Handling Static IPs When Moving On-Premises Servers to AWS EC2

When you migrate on-prem servers to AWS, you can’t bring your physical static IPs with you, since AWS controls its own IP ranges.
You can, however, achieve the same “static” behavior using AWS features.

1) Public-Facing Servers

Use Elastic IPs (EIPs), which are static public IPv4 addresses you own within your AWS account. You can assign and reassign an EIP to any EC2 instance as needed.

• Use cases: Web servers, VPN concentrators, jump boxes, partner whitelisting.
• Notes: EIPs remain yours until released; can be associated with an EC2 instance, a NAT Gateway, or a Network Load Balancer.

2) Internal / Private Servers

Use static private IPs inside your VPC subnets.

• Specify a private IP at instance launch (e.g., 10.0.1.10), or
• Attach an Elastic Network Interface (ENI) that holds that private IP.

Detaching and reattaching the ENI to a replacement instance preserves the private IP, keeping internal addressing stable.

3) DNS-Based Migrations

Abstract dependencies away from static IPs by using hostnames.

• Use Amazon Route 53 private or public hosted zones.
• Map hostnames (e.g., db.internal.example.com) to EIPs or private IPs.
• When servers change, update DNS records instead of reconfiguring all clients.

4) Load-Balanced Applications

AWS recommends DNS names for load balancers.

• ALB/NLB/Classic ELB expose DNS endpoints (not fixed IPs).
• If you require fixed IPs in front of them, use AWS Global Accelerator (provides two static anycast IPs).

5) Hybrid / VPN Environments

• Ensure non-overlapping VPC CIDRs with on-prem networks (for VPN/Direct Connect).
• Plan a consistent IP addressing scheme across environments.
• For predictable outbound IPs to on-prem or internet, route via a NAT Gateway with an Elastic IP.

6) Typical Migration Steps

1. Catalog current static IPs and dependencies (DNS, firewall, ACLs).
2. Design VPC CIDR ranges (avoid overlap with on-prem).
3. Allocate Elastic IPs for external endpoints.
4. Launch EC2 instances with specific private IPs or attach ENIs.
5. Update DNS (Route 53) to reference new IPs/hostnames.
6. Adjust Security Groups, NACLs, and on-prem firewall rules.
7. Decommission old IPs only after DNS TTLs expire and traffic stabilizes.

7) Best Practices

• Use EIPs sparingly—unused EIPs may incur charges and add complexity.
• Prefer DNS over hard-coded IPs for agility and failover.
• Manage IPs via Infrastructure as Code (CloudFormation/Terraform).
• Maintain an IP mapping between legacy and AWS addresses for audit and rollback.
• Use ENIs to retain private IPs across rebuilds or blue/green swaps.
• For stable outbound IPs to third parties, use NAT Gateways or Global Accelerator.

---

In short: Use Elastic IPs for public endpoints, static private IPs/ENIs for internal stability, and Route 53 / Global Accelerator for DNS-based resilience and fixed front-door IPs.