--- title: "Manage a scale group's network and security groups" description: "Attach or detach VPCs, assign or remove the public IP, and attach or detach security groups on E2E scale group nodes." content_type: "how-to" product: "auto-scaling" platform: "MyAccount" url: "/myaccount/auto-scaling/how-to/manage-network-and-security-groups/" topic: ["network-and-security"] relationships: {"requires":["/myaccount/auto-scaling/how-to/create-a-scale-group/"]} --- # Manage a scale group's network and security groups You can attach or detach a scale group's VPCs, assign or remove its public IP, and change the security groups that set the firewall rules for its nodes. Stop the scale group before you change its network. You can change the security groups while it reads **Running** or **Scaling**. ## Before you begin - For VPC or public IP changes, the scale group must be stopped. Stopping removes every node, and starting it again brings back as many nodes as **Minimum Node**. See [Resize, stop, or start a scale group](/myaccount/auto-scaling/how-to/resize-stop-or-start-a-scale-group/#stop-the-scale-group). To make several network changes, stop it once and make them all before you start it. - For security group changes, the scale group is in the **Running** or **Scaling** state. - To attach a VPC, you have one in the **Active** state. See [Create a VPC](/myaccount/vpc/how-to/create-a-vpc/). - To attach a security group, you have one with the rules you need. See [Create a security group](/myaccount/security-group/how-to/create-a-security-group/) and [Add or edit rules](/myaccount/security-group/how-to/add-or-edit-rules/). - Your role in the current project has the update permission for Auto Scaling. ## See the scale group's network In MyAccount, under **Compute**, click **Auto Scaling**, click your scale group, and open its **Network** tab. It lists each VPC attached to the scale group with its name and CIDR, and says whether a public IP is **Assigned** or **Not Assigned**. If no VPC is attached, it says **No vpc is attached.** The tab is available while the scale group reads **Running**, **Scaling**, **Starting**, **Stopping**, or **Stopped**. A scale group in a VPC is also listed on that VPC's **Associated Scale Groups** tab. ## Attach a VPC 1. Stop the scale group, and wait until it reads **Stopped**. 2. On the **Network** tab, click **Attach more vpc**, or **Click here** when no VPC is attached. 3. In **Select VPC**, pick one or more VPCs in the **Active** state. To make one first, click **Create New VPC**. When no VPC is left to attach, the list says **No vpc are available to attach.** 4. Confirm the selection. **VPC attached successfully.** confirms it. 5. Start the scale group again. If you try to attach a VPC while the scale group reads anything other than **Stopped**, the portal says **Vpc can only be attached in stopped state.** ## Detach a VPC Before you detach the only VPC, assign the scale group a public IP. If you try before it has one, the portal says: ```text Assign Public IP to the scale group in order to detach this only attached vpc. ``` 1. Stop the scale group, and wait until it reads **Stopped**. 2. On the **Network** tab, click the detach button beside the VPC's name and CIDR. 3. In **Confirm detach Vpc**, click **Detach Vpc**. A message confirms the detach, where `` is the VPC's name and `` is the scale group's name: ```text detached successfully from scale group - ``` 4. Start the scale group again. Once the only VPC is detached, the scale group goes back to E2E's default private network. ## Assign or remove the public IP You assign or remove the scale group's public IP on the **Network** tab. Without a public IP, the nodes have only their private address in the VPC. Attach a VPC before you remove the public IP. Without one, you see **You would be able to deassign public IP only if vpc is attached to the scale group.** 1. Stop the scale group, and wait until it reads **Stopped**. 2. On the **Network** tab, next to **Public IP**, click **Click here**. **Confirm Unassign Public IP?** opens when a public IP is assigned, or **Confirm Assign Public IP?** when none is. 3. Click **Unassign IP** or **Assign IP**. You will see one of these messages, where `` is your scale group's name: ```text Public Ip deassigned successfully from scale group - Public Ip assigned successfully to scale group - ``` 4. Start the scale group again. If you try to remove the public IP while the scale group reads anything other than **Stopped**, the portal says **Public Ip can only be deassigned in stopped state.** The **Activity Timeline** records each change as **ATTACH_VPC**, **DETACH_VPC**, **ATTACH_PUBLIC_IP**, or **DETACH_PUBLIC_IP**. ## Change the security groups The **Security Group** tab lists the security groups attached to the scale group, with their **Inbound Rules** and **Outbound Rules**. It is available while the scale group reads **Running** or **Scaling**. - To add one, click **Attach Security Group** and pick a security group. You attach security groups one at a time. - To remove one, click **Detach** on it. A scale group always keeps at least one security group, so to replace the last one, attach the new security group first, then detach the old one. Detaching the last one is refused with **Cannot detach only attached Security Group!!!** Attaching or detaching a security group changes the rules on the running nodes and on every node the scale group starts later. On the running nodes, allow about 10 minutes for the change to take effect. Each change also needs at least one node in the scale group. With none, the change is refused with **No VMs Attached**. Wait for each change to finish before you start the next. Starting one while another runs gets one of these messages: - **Please Wait as Your Last Security Group is Still Getting Attached to your Scaler VMs**, after an attach. - **Please Wait as Your Last Security Group is Still Getting Detached from your Scaler VMs**, after a detach. A security group's own page lists the scale groups it is attached to, on its **Associated Scaler** tab. The **Network** and **Security Group** tabs now show what the scale group has attached, and the **Activity Timeline** records who changed it. To make these changes from a script, see the [as-attach-vpc](/api/myaccount/operations/as-attach-vpc/), [as-detach-vpc](/api/myaccount/operations/as-detach-vpc/), [as-assign-public-ip](/api/myaccount/operations/as-assign-public-ip/), [as-unassign-public-ip](/api/myaccount/operations/as-unassign-public-ip/), [as-available-sgs](/api/myaccount/operations/as-available-sgs/), [as-attach-sg](/api/myaccount/operations/as-attach-sg/), and [as-detach-sg](/api/myaccount/operations/as-detach-sg/) operations in the API reference. If a change is refused, see [Troubleshooting Auto Scaling](/myaccount/auto-scaling/troubleshooting/auto-scaling/). To see which load balancers use the scale group, see [Check which load balancers use the scale group](/myaccount/auto-scaling/how-to/add-a-load-balancer/#check-which-load-balancers-use-the-scale-group).