Ports, fixed IPs, and port security
Create, edit, and delete ports on a network, reserve fixed IP addresses, set port security and allowed address pairs, and attach ports to instances.
A port connects a device, such as an instance, to a subnet. It holds the device's fixed IP address, a MAC address, the security groups that filter its traffic, and its port security setting. Create a port when you need a fixed address before the instance exists, or a port with its own filtering, and attach it to an instance later.
Before you begin
- To create, change, or delete ports, you need the Owner or Contributor role on the subscription or on the project, or a custom role with Manage access to Networking. To attach a port to an instance, a custom role also needs Manage access to Compute / Instances. To view ports, any role with Read access to Networking is enough.
- The network must not be Building, and it must have a subnet.
- The subscription's quota and the project's allocation need room for one more port. See Quotas.
View the ports of a network
In the console, go to NetworkingNetworks, open the network, and select the Ports / devices tab. The table lists the ports of the instances on the network and the ports that you created:
- Private IP lists every fixed IP address of the port.
- Owner and Device show what the port is attached to, with a link to the instance when there is one.
- Security groups links to the port's security groups.
- A port that is administratively down shows Admin down next to its status. If a port couldn't be created, the reason appears under its name.
Create a port
On the network's page, select the Ports / devices tab, and select Create port.
Under Subnet, select the subnet, and enter a Name.
Optional: under Fixed IP address, enter an address in the subnet. Leave it empty to let the subnet assign one.
Optional: enter a Description.
Keep Port security turned on, or turn it off. See Port security.
Under Security groups, leave the selection empty to give the port the project's default security group, or select the groups that you want.
Optional: under Allowed address pairs, enter an address or a block, optionally a MAC address, and select Add. See Allowed address pairs.
Select Create port. When the port exists, the console shows Port created. If the cloud refuses the port, the dialog stays open and shows the reason, on the field concerned when there is one.
| Field | Rule |
|---|---|
| Subnet | One subnet of the network. The port gets one fixed IP address from it. |
| Name | 1–60 lowercase letters, numbers, and hyphens. |
| Fixed IP address | An IPv4 address inside the subnet's block. It can't be the block's network address or its broadcast address. Leave it empty for an automatic address. |
| Port security | On by default. |
| Security groups | With no choice made, the port gets the project's default security group. If you select groups and then clear them all, the port is created without a security group. Groups need port security. |
| Allowed address pairs | An IPv4 address or block, each one once. The MAC address is optional; without one, the port's own MAC address applies. Pairs need port security. |
On an external network, the dialog notes that the port's fixed IP is already public and that a Floating IP can't be associated with it.
Edit a port
On the network's Ports / devices tab, point to the port's row, and select the pencil icon.
Change the name, the description, Admin state, Port security, the security groups, or the allowed address pairs. The fixed IP addresses can't be changed.
Select Save. The console shows Port updated.
The security groups and the allowed address pairs that you save replace the port's whole lists. About Admin state, the dialog says: A port that is administratively down stays provisioned but passes no traffic.
Port security
With port security on, the port's anti-spoofing filter lets through only the port's own addresses and its allowed address pairs, and the port's security groups filter its traffic.
With port security off, a port has no security groups and no allowed address pairs. The console clears both lists when you turn port security off, and the platform refuses groups or pairs on such a port.
Important
With port security off, no security group filters the port's traffic. The internet access check doesn't take port security into account.
If you turn port security back on in the edit dialog, select the security groups again. Otherwise the port stays without a security group.
Allowed address pairs
An allowed address pair lets an extra address through the port's anti-spoofing filter. Use pairs when an instance answers for addresses other than its fixed IP, for example:
- a virtual IP that two instances share and move between them;
- the pod address block of a Kubernetes node, such as
10.244.0.0/16; - the networks behind an instance that forwards traffic, such as a VPN or NAT instance.
The address doesn't have to be in the port's subnet. Pairs work only while port security is on.
Attach a port to an instance
In the console, go to ComputeInstances, open the instance, and select the Networking tab.
In the Select a network or port… list, select the port under Existing ports (unattached). To give the instance a new port on a network instead, select the network under New port on a network.
Select Attach NIC.
The list offers ports that aren't attached to anything and were created successfully. The platform refuses a port that is already attached elsewhere.
To detach an interface, select Detach on its row on the same tab, and confirm. The confirmation reads: The server loses this network interface and the address on it. Connections over it drop immediately.
Give a port a Floating IP
You can allocate a new Floating IP for a port from the port's row on the Ports / devices tab. See Allocate a Floating IP for a port.
Delete a port
You can delete a port that isn't attached to a device. A port that is attached to an instance has no delete action: detach it first.
On the network's Ports / devices tab, point to the port's row, and select the trash icon.
Select Delete port. The port's fixed IP address becomes free again.
Troubleshooting
| Message | Cause | Resolution |
|---|---|---|
| Port is attached to a device — detach it first, then delete. | The port is attached to a device. | Detach it from the instance first. |
| 10.0.5.20 is outside the subnet CIDR 10.0.4.0/24. | The address isn't in the selected subnet. | Enter an address in the subnet's block, or leave the field empty. |
| 10.0.4.255 is the subnet's broadcast address (10.0.4.0/24) and can't be assigned to a port. | The address is the block's broadcast address. A similar message names the block's network address. | Enter another address. |
| Enter a valid IPv4 address or address block, e.g. 10.0.1.100 or 10.0.1.0/28. | The pair isn't an IPv4 address or block. | Enter an address such as 10.0.1.100, or a block such as 10.0.1.0/28. |
| Not available while port security is off — the network service rejects security groups and address pairs on an unfiltered port. | Port security is off. | Turn on port security to set security groups or allowed address pairs. |