Examkin

Soru

Zorluk: Çok zorElastic Load Balancing Health Checks and Troubleshooting

A SysOps administrator is managing a high-throughput TCP service deployed on Amazon EC2 instances. The instances are registered by instance ID to a target group associated with a Network Load Balancer (NLB) in the `eu-west-1` region. To comply with strict security standards, the target security group is configured to only allow inbound TCP port 90009000 traffic from a specific customer on-premises CIDR block (198.51.100.0/22198.51.100.0/22). While the customer can establish direct connections to individual instances during maintenance windows, all attempts to connect through the NLB fail, and the NLB target group reports the instances as unhealthy. What action must the administrator take to resolve the health check failure and restore connectivity through the NLB?

  1. A
    Add an inbound rule to the target instances' security group that allows TCP port 90009000 traffic from the public Elastic IP addresses allocated to the NLB.
  2. Add an inbound rule to the target instances' security group that allows TCP port 90009000 traffic from the VPC subnets where the Network Load Balancer (NLB) is deployed.Cevap
  3. C
    Configure the target group to use port 8080 for HTTP health checks instead of port 90009000, and update the EC2 instance web server configuration to listen on port 8080.
  4. D
    Modify the target group settings to disable client IP preservation, and configure the target instances' security group to allow inbound traffic from the Amazon Route 53 health check IP ranges.

Cevap

Add an inbound rule to the target instances' security group that allows TCP port 90009000 traffic from the VPC subnets where the Network Load Balancer (NLB) is deployed.
The correct answer is to allow inbound TCP traffic on port 90009000 from the subnets where the Network Load Balancer (NLB) is deployed. When targets are registered by instance ID, the NLB preserves the client source IP for routing actual traffic, meaning the EC2 instances see the client's IP (198.51.100.0/22198.51.100.0/22) as the source. However, health check requests from the NLB always originate from the private IP addresses of the NLB nodes themselves. If the target security group only permits traffic from the client CIDR, the NLB's health checks will be blocked, causing the target group to mark them as unhealthy. Allowing traffic from the NLB's subnets resolves this issue.

Adım Adım Çözüm

1
Analyze the load balancer type and target registration method.
Identify that a Network Load Balancer (NLB) with targets registered by instance ID preserves the client's source IP address for application traffic, but health checks originate from the NLB's private IP addresses.
To determine the network path and source IP addresses for both application traffic and health checks.
2
Examine the security group configuration of the EC2 instances.
Verify that the security group only allows inbound traffic from the customer's on-premises IP range (198.51.100.0/22198.51.100.0/22), thereby blocking the NLB's internal health check requests.
To identify why the health checks are failing despite direct client connectivity being possible during maintenance.
3
Add a rule to allow health checks.
Configure the security group of the EC2 instances to allow inbound TCP traffic on port 90009000 from the subnets where the NLB is deployed.
To permit the NLB nodes to successfully complete health checks on the registered instances.

Anahtar Kavram

NLB target security group and health check source IP behavior under client IP preservation.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Elastic Load Balancing Health Checks and Troubleshooting

Bu konudan daha fazla soru