After the Classic Load Balancer (CLB) instance Enables Allow backend security group feature, the security group of its backend server no longer verifies the traffic of the CLB, allowing by default, which simplifies the configuration actions of the CLB for you.

Action description

Enable Allow Backend Security Group feature:

This only applies to backend servers within server-type backend server groups; backend servers in IP-type backend server groups still require security group configuration.

If the subnet where its backend server is located is configured with Network Access Control List, the traffic from CLB to backend servers is still restricted by the Network Access Control List.

If you want to restrict IP access to backend server services, use Access Control Lists overview for control.

warning

Enable Allow backend security group feature, effective only for new connections, previously established connections will still go through backend security group rule validation.

If your CLB instance does not support enabling Allow Backend Security Group Traffic, please Submit ticket for assistance.

Disable the Allow backend security group feature, existing connections will still bypass the security group rule verification and only apply to new connections. New connections will go through backend security group rule verification.

Toggle Allow Backend Security Group Traffic

In the top menu bar, select the target project and region.

Click the name of the target CLB instance.

On the CLB Overview tab:

Enable: Turn on the Allow backend security group switch, and click Confirm to complete the actions.

Disable: Turn off the Allow backend security group switch, and click Confirm to complete the actions.

Last updated: 2026.06.17 14:13:39

Public security network record in Beijing: No. 11010802032137