Skip to main content

Allow Address Pairs — Troubleshooting

Issue 1: "Allow Address Pairs" does not appear in the menu​

Symptom​

The Allow Address Pairs item is not visible in the VPC's Network menu, or the item is grayed out and cannot be clicked.

Cause​

The Allow Address Pairs feature is only available on General VPC. If the current VPC is a Specific VPC, this feature is not supported and will not appear in the interface.

Resolution​

  1. Check the type of VPC you are using: go to the VPC detail page and look at the VPC Type field.
  2. If the VPC is Specific type → this feature cannot be used on that VPC. You need to create a General VPC and deploy the Instance into the new VPC if you want to use Allow Address Pairs.
  3. If the VPC is General type but the menu item is still not visible → check your account permissions. Contact a system administrator to confirm you have network management permissions within that VPC.

Issue 2: Allow Address Pair added but traffic is still blocked​

Symptom​

The Allow Address Pair record was created successfully and appears in the list, but network traffic to or from the declared IP/CIDR address is still not passing through.

Cause​

Allow Address Pairs only adjusts the restriction at the virtual networking layer (source address check on packets). It does not override Security Group rules. If the Security Group applied to the NIC or Instance does not have a rule permitting traffic to or from the additional IP/CIDR, that traffic will still be blocked.

Resolution​

  1. Go to VPC → Security Groups and view the Security Groups currently applied to the Instance.
  2. Check the Inbound rules and Outbound rules — confirm there is a rule permitting the required protocol, port, and IP/CIDR address.
  3. If no such rule exists → add a new rule to the Security Group:
    • Inbound: Allow the protocol (TCP/UDP/ICMP) from the required source IP/CIDR.
    • Outbound: Allow the protocol to the required destination IP/CIDR.
  4. If the Instance acts as a router or forwards packets: also verify that IP Forwarding is enabled in the Instance operating system (e.g., sysctl net.ipv4.ip_forward on Linux).
  5. After updating the Security Group, retry the connection. Security Group rules take effect immediately — no Instance restart is required.

Issue 3: Error when entering a CIDR address — form reports invalid format​

Symptom​

After entering a value in the IP or CIDR address field and clicking confirm, the system displays a format validation error even though the input appears correct.

Common causes and fixes​

Input enteredProblemFix
10.0.1.1/24Host bits are non-zero — a host address was used instead of a network addressChange to 10.0.1.0/24 (set host bits to zero)
10.0.1.0/33Prefix length exceeds the IPv4 limitValid prefix length is /0 to /32
10.0.1Missing octet — incomplete IPv4 addressEnter all four octets, e.g., 10.0.1.0/24
2001:db8::1IPv6 address — not supportedUse IPv4 addresses only
10.0.1.0 / 24Whitespace in the CIDR notationRemove spaces and enter 10.0.1.0/24

Valid format rules​

  • Single IP: a.b.c.d — four decimal octets from 0 to 255, separated by dots. Example: 192.168.1.50.
  • CIDR: a.b.c.d/n — network address (host bits set to zero) combined with prefix length. Example: 10.10.0.0/16.
  • No spaces, no special characters other than a dot (.) and a forward slash (/).

Need more help?​

If the issue is not resolved after following the steps above, contact FPT Cloud support and provide the following information:

  • VPC name and VPC type (General/Specific)
  • Name of the affected Instance and NIC
  • Contents of the Allow Address Pair record you created (IP/CIDR, MAC if applicable)
  • Description of the traffic flow that is failing (source → destination, protocol, port)
  • Screenshot of any error message (if available)

See also​