Environment:

• Neo4j deployed on AWS ECS

• Driver or cypher-shell used to connect to the database

• Application Load Balancer (ALB) in front of the Neo4j service

---

Issue:

Authentication via Neo4j drivers or cypher-shell fails with the following error, while access through the browser works as expected:

<CONNECTION FAILED> xx.xx.xxx.xxx:7687 ServiceUnavailable: Cannot connect to Bolt service on ResolvedIPv4Address(('xx.xx.xxx.xxx', 7687)) (looks like HTTP)
DEBUG:neo4j.pool:[#0000] _: <POOL> deactivating address ResolvedIPv4Address(('xx.xx.xxx.xxx', 7687))
DEBUG:neo4j.pool:[#0000] _: <POOL> failed to fetch routing info from ResolvedIPv4Address(('xx.xx.xxx.xxx', 7687))

---

Root Cause:

The error indicates that the Bolt protocol is being interpreted as an HTTP request by a load balancer or proxy. This typically happens when a Layer 7 (Application Load Balancer) is used, which only supports HTTP/HTTPS protocols and is not designed to handle Bolt (a binary protocol).

---

Resolution:

To resolve this issue:

1. Check your network stack: Determine whether an Application Load Balancer (ALB) or another proxy is in front of your Neo4j ECS service.

2. Replace the ALB with a Network Load Balancer (NLB):

   • NLBs operate at Layer 4 and support TCP-based protocols, including Bolt.

   • This change ensures Bolt traffic is passed through without protocol interference.

---

Additional Notes:

• ALBs are not suitable for non-HTTP protocols like Bolt.

• This issue only affects driver-based or CLI connections (like cypher-shell), not the Neo4j browser, since the browser uses HTTPS