Troubleshooting

Support

If you have questions that are not answered here or in other documentation, create a service request in the STACKIT Help Center.

Common LB issues

The following issues apply to both STACKIT Network Load Balancer and Application Load Balancer:

Security group assignment to target virtual machines

Works as intended: All required security groups for STACKIT Load Balancers, including traffic configurations to target virtual machines, are created and assigned automatically during setup. No manual steps are needed.

For example: When you create a load balancer named “demo-lb-01”, a security group named loadbalancer/demo-lb-01/backend is created and added to the servers in the target pool. Ingress ports open according to the ports configured in the target pool.

Load Balancer creation freezes or gets stuck

If your STACKIT Load Balancer deployment remains stuck indefinitely in STATUS_PENDING, it is likely a misconfiguration, which conflicts with the state of other components. Common causes can be the network configuration, missing infrastructure parameters, or resource exhaustion. We have listed some common causes and resolutions for these issues in the following sections.

Security group assignment conflict with backend servers

Cause:
The load balancer cannot assign a security group to a target. This happens when network interface security is turned off on the target server while disableTargetSecurityGroupAssignment is set to false on the load balancer.

Resolution: Use one of the two following options:

• Enable network interface security: Turn network interface security back on for the target VM’s network interface (NIC). You can do this in the STACKIT Portal, in the NICs section of your target server.
• Disable automatic assignment: Recreate the load balancer with disableTargetSecurityGroupAssignment set to true. The load balancer then stops managing security groups for your targets.

Missing DNS configuration in the network

Cause:
The load balancer needs DNS to reach our backends. If the network has no working DNS, the load balancer cannot connect and never reaches the Ready state.

Resolution:
Add a valid DNS server to the network. In the STACKIT Portal, open the network view, select Edit in the overview, and add a working DNS server (for example, 8.8.8.8).

Network Private IP exhaustion / network range too small

Cause:
A load balancer needs at least 7 private IP addresses to run and update smoothly. If the network’s IP range is too small, or too few addresses are free, the load balancer never reaches the Ready state.

Resolution:
Check the network where the listener of the load balancer runs. In the STACKIT Portal, make sure at least 2 private IP addresses are free. You cannot change the network of a load balancer or its number of private IPs after creation. If not enough addresses are free, either delete unused resources to free up IPs or recreate the load balancer in a network with at least 7 free private IPs.

Public networks not reachable

Cause:
Every load balancer, including internal ones, must reach public networks to talk to our backends. If your network blocks public access, the load balancer cannot connect.

Resolution:
Make sure your routing tables, firewalls, and security groups allow both inbound and outbound traffic to STACKIT’s public backend networks.

Internal IP addresses may change after OpenStack resource loss

Internal IP addresses are dynamically assigned using OpenStack DHCP. During normal operation, the same internal IP address is reassigned. However, if OpenStack resources are lost, the internal IP address may change.

Loss of all connections during failover

Because of the active/passive configuration, a connection reset will occur during failover, which may take up to a few seconds. Additionally, sessions will not be transferred to the new VM and clients will need to reconnect.

NLB-specific issues

This section lists current known issues for STACKIT Network Load Balancer.

Terraform or OpenTofu tries to change the security group of my target servers when using STACKIT Network Load Balancer

This is expected. STACKIT Network Load Balancer automatically creates and updates security groups for its targets. The security group field will change accordingly. To avoid this behavior in Terraform, use the lifecycle meta-argument.

If you want to manage your security groups manually, you can use the disableTargetSecurityGroupAssignment option. You can find more details about target security groups under “basic concepts”.