Mount cross-region VPC servers using ALB

Application Load Balancer (ALB) lets you add servers from a VPC in a different region as backend servers to achieve efficient traffic distribution and system optimization.

Scenario example

An e-commerce company sells and promotes products on its online platform. The company deployed a server in the China (Chengdu) region to meet daily business requirements. However, during major sales promotions, traffic surges and high concurrency requests may exceed the server's capacity.

To resolve this issue, the company can use an IP-type server group for ALB and a Cloud Enterprise Network (CEN) transit router. This integrates a server from the China (Hangzhou) region into the existing network architecture for rapid resource expansion. A transit router enables quick private network peering between cross-region VPCs. Based on this private peering, you can add an IP-type server group to ALB to mount the cross-region server. This allows ALB to forward client requests to servers in both China (Chengdu) and China (Hangzhou), which improves the system's load capacity and response speed.

Limits

Note

Starting from 00:00:00 on February 25, 2025 (UTC+8), new instances use the upgraded Application Load Balancer (ALB) by default. Existing ALB instances are not affected, except for instances created from self-service requests. For more information, see Application Load Balancer (ALB) Instance Upgrade Announcement.
This topic uses an upgraded ALB instance as an example. If you use a non-upgraded ALB instance, see Instructions for non-upgraded ALB instances.

Backend server limits

Only IP-type backend servers can be mounted across regions.
Only private IP addresses are supported. Public IP addresses are not supported.
To attach IPv6 servers, set IP Version to IPv4/IPv6 dual-stack when you create an IP-based server group. Note the following items:
- You can set the IP Version to IPv4/IPv6 dual-stack only if the IPv6 feature is enabled for the VPC selected for the server group.
- You can add the server group only to listeners or forwarding rules of dual-stack upgraded ALB instances. Non-upgraded ALB instances are not supported.
- When IP Version is set to IPv4/IPv6 dual-stack, you can add only IPv6 addresses from the CIDR block of the VPC for the server group. You cannot add remote IP addresses.

Forwarding configuration limits between ALB and backend servers

If you use an Enterprise Edition transit router, it creates an elastic network interface (ENI) on a vSwitch in your specified availability zone. This ENI acts as the traffic ingress from the VPC to the transit router. When you create a VPC, make sure that you create at least one vSwitch in the specified availability zone to connect the VPC to the transit router. For more information, see How transit routers work.
Traffic between an ALB instance and its backend servers can be forwarded only through the system route table. Custom route tables in the VPC are not supported.

Prerequisites

A VPC named VPC1 is created in the China (Chengdu) region and a VPC named VPC2 is created in the China (Hangzhou) region.

In VPC1, vSwitches VSW1 and VSW2 are deployed in Zone A and Zone B.
In VPC2, vSwitches VSW3 and VSW4 are deployed in Zone H and Zone I.

The following table describes the CIDR block planning for this topic. When you plan the CIDR blocks, make sure that the CIDR blocks to be connected do not overlap.

Click to view the VPC CIDR blocks.

Region	VPC	vSwitch	vSwitch zone	CIDR block planning
China (Chengdu)	VPC1 Primary CIDR block: 172.16.0.0/12	VSW1	Zone A	172.16.1.0/24
China (Chengdu)	VPC1 Primary CIDR block: 172.16.0.0/12	VSW2	Zone B	172.16.2.0/24
China (Hangzhou)	VPC2 Primary CIDR block: 192.168.0.0/16	VSW3	Zone H	192.168.1.0/24
China (Hangzhou)	VPC2 Primary CIDR block: 192.168.0.0/16	VSW4	Zone I	192.168.2.0/24

An ECS instance named ECS01 is created in VSW1 and an ECS instance named ECS02 is created in VSW3. Application services are deployed on both ECS01 and ECS02.
Click to view the sample commands for deploying test services on the ECS instances.
Sample commands for ECS01
```
yum install -y nginx
systemctl start nginx.service
cd /usr/share/nginx/html/
echo "Hello World ! This is chengdu ECS01." > index.html
```
Sample commands for ECS02
```
yum install -y nginx
systemctl start nginx.service
cd /usr/share/nginx/html/
echo "Hello World ! This is hangzhou ECS02." > index.html
```
A public-facing ALB instance is created in VPC1.
A domain name is registered, an ICP filing is obtained for the domain name, and a CNAME record is configured for the ALB instance that uses the custom domain name.
A CEN instance is created, and transit router instances are created in the China (Chengdu) and China (Hangzhou) regions for the CEN instance.

Procedure

Step 1: Create an ALB server group

Create an IP-type server group and add ECS01 and the cross-region ECS02 as backend servers.

Log on to the ALB console.
In the top navigation bar, select the region where the ALB instance is deployed. In this example, China (Chengdu) is selected.
In the navigation pane on the left, select ALB > Server Group.

On the Server Group page, click Create Server Group, configure the following parameters, and then click Create.

This topic describes only the required parameters. Use the default values for other parameters. For more information, see Server groups.

Configuration	Description
Server Group Type	Select IP. You can then attach servers that are not in a VPC CIDR block by adding their IP addresses.
VPC	Select VPC1.
Backend Server Protocol	Select HTTP. Note For a Basic Edition ALB instance, an HTTPS listener can select only server groups that use HTTP as the backend protocol.
Scheduling Algorithm	Use the default value Weighted Round-robin. For more information, see Introduction to Server Load Balancer Scheduling Algorithms.

In the Server group created. dialog box, click Add Backend Server .
In the Add Backend Server panel, add the private IP address of ECS01 and click Next. Set the Port and Weight for the added IP address, and then click OK.
The port must be the same as the port used by the backend service. In this example, enter 80 for the port and use the default weight.
Click Add IP Address to add the private IP address of ECS02. Because the IP address of ECS02 is not within the CIDR block of the VPC that is associated with the server group, you must enable Remote IP. Then, click Next, set the Port and Weight for the added IP address, and then click OK. In this example, the port is set to 80 and the default weight is used.
If Remote IP is disabled, you can enter only IP addresses from the CIDR block of the VPC where the server group is located. If you enable Remote IP, you can enter IP addresses from the following CIDR blocks.
- 10.0.0.0/8
- 100.64.0.0/10
- 172.16.0.0/12
- 192.168.0.0/16

Step 2: Configure a listener for the ALB instance

Log on to the ALB console.
In the top navigation bar, select the region where the ALB instance is deployed. In this example, China (Chengdu) is selected.
On the Instances page, find the ALB instance created in VPC1 and click Create Listener in the Operations column.

On the NLB Configuration Wizard > Configure Listener page, configure the following parameters, use the default values for the other parameters, and then click Next.

Listener configuration	Description
Select Listener Protocol	Select HTTP.
Listener Port	Enter the listening port that is used to receive requests and forward them to backend servers. The valid port range is 1 to 65535. In this topic, enter `80`.

In the Server Group drop-down list, select IP and the server group that you created in Step 1, and then click Next.
On the Configuration Review page, confirm the configurations and click Submit.

Step 3: Connect VPC instances to the transit router

Connect VPC1 to the transit router in the China (Chengdu) region and VPC2 to the transit router in the China (Hangzhou) region. The transit routers enable private network peering between VPC1 and VPC2 across regions. This ensures that ALB can forward client requests to servers in the cross-region VPC.

Log on to the Cloud Enterprise Network console.
On the CEN Instance page, click the CEN instance ID.
On the Basic Settings > Transit Router tab, find the transit router instance in the China (Chengdu) region and click Create Connection in the Operations column.

On the Connection with Peer Network Instance page, configure the following parameters and click OK to connect VPC1 to the transit router in the China (Chengdu) region.

This topic describes only the required parameters. Use the default values for other parameters. For more information, see Create a VPC connection on an Enterprise Edition transit router.

Parameter	Description
Instance Type	This topic uses VPC.
Region	Select the region where the network instance is deployed. In this topic, China (Chengdu) is selected.
Networks	Select the ID of the VPC to connect. In this topic, select VPC1.
vSwitch	Select vSwitch instances from the zones that are supported by the Enterprise Edition transit router. In this topic, select VSW1 and VSW2.

Click Create More Connections and connect VPC2 to the transit router in the China (Hangzhou) region based on the following information.
Parameter
Description
Instance Type
Select VPC.
Region
Select China (Hangzhou).
Networks
Select VPC2.
vSwitch
Select VSW3 and VSW4.

Step 4: Create an inter-region connection between the transit routers

After you connect the VPCs to the transit routers, create an inter-region connection between the transit routers in different regions. This is required to enable private network peering between VPC1 and VPC2.

Log on to the Cloud Enterprise Network console.
On the CEN Instance page, click the target CEN instance ID.
On the Basic Settings > Transit Router tab, find the transit router instance in the China (Chengdu) region and click Create Connection in the Operations column.

On the Connection with Peer Network Instance page, configure the following information and click OK.

This topic describes only the required parameters. Use the default values for other parameters. For more information, see Create an inter-region connection on an Enterprise Edition transit router.

Configuration item	Description
Instance Type	Select Inter-region Connection.
Region	Select the region that you want to connect. This topic uses China (Chengdu) as an example.
Peer Region	Select the peer region that you want to connect. This topic uses China (Hangzhou).
Bandwidth Allocation Mode	Select Pay-By-Data-Transfer. For cross-region traffic between transit routers, you can use Cloud Data Transfer (CDT) to reduce traffic costs. If you have not activated this service, see Upgrade to CDT billing to activate it. No fees are charged for activating CDT. You can also use a bandwidth plan as needed.

Step 5: Verify the results

After you complete the preceding steps, ALB can forward client requests to ECS01 and ECS02.

Test the connectivity
Enter the domain name in your browser, for example, http://<your domain name>. Refresh the page several times. The client receives responses as expected, and the responding server alternates between ECS01 and ECS02.
Fault testing
1. Stop the service on ECS01. Run the systemctl stop nginx.service command on ECS01 to stop the application.
2. Enter the domain name in your browser, for example, http://<your domain name>. The client still receives responses as expected. This indicates that load balancing is implemented for servers in the cross-region VPC.

FAQ

How do I mount cross-region VPC servers using a non-upgraded ALB instance?

If you use a non-upgraded ALB instance, you must perform additional operations. You must add routes for VPC1, VPC2, and the transit router, and configure security groups for the ECS instances. For more information, see Step 5: Configure routes and firewalls. The other steps are the same as those described in this topic.

Limits
Backend server limits
- Regions that support adding remote IPs for non-upgraded ALB instances.
- Cross-region backend servers are supported only for server groups of the IP type.
- Only private IP addresses are supported. Public IP addresses are not supported.
- You cannot add ALB, NLB, or CLB instances from the same VPC.
Forwarding configuration limits between ALB and backend servers
- You can use an Enterprise Edition transit router or Express Connect for remote IP forwarding. Basic Edition transit routers are not supported.
  If you use an Enterprise Edition transit router, it creates an elastic network interface (ENI) on a vSwitch in your specified availability zone. This ENI acts as the traffic ingress from the VPC to the transit router. When you create your VPC, make sure that you create at least one vSwitch in a supported availability zone to connect the VPC to the transit router. For more information, see Regions and zones that support Enterprise Edition transit routers.
- Within a Cloud Enterprise Network (CEN) instance, only one VPC per region can contain one or more ALB instances that use cross-region backend servers.
  ALB instances in multiple VPCs within the same region cannot use the same transit router to access a backend service.
  ALB instances in multiple VPCs within the same region cannot use multiple transit routers to access the same backend service.
- Traffic between an ALB instance and its backend servers can be forwarded only through the system route table. Custom route tables in the VPC are not supported.

Step 5: Configure routing and security groups

Add a route entry to the system route table of VPC1.

Check whether the system route table of VPC1 contains a route that points to the VPC1 connection of the transit router for the destination CIDR block. If not, add a route entry.

Note

ALB and backend service traffic is forwarded only through system route tables. Traffic is not forwarded through VPC custom route tables.

Log on to the Virtual Private Cloud Management Console.
On the VPC page, click the instance ID of VPC1.
On the VPC1 details page, click the Resource Management tab, and click the numeric link under Route Table.
On the Route Table page, find the System route table for VPC1, and click the route table ID.
On the route table details page, on the Route Entry List > Custom Route tab, click Add Route Entry.

In the Add Route Entry pane, configure the following parameters and click OK.

Parameter	Description
Destination CIDR Block	Enter the destination CIDR block to which you want to forward traffic. In this topic, enter the CIDR block of VPC2: `192.168.0.0/16`.
Next Hop Type	Select the next hop type. In this topic, select Transit Router.
Transit Router	Select the transit router instance. In this topic, select the VPC1 connection from Step 3.

Configure back-to-origin routes.

View the back-to-origin routes.
Perform the following steps to retrieve the back-to-origin route of the ALB instance.
1. Log on to the Application Load Balancer (ALB) console.
2. In the top navigation bar, select the region where the instance is deployed. In this example, China (Chengdu) is selected.
3. On the Instances page, click the target ALB instance ID.
4. Click the Instance Details tab and to the right of Back-to-origin Route, click View.

Add a back-to-origin route for ALB to the system route table in VPC2.

Log on to the VPC console.
On the VPC page, click the instance ID of VPC2.
On the VPC details page, click the Resource Management tab, and under Route Table, click the numeric link.
On the Route Table page, find the System route table for VPC2, and click the route table ID.
On the details page of the route table, select the Route Entry List > Custom Route tab, and click Add Route Entry.

In the Add Route Entry panel, configure the following parameters, and click OK.

Parameter	Description
Destination CIDR Block	Enter the destination CIDR block to which you want to forward traffic. In this topic, enter the back-to-origin routes of the ALB instance. If there are multiple back-to-origin routes, repeat this operation until all back-to-origin routes are configured.
Next Hop Type	Select a next hop type. This topic uses Transit Router.
Transit Router	Select the transit router instance. In this topic, select the transit router associated with VPC2.

Add a back-to-origin route for ALB to the transit router associated with VPC1.

Log on to the Cloud Enterprise Network console.
On the CEN Instance page, click the ID of the created CEN instance.
On the Basic Settings > Transit Router tab, find the transit router instance that is connected to VPC1, and click the ID of the transit router instance.
Click the Route Table tab. In the navigation pane on the left, click the target route table ID. On the route table details page, under the Route Entry tab, click Add Route Entry.

In the Add Route Entry dialog box, configure the route entry information, then click OK.

Configuration item	Description
Route Table	The current route table is selected by default.
Transit Router ID	The current transit router instance is selected by default.
Destination CIDR Block	The destination CIDR block of the route entry. In this topic, enter the back-to-origin routes of the ALB instance. If there are multiple back-to-origin routes, repeat this operation until all back-to-origin routes are configured.
Blackhole Route?	Select No.
Next Hop	Select the next hop connection of the route. In this topic, select the VPC1 connection.

Check the firewall settings of the backend ECS instances.
For cross-region access, messages to backend services are sent from a source IP address in the CIDR block of the VPC where the ALB instance is deployed. Ensure that the iptables or other third-party security software on your backend ECS instances does not block this CIDR block, for example, 172.16.0.0/12. Otherwise, cross-region access to the backend services fails.

Can ALB mount servers in two VPCs in the same region after a peering connection is created between them?

Yes, it can.

How am I charged for using ALB with CEN to mount servers in a cross-region VPC?

In addition to ALB fees, CEN fees are also incurred. For more information, see CEN billing.

References

To use an NLB to attach servers in a same-region IDC or a cross-region VPC, see Use an NLB to attach servers in a same-region IDC or Use an NLB to attach servers in a cross-region VPC.
To attach same-region IDC servers or cross-region VPC servers using NLB, see Attach same-region IDC servers using NLB or Attach servers in cross-region VPCs using NLB.