Associate an EIP with a cloud resource - Elastic IP Address

Associate an Elastic IP Address (EIP) with a cloud resource to enable internet access for the resource.

Associate with cloud resources

You can associate EIPs with the following cloud resources: ECS, Elastic Network Interface (ENI), ALB/NLB/CLB, public NAT Gateway, and high-availability virtual IP address (HaVip).

Associate with an ECS instance

You can directly associate an EIP with an Elastic Compute Service (ECS) instance that is in the same region and deployed in a virtual private cloud (VPC).

An ECS instance can be associated with only one EIP.
Before you associate an EIP, make sure the ECS instance is in the Running or Stopped state. The instance cannot have a public IP address or another EIP.
An EIP is associated with an ECS instance in NAT mode. In this mode, the EIP can process only address and port information at the IP and transport layers. It does not support protocols that require a NAT Application Layer Gateway (NAT ALG).

Console

Associate an EIP with an ECS instance

Go to the Elastic IP Addresses page. In the top menu bar, select the region where the EIP is deployed.
Find the target EIP. In the Actions column, click Associate with Resource. Select ECS Instance and then select the target ECS instance.

Change the EIP of an ECS instance

To change the EIP for an ECS instance, you must first disassociate the current EIP and then associate a new one.

Retrieve an EIP

An EIP does not change. However, it may be released if it expires or if you have overdue payments on your account. You can try to retrieve an EIP that was released from your account within the last seven days.

API

Call the AssociateEipAddress operation. Set InstanceType to EcsInstance to associate the EIP with an ECS instance.

Associate with an ENI (multiple EIPs per instance)

An ECS instance can be directly associated with only one EIP. To deploy multiple independent internet-facing services on a single ECS instance, you can associate multiple EIPs with the ENIs of the instance in NAT mode.

The number of secondary ENIs that an instance type supports varies.

After you attach a secondary ENI to an ECS instance, some images cannot automatically detect the IP address of the ENI and add a route. In this case, you must configure the secondary ENI.

In NAT mode, an EIP is associated with an ENI. This mode does not support protocols that require a NAT ALG. You can associate EIPs with primary and secondary ENIs. The number of EIPs that you can associate depends on the number of private IP addresses that are assigned to the ENI. The EIPs and private IP addresses have a one-to-one mapping.

Multiple ENIs: Attach multiple secondary ENIs to a single ECS instance and associate one EIP with each secondary ENI. You can associate different security groups with each ENI and configure different network isolation policies to implement fine-grained security controls.
Multiple EIPs on a single ENI: If you do not require network isolation and only need multiple EIPs to host different services, you can attach one secondary ENI to a single ECS instance. Then, assign multiple secondary private IP addresses to the ENI and associate an EIP with each secondary private IP address in NAT mode.

Console

Associate with an ENI

Go to the Elastic IP Addresses page. In the top menu bar, select the region where the EIP is deployed.
Find the target EIP. In the Actions column, click Associate with Resource. Select Elastic Network Interface, select NAT mode, and then select the target secondary private IP address.

API

Call the AssociateEipAddress operation to associate an EIP with an ENI.
- Set InstanceType to NetworkInterface.
- Set Mode to NAT.
Call the AssociateEipAddressBatch operation to associate multiple EIPs with secondary ENIs in a single call.

Associate with an ENI (EIP-visible mode)

An EIP is mapped to the private NIC of an ECS instance using NAT. Therefore, the NIC of the ECS instance can detect only the private IP address, not the EIP. You can use EIP-visible mode to associate an EIP with a secondary ENI to make the EIP visible on the NIC.

After you associate an EIP in EIP-visible mode, you cannot access the 100.64.0.0/10 CIDR block. This CIDR block is reserved for internal communication between Alibaba Cloud services. Make sure that a route with the destination CIDR block 100.64.0.0/10 points to the primary ENI or another secondary ENI that is not associated with an EIP in EIP-visible mode.
Associating an EIP with a secondary ENI in EIP-visible mode has many limitations. We recommend that you use a secondary CIDR block for the VPC to make the EIP visible on the ENI. To do this, configure a public CIDR block as a secondary CIDR block for the VPC. Then, create a secondary ENI in the CIDR block, associate an EIP with the ENI, and attach the ENI to an ECS instance. After that, you can manage the EIP directly in the operating system.

After you attach a secondary ENI to an ECS instance, some images cannot automatically detect the IP address of the ENI and add a route. In this case, you must configure the secondary ENI.

After the association, the ECS instance automatically adds a route that uses the secondary ENI as the outbound interface. The priority of this route is lower than the route that uses the primary ENI as the outbound interface. Adjust the route priority as needed.

EIP-visible mode (not recommended): The EIP replaces the private IP address of the secondary ENI. This turns the ENI into a public-only network interface and makes the private IP address unavailable.

This mode is not supported for primary ENIs. You can associate an EIP only with the primary private IP address of a secondary ENI.
You must first associate the EIP with the secondary ENI, and then attach the ENI to the ECS instance.
In this mode, the private network function of the ENI is disabled. If a subscription EIP expires and is released, you must first detach the secondary ENI from the ECS instance and then re-attach it to restore the private network function.
Supported regions: China (Hangzhou), China (Shanghai), China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Shenzhen), China (Guangzhou), China (Chengdu), Singapore, Indonesia (Jakarta), Germany (Frankfurt), UK (London), US (Virginia), and SAU (Riyadh - Partner Region).
The EIP supports all IP protocols, including protocols that require a NAT ALG.
The VPC to which the secondary ENI belongs does not have an IPv4 gateway.

Multi-EIP visible mode (no longer accepting new applications): In this mode, both the private and public IP addresses on the secondary ENI are available. However, this mode is no longer available for new applications. Only users who were previously granted access can continue to use it.

This mode is not supported for primary ENIs. A secondary ENI supports up to 10 EIPs.
Supported regions: China (Shenzhen), China (Shanghai), China (Beijing), China (Zhangjiakou), China (Chengdu), Singapore, Germany (Frankfurt), US (Virginia), and UK (London).
Supported instance types: ecs.d1ne, ecs.ebmc4, ecs.ebmg5, ecs.ebmhfg5, ecs.f1, ecs.gn5i, ecs.gn6v, ecs.i2, ecs.r1, ecs.re4, ecs.re4e, ecs.sccg5, ecs.sccgn6, ecs.scch5, ecs.g5, ecs.c5, ecs.r5, ecs.t5, ecs.sn2ne, ecs.se1ne, and ecs.sn1ne.
The EIP supports all IP protocols, including protocols that require a NAT ALG.
After you enable Multi-EIP-to-ENI Mode, the DHCP feature must be enabled on the ECS instance to which a secondary ENI is attached for the Multi-EIP-to-ENI Mode to take effect.
After the association, call the DescribeEipGatewayInfo operation to query the gateway and subnet mask of the EIP. Then, configure multiple EIPs for the ECS instance by changing the gateway and mask of the secondary private IP address to the gateway and mask of the EIP.

Console

Associate with an ENI

Go to the Elastic IP Addresses page. In the top menu bar, select the region where the EIP is deployed.
Find the target EIP. In the Actions column, click Associate with Resource. Select Elastic Network Interface, select EIP-visible mode, and then select the target secondary private IP address.

API

Call the AssociateEipAddress operation to associate an EIP with an ENI.
- Set InstanceType to NetworkInterface.
- Set Mode to BINDED or MULTI_BINDED.
Call the AssociateEipAddressBatch operation to associate multiple EIPs with secondary ENIs in a single call.

Associate with a NAT Gateway: Centralized egress

Configuring an EIP for each ECS instance increases costs when multiple instances need to access the internet. Use the SNAT feature of a public NAT Gateway to allow multiple ECS instances to share EIPs for internet access. This saves costs and improves security by hiding the real IP addresses of the instances and restricting inbound connections.

A public NAT Gateway supports up to 20 EIPs.
For public NAT gateways created after September 19, 2022, associating an EIP consumes a private IP address from the vSwitch where the NAT gateway is deployed. This does not affect existing NAT gateway instances. Make sure that the vSwitch has sufficient private IP addresses.

Console

Associate with an ENI

Go to the Elastic IP Addresses page. In the top menu bar, select the region where the EIP is deployed.
Find the target EIP. In the Actions column, click Associate with Resource. Select NAT Gateway Instance and then select the target public NAT Gateway instance.

API

Call the AssociateEipAddress operation. Set InstanceType to Nat to associate an EIP with a public NAT Gateway.
Call the AssociateEipAddressBatch operation to associate multiple EIPs with a public NAT Gateway in a single call.

Associate with a load balancer: Centralized ingress

We recommend that you use Application Load Balancer (ALB) and Network Load Balancer (NLB). You can add backend servers from different zones to the load balancers. This distributes traffic across different backend services to increase the throughput capacity of your application, eliminate single points of failure, and improve availability.

Console

Associate with an ALB or NLB instance

You cannot associate an EIP from the Elastic IP Addresses page.

Attach when creating a new instance: Go to the ALB purchase page or the NLB purchase page, and create a Public ALB instance or NLB instance.
Change the instance network type: Go to the ALB list page or the NLB list page and select the region of the instance from the top menu bar. Click the target instance ID to go to the details page and change the Network Type to Public network.

Associate with a CLB instance

Go to the Elastic IP Addresses page. In the top menu bar, select the region where the EIP is deployed.
Find the target EIP. In the Actions column, click Associate with Resource. Select Server Load Balancer (SLB) Instance and then select the target CLB instance.

API

Call CreateLoadBalancer and set AddressType to Internet to create a public ALB instance.
Call UpdateLoadBalancerAddressTypeConfig and set AddressType to Internet to change the network type of an ALB instance to public.
Call CreateLoadBalancer and set AddressType to Internet to create a public NLB instance.
Call UpdateLoadBalancerAddressTypeConfig and set AddressType to Internet to change the network type of an NLB instance to public.
Call AssociateEipAddress and set InstanceType to SlbInstance to associate an EIP with a CLB instance.

Associate with an HaVip: IP failover

Use the high-availability virtual IP address (HaVip) feature to keep the service IP address unchanged during an active-standby switchover between servers in the same zone. After you associate an EIP with an HaVip, the HaVip can provide a high-availability, internet-facing service through the EIP.

Before you use an HaVip, log on to the Quota Center console to request the permission to create HaVips. A quota of 1 indicates that you can create HaVips. By default, each account can create up to 50 HaVips.
An HaVip can be associated with only one EIP.
The HaVip must be in the Available or Allocated state.

Console

Associate with an HaVip

Go to the Elastic IP Addresses page. In the top menu bar, select the region where the EIP is deployed.
Find the target EIP. In the Actions column, click Associate with Resource. Select High-availability Virtual IP and then select the target HaVip instance.

API

Call the AssociateEipAddress operation. Set InstanceType to HaVip to associate an EIP with an HaVip.

Disassociate from a cloud resource

After you disassociate a pay-as-you-go EIP from a resource, you are still charged an EIP configuration fee (for holding the public IP address). If you no longer need the EIP, release it promptly.
After you disassociate a subscription EIP from a resource, you can unsubscribe from it if you no longer need it.

Console

Find the target EIP and click Disassociate Resource in the Actions column.

API

Call the UnassociateEipAddress operation to disassociate an EIP from a cloud resource.