Set up a global external Application Load Balancer with an external backend

Console

1. In the Google Cloud console, go to the External IP addresses page.

   Go to External IP addresses

2. Click Reserve external static address to reserve an IPv4 address.

3. Enter a name.

4. For Network Service Tier, select Premium.

5. For IP version, select IPv4.

6. For Type, select Global.

7. Click Reserve.

gcloud

gcloud compute addresses create LB_IP_ADDRESS_NAME \
    --network-tier=PREMIUM \
    --ip-version=IPV4 \
    --global

Note the IPv4 address that was reserved:

gcloud compute addresses describe LB_IP_ADDRESS_NAME \
    --format="get(address)" \
    --global

Console

1. In the Google Cloud console, go to the Network endpoint groups page.

   Go to Network endpoint groups

2. Click Create network endpoint group.

3. Enter a name.

4. For Network endpoint group type, select Network endpoint group (Internet).

5. For Default port, enter 443.

6. For New network endpoint, select Fully qualified domain name and port.

7. Enter the Fully qualified domain name.

8. For Port type, select Default, and verify that Port number is 443.

9. Click Create.

gcloud

1. Create an internet NEG, and set the --network-endpoint-type to internet-fqdn-port (the hostname and port where your external backend can be reached):

   gcloud compute network-endpoint-groups create INTERNET_NEG_NAME \
       --network-endpoint-type="internet-fqdn-port" \
       --global
   

2. Add your endpoint to the NEG. If a port isn't specified, the port selection defaults to port 80 (HTTP) or 443 (HTTPS; HTTP/2) depending on the protocol configured in the backend service. Make sure to include the --global flag:

   gcloud compute network-endpoint-groups update INTERNET_NEG_NAME \
       --add-endpoint="fqdn=FULLY_QUALIFIED_DOMAIN_NAME,port=443" \
       --global
   

Console

Start your configuration

1. In the Google Cloud console, go to the Load balancing page.

   Go to Load balancing

2. Click Create load balancer.
3. For Type of load balancer, select Application Load Balancer (HTTP/HTTPS) and click Next.
4. For Public facing or internal, select Public facing (external) and click Next.
5. For Global or single region deployment, select Best for global workloads and click Next.
6. For Load balancer generation, select Global external Application Load Balancer and click Next.
7. Click Configure.

Frontend configuration

1. Click Frontend configuration.
2. Enter a name.

3. To create an HTTPS load balancer, you must have an SSL certificate. We recommend using a Google-managed certificate.

   Verify that the following options are configured with these values.

   Property	Value (type a value or select an option as specified)
   Protocol	HTTPS
   Network Service Tier	Premium
   IP version	IPv4
   IP address	Select the IP address created in the Reserve an external IP address step.
   Port	443
   Optional: HTTP keepalive timeout	Enter a timeout value from 5 to 1200 seconds. The default value is 610 seconds.
   Certificate	Select an existing SSL certificate or create a new certificate. To create an HTTPS load balancer, you must have an SSL certificate resource to use in the HTTPS proxy. You can create an SSL certificate resource by using either a Google-managed SSL certificate or a self-managed SSL certificate. To create a Google-managed certificate, you must have a domain. The domain's A record must resolve to the IP address of the load balancer (in this example, example-ip). We recommend using Google-managed certificates because Google Cloud obtains, manages, and renews these certificates automatically. If you don't have a domain, you can use a self-signed SSL certificate for testing.
   Optional: Enable HTTP to HTTPS Redirect	Use this checkbox to enable HTTP to HTTPS redirects. Enabling this checkbox creates an additional partial HTTP load balancer that uses the same IP address as your HTTPS load balancer and redirects HTTP requests to your load balancer's HTTPS frontend. This checkbox can only be selected when the HTTPS protocol is selected and a reserved IP address is used.

   If you want to test this process without setting up an SSL certificate resource (or a domain as required by Google-managed certificates), you can set up an HTTP load balancer.

   To create an HTTP load balancer, verify that the following options are configured with these values:

   Property	Value (type a value or select an option as specified)
   Protocol	HTTP
   Network Service Tier	Premium
   IP version	IPv4
   IP address	Select the IP address created in the Reserve an external IP address step.
   Port	80
   Optional: HTTP keepalive timeout	Enter a timeout value from 5 to 1200 seconds. The default value is 610 seconds.

4. Click Done.

Backend configuration

1. Click Backend configuration.
2. Click Backend services and backend buckets.
3. Click Create a backend service.
4. Enter a name.
5. For Backend type, select Internet network endpoint group.
6. For Protocol, select the protocol that you intend to use from the load balancer to the internet NEG. For this example, select HTTP/2.
7. For Backends, in the New backend window, select the internet NEG created in the previous step.
8. Click Create.

Review and finalize

1. Click Review and finalize.
2. If everything looks correct, click Create.

gcloud

1. Create a backend service:

     gcloud compute backend-services create BACKEND_SERVICE \
         --load-balancing-scheme=EXTERNAL_MANAGED \
         --global
     

2. Add the internet NEG to the backend service:

     gcloud compute backend-services add-backend BACKEND_SERVICE \
         --network-endpoint-group=INTERNET_NEG_NAME \
         --global-network-endpoint-group \
         --global
      

3. Create a URL map to route incoming requests to the backend service:

     gcloud compute url-maps create URL_MAP_NAME \
         --default-service=BACKEND_SERVICE \
         --global
     

4. Perform this step only if you want to create an HTTPS load balancer. This step is not required for HTTP load balancers.

   To create an HTTPS load balancer, you must have an SSL certificate resource to use in the HTTPS target proxy. You can create an SSL certificate resource by using either a Google-managed SSL certificate or a self-managed SSL certificate. We recommend using Google-managed certificates because Google Cloud obtains, manages, and renews these certificates automatically.

   To create a Google-managed certificate, you must have a domain. If you don't have a domain, you can use a self-managed SSL certificate for testing.

   To create a Google-managed SSL certificate resource:

     gcloud compute ssl-certificates create SSL_CERTIFICATE_NAME \
         --domains DOMAIN
     

   To create a self-managed SSL certificate resource:

     gcloud compute ssl-certificates create SSL_CERTIFICATE_NAME \
         --certificate CRT_FILE_PATH \
         --private-key KEY_FILE_PATH
     

5. Create a target HTTP(S) proxy to route requests to your URL map.

   For an HTTP load balancer, create an HTTP target proxy:

     gcloud compute target-http-proxies create TARGET_HTTP_PROXY_NAME \
         --url-map=URL_MAP_NAME \
         --global
     

   For an HTTPS load balancer, create an HTTPS target proxy. The proxy is the portion of the load balancer that holds the SSL certificate for HTTPS Load Balancing, so you also load your certificate in this step.

     gcloud compute target-https-proxies create TARGET_HTTPS_PROXY_NAME \
         --ssl-certificates=SSL_CERTIFICATE_NAME \
         --url-map=URL_MAP_NAME \
         --global
     

   Replace the following:

   • TARGET_HTTP_PROXY_NAME: the name of the target HTTP proxy.
   • TARGET_HTTPS_PROXY_NAME: the name of the target HTTPS proxy.
   • SSL_CERTIFICATE_NAME: the name of the SSL certificate.
   • URL_MAP_NAME: the name of the URL map.
   Optional: For global external Application Load Balancers, you can set an client HTTP keepalive timeout by using the --http-keep-alive-timeout-sec option. The timeout value must be between 5 to 1200 seconds. The default value is 610 seconds.

6. Create a forwarding rule to route incoming requests to the proxy.

   For an HTTP load balancer:

     gcloud compute forwarding-rules create HTTP_FORWARDING_RULE_NAME \
         --load-balancing-scheme=EXTERNAL_MANAGED \
         --network-tier=PREMIUM \
         --address=LB_IP_ADDRESS_NAME \
         --target-http-proxy=TARGET_HTTP_PROXY_NAME \
         --global \
         --ports=80
     

   For an HTTPS load balancer:

     gcloud compute forwarding-rules create HTTPS_FORWARDING_RULE_NAME \
         --load-balancing-scheme=EXTERNAL_MANAGED \
         --network-tier=PREMIUM \
         --address=LB_IP_ADDRESS_NAME \
         --target-https-proxy=TARGET_HTTPS_PROXY_NAME \
         --global \
         --ports=443
     

Console

1. In the Google Cloud console, go to the Load balancing page.

   Go to Load balancing

2. Click the load balancer that you just created.

3. Note the IP address of the load balancer.

4. Send traffic to the load balancer.

   • If you created an HTTP load balancer, you can test your load balancer by going to http://IP_ADDRESS. Replace IP_ADDRESS with the load balancer's IP address. You should be directed to the application you're running on the external backend.

   • If you created an HTTPS load balancer, you can test your load balancer by going to https://IP_ADDRESS. Replace IP_ADDRESS with the load balancer's IP address. You should be directed to the you're application running on the external backend.

   If that does not work and you are using a Google-managed certificate, confirm that your certificate resource's status is ACTIVE. For more information, see Google-managed SSL certificate resource status.

   Alternatively, you can use curl from your local machine's command line. Replace IP_ADDRESS with the load balancer's IPv4 address. If you're using a Google-managed certificate, test the domain that points to the load balancer's IP address. For example:

   curl -s 'https://www.example.com:443' --resolve www.example.com:443:IP_ADDRESS
   

5. Optional: If you are using a custom domain, you might need to wait for the updated DNS settings to propagate. Then, test your domain in the web browser.

   For help with troubleshooting, see Troubleshooting external backend and internet NEG issues.

Console

1. In the Google Cloud console, go to the Load balancing page.

   Go to Load balancing.

2. Click the name of the load balancer that you want to modify.

3. Click editEdit.

4. Click Backend configuration.

5. For the backend service with the internet NEG backend, click editEdit.

6. Select Enable Cloud CDN.

7. Optional: Modify the cache mode and TTL settings.

8. Click Update.

9. To review your changes, click Review and finalize, and then click Update.

gcloud

• To enable Cloud CDN on the backend service, use the following command:

    gcloud compute backend-services update BACKEND_SERVICE \
        --load-balancing-scheme=EXTERNAL_MANAGED \
        --global \
        --enable-cdn \
        --cache-mode=CACHE_MODE
    

  Set the cache mode by replacing CACHE_MODE with one of the following:

  • CACHE_All_STATIC: automatically caches static content.
  • USE_ORIGIN_HEADERS (default): requires the origin to set valid caching headers to cache content.
  • FORCE_CACHE_ALL: caches all content, ignoring any private, no-store, or no-cache directives in Cache-Control response headers.

Console

1. In the Google Cloud console, go to the Load balancing page.

   Go to Load balancing.

2. Click the name of the load balancer that you want to modify.

3. Click editEdit.

4. Click Backend configuration.

5. For the backend service with the internet NEG backend, click editEdit.

6. Click Advanced configurations.

7. For Custom request headers, click Add header:

   1. For Header name, enter Host.
   2. For Header value, enter FQDN_NEG_ENDPOINT.

8. Click Update.

9. To review your changes, click Review and finalize, and then click Update.

gcloud

• Use the following command to configure the backend service to add a custom `Host` header to each request.

    gcloud compute backend-services update BACKEND_SERVICE \
        --custom-request-header "Host: HEADER_VALUE" \
        --load-balancing-scheme=EXTERNAL_MANAGED \
        --global