Alibaba Cloud ECS instance public network IP change causes service disconnection: Elastic Public Network IP(EIP) Unbinding and Binding Pit Guide
"The website suddenly can't open! API interface full line 502/connection timeout!"
In a seemingly ordinary operation and maintenance routine, if your monitoring group suddenly receives a large number of service disconnection alarms, and after investigation, it is found that the CPU, memory and disk of the server itself are all normal, then there is a high probability that you will run into the most classic and easy-to-take problem in the field of cloud computing--
The public IP address of the ECS instance has changed.
.
In the actual operation and maintenance of Aliyun, many beginners and even experienced engineers have confused "fixed public network IP" with "elastic public network IP(EIP)", or stepped on holes in the process of unbinding and rebinding EIP, resulting in unnecessary downtime for online services. Today, we will start with a real production failure, thoroughly explain the underlying logic of Aliyun ECS public network IP, and provide both hands with a practical EIP unbinding/binding avoidance guide.
1. Failure Site: Why Did Public Network IP Suddenly Change?
Many classmates who have just come into contact with ariyun have a misconception: they think that if they buy an ECS instance and assign a public network IP, this IP will follow this server for a lifetime. However, in actual business operations, the following common scenarios will cause the fixed public network IP to change or become invalid:
Instance deployment or pay-as-you-go downtime (VPC instances in proprietary networks): When the "stop without charge" mode is enabled, when the ECS instance that pays for the volume is shut down, the system will automatically release the fixed public network IP assigned to the instance. When you turn it on again, the system will reassign a new public IP. If your business code, third-party payment callback, domain name DNS resolution or firewall white list kills the original IP, service disconnection is almost inevitable.
Instance migration or cross-zone change: When ECS is migrated to another zone due to physical machine failure, maintenance, or architecture adjustment, the fixed public network IP often cannot follow across the zone.
Misoperation release and redistribution: When modifying the network configuration or changing the public network bandwidth billing mode, the fixed IP is mistakenly released, resulting in the failure to retrieve the original IP.
Core lesson: For the production environment, it is very dangerous to rely on the "fixed public network IP" automatically allocated by ECS. True cloud native architecture, computing resources (ECS) must be decoupled from network portal resources (IP)
. The core key to achieving this decoupling is
Elastic IP(EIP) (Elastic IP)
.
2. What Is an Elastic IP(EIP) and Why Is It a Decoupling Thread?
To put it simply, an Elastic IP(EIP) is a public IP address resource that can be purchased and held independently. It is not physically bound to any specific ECS instance, but exists as an independent cloud resource under your Alibaba Cloud account.
The three core advantages of EIP:
Independent holding and life cycle: its application, retention and release.
is completely independent of the ECS instance. Even if your ECS is shut down, destroyed or rebuilt, the EIP will remain firmly in your account and the IP address will never change.
Flexible unbinding and second-level binding: You can unbind an EIP from instance A and quickly bind it to instance B at any time. This is extremely useful in server hardware failure emergency, blue-green deployment, and seamless version switching.
Rich binding objects: In addition to ECS instances, EIP can also be bound to secondary elastic network cards (ENI), internal load balancing (SLB/ALB), NAT gateways, etc. It is the basis for building complex cloud network topologies.
Record of 3. Stepping Pit: 4 High Frequency "Traps" in EIP Unbinding and Binding Process"
Since EIP is so easy to use, why do people still repeatedly step on the pit in actual operation? We have summarized four key details that are most easily overlooked in the process of EIP unbinding and rebinding:
Pit 1: Fixed public network IP cannot be directly "transferred" to EIP
After suffering from IP changes, the first reaction of many teams is: "Can I directly convert my existing ECS fixed public network IP into EIP?" The answer is:
Specific conditions need to be met
. Although Alibaba Cloud supports converting the fixed public IP of a VPC ECS instance to an EIP, the premise is that the fixed IP must be in the running state and the billing method will change after the conversion. If you destroy the instance directly or in the shutdown state, the fixed IP can no longer be retrieved once it is released.
Pit 2:EIP Encountered "Arrears Stopped" or High Idle Fees after Unbundling
In the billing logic of EIP, there is a rule that novices can easily ignore:
When an EIP is tied to an ECS instance, only the bandwidth fee or traffic fee is usually charged. However, when the EIP is in the "unbound (idle)" state, Alibaba Cloud will charge an IP occupation fee (idle fee) by the hour.
.
More seriously, if the balance of the cloud account is insufficient during the operation of high concurrent services or large-scale network adjustment, the EIP will instantly enter the "overdue disabled" state, resulting in the instantaneous interruption of the bound public network service. In the process of operation and maintenance, many enterprises often focus on technical configuration, but ignore the health of the financial status of cloud accounts. Especially when multiple cloud products such as enterprise multi-project parallel, high-security CDN, EIP elastic expansion are used in superposition, sudden large traffic or resource changes can easily lead to the account balance being emptied instantly. In order to ensure 7x 24 high availability of the production environment, many mature enterprise operations and finance teams will choose to use professional service channels.
Alibaba Cloud account recharge
, through pre-deposit quota, public payment, issuance of VAT special tickets and setting of credit limit alarms, etc., to ensure that cloud core network resources will never be unexpectedly shut down due to the interruption of funds.
Pit 3:ARP Cache and DNS Effective Delay ("I have already tied up, why can't I connect?")
When you will EI
After P is unbound from the old ECS and quickly bound to the new ECS, it is often found that it is still inaccessible for a short period of time. This is usually not a problem with the EIP itself, but rather:
Local/operator DNS cache: if your client accesses through domain name, although IP is tied to the new server, the client still resolves to the old IP or the local DNS has not been refreshed.
The security group is not synchronized with the firewall: The security group (Security group) of the new ECS instance does not allow the corresponding service port (such as 80, 443, and 22), or the internal iptables / firewalld of the system blocks the traffic from the EIP.
Pit 4: Routing conflict when multiple network cards are bound to secondary network cards
When an EIP is bound to an ENI of an ECS instance or multiple EIPs are bound to the same ECS instance, if the default route and policy route (Policy Routing) are not correctly configured in the operating system, the packet can enter, but the packet returns to the wrong network adapter. The appearance is that the public network is completely blocked.
4. standardization: standard process for seamless switching between EIP unbinding and binding
In order to achieve "zero error" during business switching, it is recommended that the operation and maintenance team strictly follow the following standard SOP for EIP changes:
Pre-change check: confirm that the new ECS instance has been deployed and the service local health check has passed (such as curl [ht
tp://127.0.0.1:8080](ht
tp:// 127.0.0.1:8080) returns 200). Check the security group rules of the new ECS instance to ensure that the necessary inbound ports are opened. Check the recharge and balance of the Alibaba Cloud account to ensure that the account has sufficient funds and prevent resource locking due to arrears during the change.
Unbind the old instance: Log on to the Alibaba Cloud console and enter the Elastic IP Address list. Find the target EIP and click Unbind ". The unbinding process is usually completed within seconds.
Bind a new instance: Click Bind Resource in the same list, select VPC ECS instance as the resource type, select the corresponding new ECS instance and NIC, and confirm the binding.
Connectivity verification: Use an independent terminal outside the network to directly ping the EIP to verify the ICMP response. Use telnet or nc -zv [EIP] [PORT] to test service port connectivity. Initiate a real service request to confirm that the service is back to normal.
5. Architecture Evolution: How to Fundamentally Avoid the Risks of IP Changes?
Upgrading a fixed IP address to an EIP is only the first step in optimizing the cloud architecture. To completely say goodbye to the shadow of "IP changes leading to service disconnection", it is recommended that enterprises evolve from the architecture level as follows:
Direct connection to ECS public network IP is completely prohibited in the production environment: ECS is deployed in a private subnet (Privat
E Subnet), only the private network IP is retained. All public network traffic is introduced through SLB/ALB (load balancing) or API gateway. Even if the back-end ECS is arbitrarily destroyed, expanded, or migrated, the front-end portal IP will never change.
Domain name and CNAME dependency: Business interactions are based on domain names. It is strictly forbidden to use hard-coded (Hardcode)IP addresses in client code, app server configuration, or third-party callbacks.
Use NAT Gateway to collect outbound traffic: If multiple ECS instances only need to actively access the public network (for example, call a third-party interface or download an update package), there is no need to assign EIP to each machine, and the NAT Gateway EIP combination is uniformly configured to realize highly available and cost-effective outbound channels.
6. Summary
In the era of cloud computing, the stability of the network entrance is the lifeline of the business. The change of the public IP of Alibaba Cloud ECS instance seems to be a small probability event, but once it occurs, the impact on the business is often devastating. by introducing
Elastic IP(EIP)
To realize the decoupling of computing and network, combined with standardized operation process, abundant account fund guarantee and highly available load balancing architecture, we can completely kill this risk in the cradle.
