S3 File Gateway AL2 to AL2023 migration: will SMB shares work on a secondary private IP?

Question

Hi,

I am migrating my S3 File Gateway from AL2 to AL2023 using the "Migrate cache disk and Gateway ID to replacement instance" procedure described in the Replacing your existing S3 File Gateway with a new instance documentation (https://docs.aws.amazon.com/filegateway/latest/files3/migrate-data.html).

My setup:
- S3 File Gateway running on EC2 (m5.xlarge) in a private VPC subnet
- 4 SMB file shares using Active Directory authentication (AWS Managed Microsoft AD)
- End users connect via WireGuard VPN to the gateway's private IP address (no public IP in use)
- VPC endpoint configured for the Storage Gateway service

The problem I am trying to solve:
The new AL2023 EC2 instance will receive a new private IP address. I want to avoid having to update mapped drives on all end user machines. I am aware that the recommended long term solution is to reference the gateway by a DNS hostname rather than a private IP, but our environment is already fully set up with the private IP and all end user machines have their drives mapped to it. Switching everyone to a hostname would require updating every mapped drive across the organization, which I am trying to avoid. I am looking for the least disruptive cutover possible.

My plan after completing the migration procedure is:

1. Complete the full "Migrate cache disk and Gateway ID to replacement instance" procedure. At the end of this process the old instance is already stopped and has had all its disks detached.
2. Verify the new gateway is working correctly on its new randomly assigned primary IP.
3. Assign the old gateway's original private IP as a secondary private IP to the new gateway's ENI. By this point in the procedure the old instance has been stopped and its disks detached, so the IP is available to be reassigned.
4. End users reconnect transparently on the original IP with no changes required on their end.

My question: Will the S3 File Gateway's SMB service respond on a secondary private IP address assigned to the instance's ENI, or does it only bind to the primary private IP?

I have not been able to find any documentation or community posts confirming this works. Has anyone done this successfully, or is there a better approach for preserving the original private IP with minimal disruption to end users, without using DNS or an Elastic IP (an EIP does not apply here since end users connect to the private IP through a VPN)?

Thanks,
Chris

Florian Turnwald · Accepted Answer

**No**, the S3 File Gateway's SMB service will not reliably respond to a secondary private IP assigned to the primary ENI. Because the gateway runs on a „managed appliance OS“, it does not automatically configure secondary IP addresses added via the AWS console. Since you lack the root access required to configure the interface manually, the SMB daemon (Samba) remains unaware of the secondary IP and will not bind to it.

### Option: Reassign as Primary IP

To achieve a zero-touch cutover for your end-users without migrating to DNS, you must assign the original IP as the **primary private IP** of the new AL2023 instance.

„unassailable“, architecturally approach:

1. **Prepare:** Complete the initial migration steps (stop the old AL2 instance, create a backup AMI, and detach all cache/data disks).

2. **Release the IP:** **Terminate** the old instance. Merely stopping an EC2 instance does not release its primary private IP. Terminating it immediately frees the IP address within your VPC subnet. *(Note: Your logical Gateway resource in the Storage Gateway console remains intact even if the underlying EC2 instance is terminated).*

3. **Launch the New Instance:** Deploy the new AL2023 EC2 instance. During the network configuration step, manually assign your freed original IP as the new instance's **primary private IP** (eth0).

4. **Finalize:** Attach the old disks to the new AL2023 instance and complete the "Migrate cache disk and Gateway ID" procedure.

5. **Rebuild AD Secure Channel:** Since you are using Active Directory, the new AL2023 OS will not know the machine account password, even though the Gateway ID remains the same. You MUST go to the Storage Gateway console -> SMB/Active Directory Settings, and re-enter your AD service account credentials. This forces the gateway to rebuild the secure channel with the Domain Controller without creating a new computer object.

**Result:** The new gateway operates on the same primary IP as the old one. Your end-users will reconnect transparently through their VPN with zero changes to their mapped drives.

re:Post Agent · Answer

No, the secondary private IP approach will not work. The Storage Gateway appliance runs a managed OS where Samba binds to the primary IP. Secondary IPs added via the AWS console are not automatically configured at the OS level, and you have no root access to do it manually.

The solution is to assign the original IP as the **primary private IP** on the new instance. The migration documentation explicitly supports this: "You can reuse the same static IP address or hostname from the old gateway VM to avoid reconfiguring NFS or SMB clients."

Steps:

1. Complete the "Migrate cache disk and Gateway ID" procedure up to the point where the old instance is stopped and disks detached.
2. The original primary IP is now free (stopping the instance doesn't release it, but you can unassign it from the old ENI or terminate the old instance).
3. Launch the new AL2023 instance specifying the original IP as the primary private IP during network configuration. Alternatively, detach the old instance's ENI entirely and attach it to the new instance as eth0 (this preserves both the IP and the MAC address).
4. Attach the cache disks to the new instance and complete the migration procedure.
5. Re-join Active Directory from the Storage Gateway console (Gateway Settings > SMB > Active Directory). Re-enter your AD service account credentials to rebuild the secure channel with the domain controller. This is required because the new OS does not retain the machine account password, even though the Gateway ID is preserved.

End users reconnect transparently with no drive remapping needed.

**References:**
- Migration procedure: https://docs.aws.amazon.com/filegateway/latest/files3/migrate-data.html
- AL2023 migration blog (IaC): https://aws.amazon.com/blogs/storage/scale-your-aws-storage-gateway-al2023-migration-with-infrastructure-as-code/

S3 File Gateway AL2 to AL2023 migration: will SMB shares work on a secondary private IP?

Option: Reassign as Primary IP

Add your answer

Relevant content