Elastic IP Address:EIP troubleshooting

Prerequisites

• You have activatedNetwork Intelligence Service (NIS).

• When you run a diagnosis for the first time, the system automatically creates the service-linked roleAliyunServiceRoleForNis to obtain the required permissions.

Instance diagnosis

Run automated health checks on an EIP to identify issues related to configuration, capacity, security, and billing, and receive remediation suggestions.

1. Go to the EIP console, select a region, and then click the ID of the target EIP.

2. On the Diagnose tab, run a diagnosis. You can select Show All Diagnostic Items to view all diagnostic results. You can also go to the NIS instance diagnosis page to view historical results.

   Diagnostic items

   Category	Checks
   Configuration Diagnostics	Instance Status EIP Allocation Status
   Quota Limit Diagnostics	High EIP Bandwidth Usage Packets Dropped Due to EIP Bandwidth Throttling
   Security Policy Diagnostics	Anti-DDoS Origin Basic Status Interception by Cloud Firewall Penalty for Security Control Suspension for Security Reasons
   Cost Diagnostics	Alerts for Overdue Payments Alerts for Expiration

3. To further investigate issues related to public network ISPs, click Internet Diagnostics at the bottom of the page. You can then set an access region to check the public network connectivity to the target EIP from ISPs both within and outside the Chinese mainland.

   Common causes of connectivity issues

   Cause	Actions
   Cloud security policies	DDoS blocking: Anti-DDoS Basic automatically sets a scrubbing threshold based on the EIP bandwidth. If inbound traffic exceeds the protection capacity of Anti-DDoS Basic, a blackhole route is triggered and all inbound traffic is blocked. Check the protection threshold in the Anti-DDoS console. WAF blocking: After you add your website to Web Application Firewall (WAF), access exceptions may occur. Cloud Firewall blocking: Cloud Firewall inspects traffic for public IP assets. Check whether any access control policies are blocking the traffic.
   Resource-side security policies	Check the iptables rules, operating system (OS) firewall, third-party security software, and network interface card (NIC) drivers on the associated resource instance.
   ISP blocking	Run a diagnosis to identify the affected area. If ISP blocking occurs: Contact the ISP to confirm the cause. To view public network performance data, add the VPC Flow Logs of the elastic network interface (ENI) to an NIS traffic analyzer. If the service is critical, you can replace the EIP: unbind the original EIP and then bind a new EIP.

Reachability Analyzer

If an EIP is unreachable, you can use Reachability Analyzer to test the connectivity between the EIP and a destination resource and diagnose network configuration issues. The analysis does not send real data packets or affect your services.

1. Go to the EIP console, select a region, and in the Diagnose column of the target EIP, click Diagnose > Reachability Analyzer.

2. Select the Source and Destination resources, configure the Protocol, Destination Port, and an analysis name, and then click Start Analyzing.

3. After the analysis is complete, Reachability Analyzer displays a hop-by-hop virtual network path from the source to the destination. If the path is blocked, the analyzer identifies the blocking point and its cause.

Traffic analysis

EIPs integrate with the public traffic analysis feature of NIS. You can use an NIS traffic analyzer to view the volume and ranking of inbound and outbound EIP traffic, displayed as 2-tuples or 5-tuples. You can use this traffic data and monitoring metrics to troubleshoot issues.

• NIS Traffic Analyzer detects Internet traffic through VPC flow logs, which collect traffic information only from elastic network interfaces (ENIs). As a result, NIS Traffic Analyzer cannot guarantee collection of Internet traffic from IP targets or Classic Load Balancer (CLB) instances.

• VPC flow logs support traffic collection at VPC, vSwitch, and ENI granularity, but do not support filtering for Internet traffic only. To get complete Internet traffic analysis data, enable traffic analysis for the required VPCs. NIS Traffic Analyzer parses Internet traffic from VPC flow logs. To analyze traffic for a specific public IP address, enable traffic analysis for the ENI that the public IP address is bound to.

1. Create an NIS traffic analyzer.

2. Create VPC Flow Logs as a data source. To collect traffic data from an elastic network interface (ENI) that is bound to an EIP, set Resource Type and Resource Instance to the target ENI.

3. View public traffic analysis charts.

Self-service troubleshooting

Go to the self-service troubleshooting page, select an issue category, and follow the on-page guidance to find relevant documentation and recommended actions.