Examkin

Soru

Zorluk: ZorElastic Load Balancing Health Checks and Troubleshooting

A company has deployed a TCP-based application on a fleet of Amazon EC2 instances in a private subnet. The instances are registered as targets in a target group for an internet-facing Network Load Balancer (NLB) using the 'instance' target type. The application listens on port 9000, and the target group is configured with TCP health checks on port 9000. The NLB has client IP preservation enabled. A SysOps Administrator observes that all EC2 instances are marked as unhealthy in the target group, and clients are unable to connect to the application. Which two configurations must the SysOps Administrator verify or apply to resolve this issue? (Select two.)

  1. The security group associated with the EC2 instances allows inbound TCP traffic on port 9000 from the client IP ranges.Cevap
  2. The security group associated with the EC2 instances allows inbound TCP traffic on port 9000 from the private IP addresses of the load balancer nodes.Cevap
  3. C
    The security group associated with the EC2 instances allows inbound TCP traffic on port 9000 from the security group of the Network Load Balancer.
  4. D
    The target group health check settings are updated to use HTTP protocol on port 80 and the path is set to /index.html.
  5. E
    The DNS routing configuration in Route 53 is updated to use a failover routing policy that routes client traffic directly to the EC2 instances if the NLB reports them as unhealthy.

Cevap

The correct configurations are to configure the security group associated with the EC2 instances to allow inbound TCP traffic on port 9000 from the client IP ranges, and to allow inbound TCP traffic on port 9000 from the private IP addresses of the Network Load Balancer nodes.
To resolve the issue, the security group associated with the EC2 instances must be configured to permit inbound traffic on the service port from both the clients and the load balancer. Because client IP preservation is enabled on the Network Load Balancer (NLB) for target groups of type 'instance', the source IP addresses of the client traffic are preserved. Therefore, the target EC2 instances receive requests with the clients' public IP addresses as the source, meaning the security group must allow inbound traffic from the client IP ranges. Concurrently, NLB health checks originate from the private IP addresses of the load balancer nodes. To make the targets healthy, the security group must also allow inbound TCP traffic on port 9000 from the load balancer's private IP addresses.

Adım Adım Çözüm

1
Analyze the load balancer type and target registration type.
The architecture uses an internet-facing Network Load Balancer (NLB) with targets registered by 'instance' target type and client IP preservation enabled.
Understanding the load balancer and registration type dictates how source IP addresses are handled at the target level.
2
Determine the source IP for client traffic reaching the targets.
Since client IP preservation is enabled and targets are registered by instance ID, the source IP of client traffic is the client's actual public IP address.
This determines that the target's security group must permit inbound traffic from the client IP ranges rather than the load balancer.
3
Determine the source IP for load balancer health check traffic reaching the targets.
NLB health check requests always originate from the private IP addresses of the load balancer nodes.
This determines that the target's security group must permit inbound traffic from the private IP addresses of the load balancer nodes (or the VPC CIDR) for health checks to succeed.
4
Select the two configuration adjustments required to allow traffic flow.
Adjust the EC2 security group to allow inbound port 9000 traffic from the clients (for application traffic) and from the NLB node private IPs (for health checks).
Both configurations are required: passing health checks makes targets healthy, and permitting client IPs allows actual traffic routing.

Anahtar Kavram

Network Load Balancer client IP preservation and health check source IP routing requirements.
Bu soruyu puanla

Konular

Elastic Load Balancing Health Checks and Troubleshooting

Bu konudan daha fazla soru