NLB Health Check Configuration — Troubleshooting Steps

Quick Answer

Diagnosing why a Network Load Balancer isn't routing traffic to healthy targets means working through the chain of things that all have to be true simultaneously for a target to receive traffic: it has to be registered in the target group and in the Available state, network paths including security group rules have to actually allow the health check and client traffic through, and the health check itself has to be configured correctly. Health check settings such as the ping path, port, and protocol are a common root cause because if they're misconfigured, the NLB can mark genuinely healthy instances as unhealthy simply because it's probing the wrong endpoint or port, which looks identical to a real outage from the load balancer's perspective. Security group rules on the target instances matter for the same reason - if the security group doesn't allow traffic from the NLB, health checks will fail even though the application itself is running fine. Confirming targets are registered and in the Available state rules out the simplest possible cause before digging into configuration details. Cross-zone load balancing and CloudWatch metrics, by contrast, aren't diagnostic starting points for this specific symptom: cross-zone balancing only affects how traffic is distributed across AZs once targets are already healthy, and CloudWatch metrics are better suited to spotting trends after the fact than to root-causing why targets are currently marked unhealthy. When you see an NLB not routing to healthy targets, work through registration status, security groups, and health check configuration first.