could acquire the IP address before you assign it to your intended resource. To reduce this risk, minimize the time between releasing and reassigning the IP address.

Common issues and troubleshooting

Network Load Balancer IP addresses don't display in the console

For Network Load Balancers with automatically assigned IP addresses, the IP addresses don't display on the Network mapping tab of the Load balancers page. Find the IP addresses instead on the Network interfaces page.

Subnet disassociation fails

Subnet disassociation fails when the Network Load Balancer has active VPC endpoint associations (AWS PrivateLink). This applies to all subnets on the Network Load Balancer, regardless of the Availability Zone that the VPC endpoint is in. For more information, see How do I delete my Network Load Balancer that's associated with PrivateLink endpoint services?

Related information

What is a Network Load Balancer?

How do I delete a Network Load Balancer that's currently associated with another service?