Deploying a single NAT gateway in each availability zone limits the fault domain for public egress to a single availability zone and prevents cross-zone cascading failures.
Solution overview
To minimize the impact of a single availability zone failure, align your cloud workloads by zone and avoid cross-zone dependencies. This high-availability architecture deploys a single NAT gateway in each zone.
As shown in the figure, if a failure occurs in availability zone A, only workloads in that zone are affected. Workloads in availability zone B and availability zone C are unaffected.
This disaster recovery mode is available in all regions that support Internet NAT Gateway. To enable this feature, contact your account manager.
Procedure
Deploy single-availability zone Internet NAT gateways in multiple availability zones
Go to the Internet NAT Gateway purchase page and create one Internet NAT Gateway for each availability zone.
Billing Method: Pay-As-You-Go.
Region: Select the region where you want to create the Internet NAT Gateway.
Network and Zone: Select the VPC and vSwitch for the Internet NAT Gateway. Create each NAT gateway in a vSwitch from a different availability zone. This setting cannot be changed after creation.
Disaster Recovery: Select Single-zone disaster recovery. The gateway is deployed within the selected availability zone and uses device-level redundancy to ensure high availability.
EIP: Select an option based on whether you have an existing EIP.
Select EIP: Select an unassociated EIP.
Purchase EIP: Select this option if you do not have an available EIP. By default, a pay-by-traffic EIP of the BGP (Multi-ISP) line type is created. You can set the Maximum Bandwidth as needed.
To associate an EIP of the BGP (Multi-ISP) Premium line type or an EIP with a different billing method, you must first apply for an EIP and then select Select EIP during creation.
Configure Later: The NAT gateway will not have public internet access until you associate an EIP.
After the gateway is created, click Associate Now in the EIP column for the target Internet NAT Gateway instance. You can then select an existing elastic IP address or create and associate a new one.
Configure an SNAT entry for each NAT gateway.
Go to the Internet NAT Gateway page. In the Actions column for the target instance, click Configure SNAT , and then click Create SNAT Entry.
SNAT Entry: The scope to which the SNAT rule applies. Select the granularity based on your management requirements.
Select EIP: From the drop-down list, select the EIPs to use for public internet access.
You can select multiple EIPs. Connections are distributed across the EIPs using a hash algorithm. Because traffic varies per connection, the load across EIPs may be uneven. We recommend adding all EIPs to the same Shared Bandwidth instance to prevent service disruption caused by a single EIP reaching its bandwidth limit.
EIP Affinity: If EIP affinity is disabled, a single private IP address might use different egress IP addresses to access the same destination. If enabled, the same egress IP address is used. However, a high number of concurrent connections to a single destination can lead to port allocation failures. You must monitor the port allocation failure drops.
After the entry is created, you can click Edit in the Actions column for the target entry to modify the EIPs and EIP affinity settings.
Configure routes by binding a separate custom route table to the vSwitch in each availability zone. In each route table, add a
0.0.0.0/0route that points to the NAT gateway in the same zone. This ensures that public traffic from each zone is routed independently.Go to the VPC console - Route tables page. In the top menu bar, select the region where the Internet NAT gateways are located.
Create a route table: Click Create Route Table, select the target VPC, and set Associated Resource Type to vSwitch.
Bind a vSwitch: On the VPC console - Route tables page, find the target route table and click Bind in the Associated Resource column. Select Associate vSwitch and choose the target vSwitch in the dialog box that appears.
Add a custom route: On the route table details page, go to the Route Entry List > Custom Route tab, and click Add Route Entry. Set Destination CIDR Block to
0.0.0.0/0and Next Hop Type to NAT Gateway. For the next hop, select the NAT gateway located in the same availability zone as the vSwitch.
Verify the configuration
Log on to the ECS instances in different availability zones and run the following command to check the egress IP address.
# Verify that the egress IP address is the EIP bound to the NAT gateway in the same availability zone.
curl ifconfig.meThe egress IP address of the ECS instance in availability zone A should be the EIP of NATGW-1, while the egress IP for the instance in availability zone B should be the EIP of NATGW-2. This difference confirms that fault domain isolation is working correctly.
Production environment best practices
Workload availability zone redundancy: Deploy your application workloads across multiple availability zones so if one zone fails, workloads in other zones continue to operate independently.
Multi-EIP redundancy: Associate multiple EIPs with the SNAT entry for each NAT gateway. If one EIP becomes unavailable due to an attack, traffic can still flow through the other EIPs.
Monitoring and alerts: Configure alerts for key metrics on each NAT gateway, such as concurrent connections, ingress/egress bandwidth, and port allocation failure drops. This allows you to scale up resources before they become bottlenecks.
Dedicated vSwitches: Create a dedicated vSwitch for each NAT gateway and reserve enough private IP addresses to prevent IP address exhaustion, which can block the association of new EIPs.