Use ALB to attach on-premises IDC servers in the same region

To use an Application Load Balancer (ALB) to attach on-premises Internet Data Center (IDC) servers in the same region for load balancing, combine ALB with Cloud Enterprise Network (CEN) and Transit Router to forward ALB requests to your IDC servers.

Scenario example

ALB supports attaching same-region and cross-region IDC (Internet Data Center) servers. This topic uses the example of ALB attaching same-region IDC servers.

A company created a virtual private cloud (VPC) named VPC1 in the China (Chengdu) region on Alibaba Cloud. In VPC1, the company deployed a public-facing ALB instance and wants to forward client requests through this ALB instance to IDC servers located in the same region. The company can use Cloud Enterprise Network (CEN) to connect VPC1 and a Virtual Border Router (VBR) to a Transit Router. The on-premises IDC connects to Alibaba Cloud through the VBR, and the ALB forwards traffic through the Transit Router to the IDC, achieving the goal of attaching same-region IDC servers to the ALB.

Limits

Note

Starting from February 25, 2025, 00:00:00 (UTC+8), newly created instances will by default use the upgraded Application Load Balancer (ALB). Existing ALB instances are not affected (except for instances created by submitting a self-service request). For more information, see Application Load Balancer (ALB) Instance Upgrade Announcement.
This topic uses the upgraded ALB instance as an example. If you are using a pre-upgrade ALB instance, see Instructions for pre-upgrade ALB instances.

Backend server limits

You can add backend servers from other regions to a server group only by specifying their IP addresses.
Only private IP addresses are supported.
To add IPv6 backend servers, you must enable IPv6 attachment when you create an IP-based server group. The following limitations apply:
- You can enable IPv6 attachment for the server group only if IPv6 is enabled for the selected Virtual Private Cloud (VPC).
- You can add the server group only to a listener or forwarding rule of a dual-stack upgraded ALB instance. Legacy ALB instances are not supported.
- After you enable IPv6 attachment, you can add only IPv6 addresses from the CIDR block of the server group's VPC. You cannot add remote IP addresses.

Forwarding configuration limits between ALB and backend servers

An Enterprise Edition transit router creates an ENI on a vSwitch in your specified zone, which serves as the traffic ingress from the VPC to the transit router. Therefore, you must create at least one vSwitch in that zone to connect the VPC to the transit router. For more information, see How transit routers work.
Traffic between an ALB instance and its backend servers can be forwarded only through the system route table. Custom VPC route tables are not supported.

Prerequisites

You have created a virtual private cloud (VPC) named VPC1 in the China (Chengdu) region, and created vSwitches VSW1 and VSW2 in Zone A and Zone B, respectively.

The following table shows the CIDR planning used in this topic. If you plan your own CIDR blocks, ensure no overlap exists between interconnected networks.

Southwest (Chengdu) region	vSwitch	vSwitch zone	CIDR planning
VPC1 Primary CIDR block: 172.16.0.0/12	VSW1	Zone A	172.16.0.0/24
VPC1 Primary CIDR block: 172.16.0.0/12	VSW2	Zone B	172.16.6.0/24
VBR	Not applicable	Not applicable	Customer-side IPv4 peer IP: 10.0.0.2/30 Alibaba Cloud-side IPv4 peer IP: 10.0.0.1/30
On-premises IDC	VSW3	Not applicable	192.168.20.0/24

You have created an ECS01 instance in VSW1 and deployed an application service on it.
Example commands to deploy a test service on ECS01:
```
yum install -y nginx
systemctl start nginx.service
cd /usr/share/nginx/html/
echo "Hello World ! This is c****u ECS01." > index.html
```
You have created an ALB instance in VPC1. This topic uses a public ALB instance as an example.
You have registered a domain name, completed ICP filing, and configured CNAME resolution for ALB using your custom domain.
You have created a CEN instance and a Transit Router instance in the China (Chengdu) region.
You have created an Express Connect circuit and a Virtual Border Router (VBR). For details, see Create and manage dedicated Express Connect connections and Create and manage Virtual Border Routers.
You have created a test server named ECS02 in your on-premises IDC and deployed an application service on it.
Example commands to deploy a test service on ECS02:
```
yum install -y nginx
systemctl start nginx.service
cd /usr/share/nginx/html/
echo "Hello World ! This is h****z ECS02." > index.html
```

Procedure

Step 1: Create an ALB server group

Create an IP-type server group and attach ECS01 and ECS02 from your IDC.

Log on to the ALB console.
In the top navigation bar, select the region where the ALB instance is deployed. In this example, China (Chengdu) is selected.
In the left-side navigation pane, choose ALB > Server Group.

On the Server Group page, click Create Server Group, complete the following configurations, and then click Create.

Only key parameters are listed. For all parameters, see Server groups for Application Load Balancer (ALB).

Parameter	Description
Server Group Type	Select IP. This allows you to add backend servers outside the VPC CIDR block by specifying their IP addresses.
VPC	Select VPC1.
Backend Server Protocol	Select HTTP. Note An HTTPS listener on a basic ALB instance can only be associated with a server group that uses the HTTP backend protocol.
Scheduling Algorithm	Use the default value Weighted Round-robin. Load balancing scheduling algorithms.

In the Server group created. dialog box, click Add Backend Server .
In the Add Backend Server pane, add the private IP address of ECS01, click Next, set the Port and Weight, and then click OK.

The port must match the backend service port. In this example, set the port to 80 and use the default weight.
Click Add IP Address to add the private IP address of the on-premises IDC server ECS02. Since ECS02’s IP address is outside the VPC CIDR block associated with the server group, turn on Remote IP. Then click Next, set the Port and Weight for the added IP address, then click OK. This topic uses port 80 with the default weight.
When Remote IP is disabled, you can only enter IP addresses from the VPC's CIDR block. When Remote IP is enabled, you can enter IP addresses from the following CIDR blocks:
- 10.0.0.0/8
- 100.64.0.0/10
- 172.16.0.0/12
- 192.168.0.0/16

Step 2: Configure a listener

Log on to the ALB console.
In the top navigation bar, select the region where the ALB instance is deployed. In this example, China (Chengdu) is selected.
On the Instances page, find the ALB instance that you created in VPC1, and click Create Listener in the Operations column.

On the NLB Configuration Wizard > Configure Listener page, configure the following parameters, use the default values for the others, and then click Next.

Listener configuration	Description
Select Listener Protocol	Select HTTP.
Listener Port	Enter a port (1-65535) for receiving requests. In this example, enter `80`.

In the Server Group step, select the server group of the IP type that you created in Step 1, and then click Next.
In the Configuration Review step, confirm the settings and click Submit.

Step 3: Create a VPC connection in CEN

Log on to the Cloud Enterprise Network (CEN) console.
On the CEN Instance page, click the ID of the CEN instance that you created.
On the Basic Settings > Transit Router tab, find the TR instance in the China (Chengdu) region and click Create Connection in the Operations column.

On the Connection with Peer Network Instance page, configure the following parameters and click OK to connect VPC1 to the TR in the China (Chengdu) region.

Only key parameters are listed. For all parameters, see Create a VPC connection by using an Enterprise Edition transit router.

Parameter	Description
Instance Type	Select VPC.
Region	Select the region of the network instance. In this example, select China (Chengdu).
Networks	Select the VPC. In this example, select VPC1.
vSwitch	Select vSwitches in zones supported by the Enterprise Edition transit router. In this example, select VSW1 and VSW2.

Step 4: Create a VBR connection in CEN

After creating the VPC connection, click Create More Connections.

On the Connection with Peer Network Instance page, configure the following parameters and click OK to connect the VBR instance to the Transit Router in the China (Chengdu) region.

Only settings relevant to this topic are listed here. Keep other parameters at their default values. For more information, see Create a VBR connection using an Enterprise Edition Transit Router.

Parameter	Description
Instance Type	This topic uses Virtual Border Router (VBR).
Region	Select the region where the network instance resides. This topic uses China (Chengdu).
Networks	Select the VBR instance ID to connect. This topic uses the created VBR instance.

Step 5: Add a route entry to the system route table of VPC1

Check whether the system route table in VPC1 already contains a route entry pointing to the Transit Router VPC1 attachment for the destination CIDR block. If not, follow these steps to add one.

Note

Traffic between ALB and backend services can be forwarded only through the system route table. Custom route tables in VPC are not supported.

Log on to the Virtual Private Cloud console.
On the VPC page, click the instance ID of VPC1.
On the VPC1 details page, click the Resource Management tab. Under Route Tables, click the numeric link.
On the Route Tables page, find the System route table for VPC1 and click its route table ID.
On the route table details page, choose Route Entry List > Custom Route and click Add Route Entry.

In the Add Route Entry panel, configure the following parameters and click OK.

Parameter	Description
Destination CIDR Block	Enter the destination CIDR block to forward traffic to. This topic uses the on-premises IDC server CIDR block: `192.168.20.0/24`.
Next Hop Type	Select the next hop type. This topic uses Transit Router.
Transit Router	Select the network instance connection. This topic uses the VPC1 connection from Step 3.

Step 6: Configure VBR routes in Express Connect

Configure a route on the VBR that points to your on-premises IDC.

Log on to the Express Connect console.
In the top menu bar, select the target region. In the navigation pane on the left, click Virtual Border Routers (VBRs).
On the Virtual Border Routers (VBRs) page, click the ID of your target VBR instance.
On the VBR details page, click the Routes tab, then click Add Route.

In the Add Route panel, configure the following parameters and click OK.

Parameter	Description
Next Hop Type	Select the next hop type for the route entry. This topic uses Physical Connection Interfaces.
Destination CIDR Block	This topic uses the on-premises IDC server CIDR block: `192.168.20.0/24`.
Next Hop	Select the Express Connect circuit.

Step 7: Configure routes for the on-premises IDC

Identify the CIDR blocks of the vSwitches associated with the ALB instance and add routes for all these CIDR blocks to your on-premises IDC.

Note

After connecting a VPC instance to a Transit Router, the Transit Router automatically learns routes for all vSwitch CIDR blocks in the VPC. Therefore, you do not need to manually configure routes for the ALB-associated vSwitch CIDR blocks on the Transit Router.

Follow these steps to obtain the CIDR blocks of the vSwitches associated with the ALB instance.
1. Log on to the Virtual Private Cloud console.
2. In the top menu bar, select the region where VPC1 resides. This topic uses China (Chengdu).
3. On the VPC page, find and click the ID of VPC1.
4. On the VPC1 details page, click the Resource Management tab. Under vSwitch, click the numeric link.
5. On the vSwitch page, locate the vSwitches associated with the ALB instance and record their CIDR blocks.
Follow these steps to add routes for the ALB-associated vSwitch CIDR blocks to your on-premises IDC.
Add routes for the ALB-associated vSwitch CIDR blocks on your on-premises gateway device. Example routes used in this topic are shown below. If multiple vSwitches are involved, repeat the configuration until routes for all associated CIDR blocks are added.

Note
The route examples are for reference only. Actual commands may vary depending on your device vendor and model.
```
ip route 172.16.0.XX/24 255.255.255.0 <VBR instance Alibaba Cloud-side IP address>
ip route 172.16.6.XX/24 255.255.255.0 <VBR instance Alibaba Cloud-side IP address>
```

Step 8: Verify the result

Connectivity test

In your browser, enter the domain name, for example, http://<domain name>. Refresh the page multiple times. You should see responses alternating between ECS01 and ECS02.
Simulate a failure
1. Stop the ECS01 service by running systemctl stop nginx.service on ECS01.
2. In your browser, enter the domain name, for example, http://<domain name>. The client should still receive responses, confirming that load balancing between on-premises IDC servers and cloud servers in the same region works correctly.

FAQ

How do I attach same-region IDC servers using a pre-upgrade ALB instance?

When using a pre-upgrade ALB instance to attach same-region IDC servers, follow all steps described above except Step 7.

Limits
Backend server limits
- Regions that support adding remote IPs for non-upgraded ALB instances.
- Cross-region backend servers are supported only for IP-type server groups.
- Only private IP addresses are supported.
- Adding ALB, NLB, or CLB instances from the same VPC is not supported.
Forwarding configuration limits between ALB and backend servers
- Remote IP forwarding is supported through an Enterprise Edition transit router or Express Connect. Basic Edition transit routers are not supported.
  
  If you use an Enterprise Edition transit router, it creates an ENI on a vSwitch in your specified zone. This ENI acts as the traffic ingress from the VPC to the transit router. When you create your VPC, ensure that you create at least one vSwitch in a supported zone to connect the VPC to the transit router. For more information, see Supported regions and zones for Enterprise Edition transit routers.
- Within a single CEN instance, only one VPC in each region can contain ALB instances that use cross-region backend servers.
  
  ALB instances in multiple VPCs within the same region cannot use the same transit router to access a backend service.
  
  ALB instances in multiple VPCs within the same region cannot use multiple transit routers to access the same backend service.
- Traffic between an ALB instance and its backend servers can be forwarded only through the system route table. Custom VPC route tables are not supported.

Step 7: Configure back-to-origin routes

Identify the ALB instance’s back-to-origin routes and add them to both the Transit Router attached to VPC1 and your on-premises IDC.

View back-to-origin routes.

Follow these steps to obtain the ALB instance’s back-to-origin routes.
1. Log on to the Application Load Balancer console.
2. In the top menu bar, select the region where your instance resides. This topic uses China (Chengdu).
3. On the Instances page, click the ID of your target ALB instance.
4. Click the Instance Details tab. On the right side of Back-to-origin Route, click View.

Follow these steps to add the ALB back-to-origin routes to the Transit Router attached to VPC1.

Log on to the Cloud Enterprise Network console.
On the CEN Instance page, click the ID of your CEN instance.
On the Basic Settings > Transit Router tab, find the Transit Router instance connected to VPC1 and click its ID.
Click the Route Table tab. In the left panel, click the target route table ID. On the route table details page, under the Routes tab, click Add Route Entry.

In the Add Route dialog box, configure the route entry and click OK.

configuration item	Description
Route Table	The system selects the current route table by default.
Transit Router ID	The system selects the current Transit Router instance by default.
Destination CIDR Block	Enter the destination CIDR block for the route entry. This topic uses the ALB instance’s back-to-origin route. If multiple back-to-origin routes exist, repeat the configuration until all are added.
Blackhole Route	Select No.
Next Hop	Select the next hop connection. This topic uses the VPC1 connection.

Follow these steps to add the ALB instance’s back-to-origin routes to your on-premises IDC.
Add the ALB back-to-origin routes on your on-premises gateway device. Example routes are shown below. If multiple back-to-origin routes exist, repeat the configuration until all are added.

Note
The route examples are for reference only. Actual commands may vary depending on your device vendor and model.
```
ip route 100.XX.XX.0/25 255.255.255.128 <VBR instance Alibaba Cloud-side IP address>
```

Public networkALB and private networkALB both support attaching on-premises data center servers?

Supported.

References

To attach servers in cross-region VPCs using ALB, see Attach servers in cross-region VPCs using ALB.
To attach same-region IDC servers or cross-region VPC servers using NLB, see Attach same-region IDC servers using NLB or Attach servers in cross-region VPCs using NLB.