This topic answers common questions about associating and disassociating EIPs.
-
Can I associate an EIP with multiple cloud resources at the same time?
-
Can I associate an EIP with a resource in a different region?
-
Why can't I find the associated CLB instance in the EIP console?
Which cloud resources can an EIP be bound to?
You can associate an EIP with the following cloud resources: ECS instances in a VPC, secondary ENIs, SLB instances, NAT Gateways, and high-availability virtual IP addresses (HAVIPs).
You can associate an EIP with SLB instances, including internal-facing CLB instances in a VPC, ALB instances, and NLB instances. To associate an EIP with an ALB or NLB instance, you must use the SLB console.
-
When you create an Internet-facing ALB instance or NLB instance, you can choose to automatically allocate an EIP or select an existing EIP. For more information, see Create an Internet-facing ALB instance or Create an Internet-facing NLB instance.
-
When you change the network type of an internal-facing ALB instance or NLB instance to Internet-facing, an EIP is allocated to the instance. For more information, see Change the network type of an internal-facing ALB instance to Internet-facing or Change the network type of an internal-facing NLB instance to Internet-facing.
Can a single EIP be bound to multiple cloud resources simultaneously?
No. You can associate an EIP with only one cloud resource at a time.
EIP: Does it support cross-region association?
No.
An EIP and the resource you want to associate it with must be in the same region. For example, you cannot associate an EIP in the China (Beijing) region with a resource in the China (Hangzhou) region.
EIP: Is cross-zone association supported?
Yes.
EIPs are not constrained by zones. You can associate an EIP with a cloud resource as long as the resource is in the same region as the EIP.
How many EIP can be associated with a cloud resource?
-
Elastic Compute Service
You can associate an ECS instance with only one EIP. However, you can associate multiple EIPs with an ECS instance by attaching secondary ENIs to the instance.
-
Attach multiple secondary ENIs to a single ECS instance and associate one EIP with each secondary ENI. The number of secondary ENIs that you can attach to an ECS instance varies by instance type. For more information, see Instance families.
-
Attach one secondary ENI to a single ECS instance, assign multiple secondary private IP addresses to the ENI, and then associate each EIP with one of the secondary private IP addresses. For more information, see Associate multiple EIPs with an ECS instance in NAT mode.
-
-
Secondary ENI
When you associate EIPs with a secondary ENI in NAT Mode, the number of EIPs that you can associate depends on the number of private IP addresses assigned to the secondary ENI.
The number of secondary private IP addresses that you can assign to a secondary ENI depends on the state of the ENI and the instance type of the ECS instance to which the ENI is attached. For more information, see Usage notes.
-
NAT Gateway
An Internet NAT Gateway can be associated with up to 20 EIPs.
Starting from September 19, 2022, when you associate an EIP with a newly created Internet NAT Gateway, the EIP consumes a private IP address from the NAT Gateway's vSwitch. This does not affect existing NAT Gateway instances. Make sure that the vSwitch has sufficient private IP addresses. If no private IP addresses are available in the vSwitch, you cannot associate new EIPs.
-
HAVIP
A high-availability virtual IP address (HAVIP) instance can be associated with only one EIP.
-
Server Load Balancer (SLB)
-
An internal-facing CLB instance in a VPC can be associated with only one EIP.
-
An ALB instance can be associated with multiple EIPs. The number of EIPs depends on the number of zones in the region where the ALB instance is deployed. Each zone supports one EIP.
-
An NLB instance can be associated with multiple EIPs. The number of EIPs depends on the number of zones in the region where the NLB instance is deployed. Each zone supports one EIP.
-
Does EIP support binding to a CLB instance?
You can associate an EIP with an internal-facing CLB instance in a VPC, but not with an Internet-facing CLB instance. An internal-facing CLB instance in a VPC can be associated with only one EIP.
Why is the bound CLB instance not visible in the EIP console?
The associated CLB instance may not be visible in the console for the following reasons:
-
The EIP and the CLB instance belong to different resource groups.
-
You are logged on as a RAM user. If so, log on with your Alibaba Cloud account and try again.
Can an ECS instance that is already bound with an EIP still use the DNAT feature of a NAT Gateway to provide services to the internet?
No.
The following limits apply:
-
If your ECS instance is already associated with an EIP, you cannot use the DNAT feature of a NAT Gateway to provide Internet services.
To use the DNAT feature of a NAT Gateway, first disassociate the EIP from the ECS instance. Then, add a DNAT entry for the ECS instance. For more information, see Internet NAT Gateway and Create and manage DNAT entries.
-
If you have already added a DNAT entry for an ECS instance, you cannot associate an EIP with that ECS instance.
To associate an EIP with the ECS instance, first delete the DNAT entry for the ECS instance. After you delete the entry, you can associate an EIP with the ECS instance. For more information, see Internet NAT Gateway and Create and manage DNAT entries.
If an existing ECS instance is associated with an EIP and is also included in a DNAT entry of a NAT Gateway, the ECS instance uses the associated EIP for Internet communication by default.
Why can't an EIP be associated with an ECS instance?
You may be unable to associate an EIP with an ECS instance for one of the following reasons:
-
The EIP and the ECS instance are in different regions.
-
The ECS instance already has a EIP or is associated with another EIP.
-
The ECS instance is in a EIP instead of a VPC. You can associate an EIP only with an ECS instance in a VPC.
-
The ECS instance is in an invalid state. You can associate an EIP only with an ECS instance that is in the Running or Stopped state.
Follow these steps to troubleshoot the issue:
-
Check the regions of the EIP and the ECS instance and ensure they are in the same region, such as China (Hangzhou).
-
Log on to the ECS console and check the target ECS instance. Make sure that the instance meets the following requirements. You can view the IP address, network type, and status of the instance on the Instances page in the ECS console.
Item
Description
①
The ECS instance has only a private IP address.
If your ECS instance already has a EIP or is associated with another EIP, you do not need to associate another EIP.
In the IP Address column on the instance list page, a public IP address followed by the Elastic tag indicates an associated EIP. A public IP address followed by the Public tag indicates an assigned public IP address. If only a private IP address is displayed, the instance does not have a public IP address. If you have other requirements, see the following topics:
②
The network type of the ECS instance is VPC.
If the target ECS instance is in a classic network, you can migrate it to a VPC. For more information, see Migrate ECS instances from the classic network to a VPC.
③
The ECS instance is in the Running or Stopped state.
If your ECS instance is in an abnormal state, see Instance lifecycle to learn how to manage the ECS instance status.
After an EIP is associated with an ECS instance, why is the EIP not visible on the ECS network interface?
An EIP is configured on an Internet gateway and mapped to the private network interface card of an ECS instance by using Network Address Translation (NAT). Therefore, the private network interface card of the ECS instance does not show the EIP.
You can use the secondary CIDR block feature of a Virtual Private Cloud (VPC) to make the primary private IP address of a secondary ENI the same as the EIP. This makes the EIP visible on the network interface. For more information, see Make an EIP visible on an ENI.
An ECS instance can be bound to only one EIP, so how can an ECS instance be associated with multiple EIPs?
You can use the following methods to associate multiple EIPs with an ECS instance:
-
Associate one EIP with each secondary ENI, and then attach the secondary ENIs to an ECS instance. The number of secondary ENIs that you can attach to an ECS instance varies by instance type. For more information, see Instance families.
-
Associate EIPs with a secondary ENI in NAT Mode. In this mode, you can associate multiple EIPs with individual secondary private IP addresses on the secondary ENI, and then attach the secondary ENI to an ECS instance. For more information, see Associate multiple EIPs with an ECS instance in NAT mode.
Why is a service inaccessible over the Internet after an ECS instance or an ENI is associated with an EIP?
If the application deployed on the ECS instance needs to initiate outbound traffic to the Internet, you must configure a default route or specific routes on the ECS instance. By default, traffic routes through the primary network interface. You can change the route priority to route traffic through an ENI. You can also configure specific routes to distribute traffic across multiple network interfaces for load balancing or route traffic randomly through a specific network interface.
For a route configuration example, see (Optional) Step 4: Configure routes.
Using IPv6 addresses on an ECS instance
Yes. For more information, see Enable IPv6 communication for an ECS instance.
Is EIP supported for use as an origin IP for WAF?
Yes.