why ECS agent got disconnected

Hello.

If you are not using a VPC endpoint, it may be difficult to control it with network ACLs.
Because the ECS Agent's connection destination is managed by AWS, the destination CIDR and source CIDR will fluctuate.
In other words, I don't think it's possible to set a fixed CIDR in the NACL inbound or outbound rules.
If you have set up a VPC endpoint, you should be able to connect by allowing HTTPS in the VPC CIDR in the outbound rules and allowing the well-known port in the outbound rules.
https://docs.aws.amazon.com/AmazonECS/latest/developerguide/vpc-endpoints.html