This topic introduces data planning and resource preparation before configuring Network Load Balancer (NLB), as well as the configuration process.

Data planning

Region and AZ

Select the Region and availability zone based on the geographical location of the actual business.

Region: It is recommended to select a region as close as possible to the geographical location of the client to reduce latency and improve download speed.

Availability Zone: NLB supports active-active deployment across multiple availability zones by default. Select two or more availability zones within the same region to deploy NLB and improve overall service availability.

IP version

NLB supports instances with IPv4 and dual-stack IP protocols. Choose according to the business requirements.

When only IPv4 is involved, select the IPv4 type.

When dealing with IPv6 services, regardless of whether IPv4 services are involved, always select Dual-stack type.

Plan network type

NLB supports two types: public and private network. See the table below for appropriate selection.

Network type			Explanation
IPv4 Network Type	Internet	If you want IPv4 internet clients to access the NLB instance, it is recommended that you select the internet network. At this point, you also need to confirm the creation type of Elastic IP (EIP): Newly purchased EIP: There is no need to apply for an EIP in advance; the system automatically synchronizes and applies for an EIP when creating an NLB instance. The default configuration of the EIP is as follows: Bandwidth limit: 200Mbps ISP: BGP (Multi-ISP) Billing method: Pay-by-data-transfer Security protection level: Default (basic protection) Using existing EIP: You need to plan the bandwidth cap and type information (including ISP, billing methods, and security protection type) in advance and apply for EIP. The type of all EIPs associated with a single NLB instance must be consistent.
IPv4 Network Type		Private	If you do not want IPv4 internet clients to access the NLB instance, it is recommended that you select the private network.
IPv6 network type	Internet	If you want IPv6 internet clients to access the NLB instance, we recommend selecting the internet type. tip Since creating dual-stack instances of the IPv6 internet type is not supported directly, you need to convert the IPv6 network type to internet after the NLB instance is created.
IPv6 network type		Private	If you do not want IPv6 Internet clients to access NLB instances, it is recommended to select the private network.

Plan protocol type

NLB supports TCP and UDP protocol listeners. Choose according to your scenario.

Applicable to scenarios that require high reliability and high data accuracy, and have relatively low speed requirements, such as file transmissions, email communications, and remote log-ins.

UDP protocol: Applicable to scenarios that require high real-time performance but relatively low reliability, such as voice and video chats, gaming, and financial real-time market push notifications.

Planning instance Identity and Access Management (IAM)

Traffic entering the NLB instance is restricted by the security group associated with the NLB instance and the network ACL associated with the subnet of the NLB instance. You need to see Configurating instance access control to plan the outbound and inbound direction rules of the security group and Network ACL, so as to allow Client access traffic and Traffic verifying the availability of the NLB private IP address.

Resource preparation

Prepare the private cloud network environment

Create a Virtual Private Cloud (VPC) that meets business needs to provide a private network environment for the NLB.

See Creating an IPv4 VPC to create a private network that supports only IPv4.

See Creating an IPv6 VPC to create a private network that supports both IPv4 and IPv6.

Prepare backend servers

NLB supports three types of backend servers: Elastic Compute Service (ECS) instances, secondary network interfaces, and IP addresses. Please see the table below to select as needed.

Backend server types	Application scenarios	Configuration actions	Access Control Policy Configuration Instructions
ECS instance	Used for adding backend servers within the same VPC to the NLB.	Create an ECS instance and deploy services for external access. For specific operations, see Purchasing an ECS and Setting up backend services.	Ensure that the security groups associated with the ECS instance and the Network ACL of the subnet to which the Cloud Service instance belongs have allowed Client access traffic and NLB health check traffic. For detailed configuration, please see Configuring Backend Server Access Control.
Secondary network interface (associated with an ECS instance)	Used to add backend servers within the same VPC to the NLB. By switching the associated ECS instance, you can flexibly adjust which servers receive and process NLB traffic.	Create a secondary network interface and mount it to an ECS instance. For detailed steps, see Creating a secondary network interface and Mounting a secondary network interface.	In addition to the access control policy configuration of the above ECS instance, routing also needs to be configured for the secondary network interface. For detailed configuration, please see Configuring Secondary Network Interface Routing.
IP Address	Mainly used to add backend servers across VPCs for NLB, and can also add backend servers within the same VPC. The address can be a private IP address of an ECS within this VPC or another VPC, or an IP address of a server in an on-premises data center (IDC).	When the IP address belongs to an ECS instance or secondary network interface within the VPC, see Buying ECS instance and Configuring secondary network interface to complete resource creation and obtain the resource's IP address. When the IP address belongs to an on-premises IDC server, please obtain the server's IP address in advance.	When the IP address belongs to an ECS instance or a secondary network interface within the VPC, ensure that the access control policies for the ECS instance or secondary network interface meet configuration requirements. When the IP address is from a server in an on-premises IDC, ensure that the server's access control policy allows Client traffic and NLB health check traffic. For detailed configuration, please see Configuring backend server access control.

Configuration procedures

IPv4 NLB

IPv6 NLB

Create an NLB instance: Create an IPv4-type internet NLB instance.

Create a Server Group and Add backend servers: Create an IPv4-type server group and add backend servers that provide actual services.

Add a listener: Add a listener to the NLB instance and associate it with the server group.

Configure the Security group and Network ACL: Allow the NLB traffic in the security group and Network ACL associated with the NLB instance and backend servers.

Point own domain to NLB domain: Configure a CNAME record to parse the actual business domain to the NLB domain.

Verification: Verify that the configured NLB can forward access requests to backend servers properly.