Attach on-premises IDC servers in the same region - Server Load Balancer

To use an Application Load Balancer (ALB) to attach on-premises Internet Data Center (IDC) servers in the same region for load balancing, combine ALB with Cloud Enterprise Network (CEN) and Transit Router to forward ALB requests to your IDC servers.

Scenario example

ALB supports attaching same-region and cross-region IDC (Internet Data Center) servers. This topic uses the example of ALB attaching same-region IDC servers.

A company created a virtual private cloud (VPC) named VPC1 in the China (Chengdu) region on Alibaba Cloud. In VPC1, the company deployed a public-facing ALB instance and wants to forward client requests through this ALB instance to IDC servers located in the same region. The company can use Cloud Enterprise Network (CEN) to connect VPC1 and a Virtual Border Router (VBR) to a Transit Router. The on-premises IDC connects to Alibaba Cloud through the VBR, and the ALB forwards traffic through the Transit Router to the IDC, achieving the goal of attaching same-region IDC servers to the ALB.

Limits

Note

Starting from February 25, 2025, 00:00:00 (UTC+8), newly created instances will by default use the upgraded Application Load Balancer (ALB). Existing ALB instances are not affected (except for instances created by submitting a self-service request). For more information, see Application Load Balancer (ALB) Instance Upgrade Announcement.
This topic uses the upgraded ALB instance as an example. If you are using a pre-upgrade ALB instance, see Instructions for pre-upgrade ALB instances.

Backend server limits

Only IP-type backend servers can be mounted across regions.
Only private IP addresses are supported. Public IP addresses are not supported.
To attach IPv6 servers, set IP Version to IPv4/IPv6 dual-stack when you create an IP-based server group. Note the following items:
- You can set the IP Version to IPv4/IPv6 dual-stack only if the IPv6 feature is enabled for the VPC selected for the server group.
- You can add the server group only to listeners or forwarding rules of dual-stack upgraded ALB instances. Non-upgraded ALB instances are not supported.
- When IP Version is set to IPv4/IPv6 dual-stack, you can add only IPv6 addresses from the CIDR block of the VPC for the server group. You cannot add remote IP addresses.

Forwarding configuration limits between ALB and backend servers

If you use an Enterprise Edition transit router, it creates an elastic network interface (ENI) on a vSwitch in your specified availability zone. This ENI acts as the traffic ingress from the VPC to the transit router. When you create a VPC, make sure that you create at least one vSwitch in the specified availability zone to connect the VPC to the transit router. For more information, see How transit routers work.
Traffic between an ALB instance and its backend servers can be forwarded only through the system route table. Custom route tables in the VPC are not supported.

Prerequisites

You have created a virtual private cloud (VPC) named VPC1 in the China (Chengdu) region, and created vSwitches VSW1 and VSW2 in Zone A and Zone B, respectively.

The following table shows the CIDR planning used in this topic. If you plan your own CIDR blocks, ensure no overlap exists between interconnected networks.

Southwest (Chengdu) region	vSwitch	vSwitch zone	CIDR planning
VPC1 Primary CIDR block: 172.16.0.0/12	VSW1	Zone A	172.16.0.0/24
VPC1 Primary CIDR block: 172.16.0.0/12	VSW2	Zone B	172.16.6.0/24
VBR	Not applicable	Not applicable	Customer-side IPv4 peer IP: 10.0.0.2/30 Alibaba Cloud-side IPv4 peer IP: 10.0.0.1/30
On-premises IDC	VSW3	Not applicable	192.168.20.0/24

You have created an ECS01 instance in VSW1 and deployed an application service on it.
Example commands to deploy a test service on ECS01:
```
yum install -y nginx
systemctl start nginx.service
cd /usr/share/nginx/html/
echo "Hello World ! This is c****u ECS01." > index.html
```
You have created an ALB instance in VPC1. This topic uses a public ALB instance as an example.
You have registered a domain name, completed ICP filing, and configured CNAME resolution for ALB using your custom domain.
You have created a CEN instance and a Transit Router instance in the China (Chengdu) region.
You have created an Express Connect circuit and a Virtual Border Router (VBR). For details, see Create and manage dedicated Express Connect connections and Create and manage Virtual Border Routers.
You have created a test server named ECS02 in your on-premises IDC and deployed an application service on it.
Example commands to deploy a test service on ECS02:
```
yum install -y nginx
systemctl start nginx.service
cd /usr/share/nginx/html/
echo "Hello World ! This is h****z ECS02." > index.html
```

Procedure

Step 1: Create an ALB server group

Create an IP-type server group and attach ECS01 and ECS02 from your IDC.

Log on to the ALB console.
In the top navigation bar, select the region where the ALB instance is deployed. In this example, China (Chengdu) is selected.
In the navigation pane on the left, select ALB > Server Group.

On the Server Group page, click Create Server Group, configure the following parameters, and then click Create.

This topic describes only the required parameters. Use the default values for other parameters. For more information, see Server groups.

Configuration	Description
Server Group Type	Select IP. You can then attach servers that are not in a VPC CIDR block by adding their IP addresses.
VPC	Select VPC1.
Backend Protocol	Select HTTP. Note For a Basic Edition ALB instance, an HTTPS listener can select only server groups that use HTTP as the backend protocol.
Scheduling Algorithm	Use the default value Weighted Round-robin. For more information, see Introduction to Server Load Balancer Scheduling Algorithms.

In the Server group created. dialog box, click Add Backend Server .
In the Add Backend Server panel, add the private IP address of ECS01 and click Next. Set the Port and Weight for the added IP address, and then click OK.
The port must be the same as the port used by the backend service. In this example, enter 80 for the port and use the default weight.
Click Add IP Address to add the private IP address of the on-premises IDC server ECS02. Since ECS02’s IP address is outside the VPC CIDR block associated with the server group, turn on Remote IP. Then click Next, set the Port and Weight for the added IP address, then click OK. This topic uses port 80 with the default weight.
If Remote IP is disabled, you can enter only IP addresses from the CIDR block of the VPC where the server group is located. If you enable Remote IP, you can enter IP addresses from the following CIDR blocks.
- 10.0.0.0/8
- 100.64.0.0/10
- 172.16.0.0/12
- 192.168.0.0/16

Step 2: Configure a listener for the ALB instance

Log on to the ALB console.
In the top navigation bar, select the region where the ALB instance is deployed. In this example, China (Chengdu) is selected.
On the Instances page, find the ALB instance created in VPC1 and click Create Listener in the Operations column.

On the NLB Configuration Wizard > Configure Listener page, configure the following parameters, use the default values for the other parameters, and then click Next.

Listener configuration	Description
Select Listener Protocol	Select HTTP.
Listener Port	Enter the listening port that is used to receive requests and forward them to backend servers. The valid port range is 1 to 65535. In this topic, enter `80`.

In the Server Group drop-down list, select IP and the server group that you created in Step 1, and then click Next.
On the Configuration Review page, confirm the configurations and click Submit.

Step 3: Create a VPC connection in CEN

Log on to the Cloud Enterprise Network console.
On the CEN Instance page, click the CEN instance ID.
On the Basic Settings > Transit Router tab, find the transit router instance in the China (Chengdu) region and click Create Connection in the Operations column.

On the Connection with Peer Network Instance page, configure the following parameters and click OK to connect VPC1 to the transit router in the China (Chengdu) region.

This topic describes only the required parameters. Use the default values for other parameters. For more information, see Create a VPC connection on an Enterprise Edition transit router.

Parameter	Description
Instance Type	This topic uses VPC.
Region	Select the region where the network instance is deployed. In this topic, China (Chengdu) is selected.
Networks	Select the ID of the VPC to connect. In this topic, select VPC1.
vSwitch	Select vSwitch instances from the zones that are supported by the Enterprise Edition transit router. In this topic, select VSW1 and VSW2.

Step 4: Create a VBR connection in CEN

After creating the VPC connection, click Create More Connections.

On the Connection with Peer Network Instance page, configure the following parameters and click OK to connect the VBR instance to the Transit Router in the China (Chengdu) region.

Only settings relevant to this topic are listed here. Keep other parameters at their default values. For more information, see Create a VBR connection using an Enterprise Edition Transit Router.

Parameter	Description
Instance Type	This topic uses Virtual Border Router (VBR).
Region	Select the region where the network instance resides. This topic uses China (Chengdu).
Networks	Select the VBR instance ID to connect. This topic uses the created VBR instance.

Step 5: Add a route entry to the system route table of VPC1

Check whether the system route table in VPC1 already contains a route entry pointing to the Transit Router VPC1 attachment for the destination CIDR block. If not, follow these steps to add one.

Note

Traffic between ALB and backend services can be forwarded only through the system route table. Custom route tables in VPC are not supported.

Log on to the Virtual Private Cloud console.
On the VPC page, click the instance ID of VPC1.
On the VPC1 details page, click the Resource Management tab. Under Route Tables, click the numeric link.
On the Route Tables page, find the System route table for VPC1 and click its route table ID.
On the route table details page, choose Route Entry List > Custom Route and click Add Route Entry.

In the Add Route Entry panel, configure the following parameters and click OK.

Parameter	Description
Destination CIDR Block	Enter the destination CIDR block to forward traffic to. This topic uses the on-premises IDC server CIDR block: `192.168.20.0/24`.
Next Hop Type	Select the next hop type. This topic uses Transit Router.
Transit Router	Select the network instance connection. This topic uses the VPC1 connection from Step 3.

Step 6: Configure VBR routes in Express Connect

Configure a route on the VBR that points to your on-premises IDC.

Log on to the Express Connect console.
In the top menu bar, select the target region. In the navigation pane on the left, click Virtual Border Routers (VBRs).
On the Virtual Border Routers (VBRs) page, click the ID of your target VBR instance.
On the VBR details page, click the Routes tab, then click Add Route.

In the Add Route panel, configure the following parameters and click OK.

Parameter	Description
Next Hop Type	Select the next hop type for the route entry. This topic uses Physical Connection Interfaces.
Destination CIDR Block	This topic uses the on-premises IDC server CIDR block: `192.168.20.0/24`.
Next Hop	Select the Express Connect circuit.

Step 7: Configure routes for the on-premises IDC

Identify the CIDR blocks of the vSwitches associated with the ALB instance and add routes for all these CIDR blocks to your on-premises IDC.

Note

After connecting a VPC instance to a Transit Router, the Transit Router automatically learns routes for all vSwitch CIDR blocks in the VPC. Therefore, you do not need to manually configure routes for the ALB-associated vSwitch CIDR blocks on the Transit Router.

Follow these steps to obtain the CIDR blocks of the vSwitches associated with the ALB instance.
1. Log on to the Virtual Private Cloud console.
2. In the top menu bar, select the region where VPC1 resides. This topic uses China (Chengdu).
3. On the VPC page, find and click the ID of VPC1.
4. On the VPC1 details page, click the Resource Management tab. Under vSwitch, click the numeric link.
5. On the vSwitch page, locate the vSwitches associated with the ALB instance and record their CIDR blocks.
Follow these steps to add routes for the ALB-associated vSwitch CIDR blocks to your on-premises IDC.
Add routes for the ALB-associated vSwitch CIDR blocks on your on-premises gateway device. Example routes used in this topic are shown below. If multiple vSwitches are involved, repeat the configuration until routes for all associated CIDR blocks are added.
Note
The route examples are for reference only. Actual commands may vary depending on your device vendor and model.
```
ip route 172.16.0.XX/24 255.255.255.0 <VBR instance Alibaba Cloud-side IP address>
ip route 172.16.6.XX/24 255.255.255.0 <VBR instance Alibaba Cloud-side IP address>
```

Step 8: Verify the result

Connectivity test
In your browser, enter the domain name, for example, http://<domain name>. Refresh the page multiple times. You should see responses alternating between ECS01 and ECS02.
Simulate a failure
1. Stop the ECS01 service by running systemctl stop nginx.service on ECS01.
2. In your browser, enter the domain name, for example, http://<domain name>. The client should still receive responses, confirming that load balancing between on-premises IDC servers and cloud servers in the same region works correctly.

FAQ

How do I attach same-region IDC servers using a pre-upgrade ALB instance?

When using a pre-upgrade ALB instance to attach same-region IDC servers, follow all steps described above except Step 7.

Limits
Backend server limits
- Regions that support adding remote IPs for non-upgraded ALB instances.
- Cross-region backend servers are supported only for server groups of the IP type.
- Only private IP addresses are supported. Public IP addresses are not supported.
- You cannot add ALB, NLB, or CLB instances from the same VPC.
Forwarding configuration limits between ALB and backend servers
- You can use an Enterprise Edition transit router or Express Connect for remote IP forwarding. Basic Edition transit routers are not supported.
  If you use an Enterprise Edition transit router, it creates an elastic network interface (ENI) on a vSwitch in your specified availability zone. This ENI acts as the traffic ingress from the VPC to the transit router. When you create your VPC, make sure that you create at least one vSwitch in a supported availability zone to connect the VPC to the transit router. For more information, see Regions and zones that support Enterprise Edition transit routers.
- Within a Cloud Enterprise Network (CEN) instance, only one VPC per region can contain one or more ALB instances that use cross-region backend servers.
  ALB instances in multiple VPCs within the same region cannot use the same transit router to access a backend service.
  ALB instances in multiple VPCs within the same region cannot use multiple transit routers to access the same backend service.
- Traffic between an ALB instance and its backend servers can be forwarded only through the system route table. Custom route tables in the VPC are not supported.

Step 7: Configure back-to-origin routes

Identify the ALB instance’s back-to-origin routes and add them to both the Transit Router attached to VPC1 and your on-premises IDC.

View back-to-origin routes.
Follow these steps to obtain the ALB instance’s back-to-origin routes.
1. Log on to the Application Load Balancer console.
2. In the top menu bar, select the region where your instance resides. This topic uses China (Chengdu).
3. On the Instances page, click the ID of your target ALB instance.
4. Click the Instance Details tab. On the right side of Back-to-origin Route, click View.

Follow these steps to add the ALB back-to-origin routes to the Transit Router attached to VPC1.

Log on to the Cloud Enterprise Network console.
On the CEN Instance page, click the ID of your CEN instance.
On the Basic Settings > Transit Router tab, find the Transit Router instance connected to VPC1 and click its ID.
Click the Route Table tab. In the left panel, click the target route table ID. On the route table details page, under the Routes tab, click Add Route Entry.

In the Add Route dialog box, configure the route entry and click OK.

configuration item	Description
Route Table	The system selects the current route table by default.
Transit Router ID	The system selects the current Transit Router instance by default.
Destination CIDR Block	Enter the destination CIDR block for the route entry. This topic uses the ALB instance’s back-to-origin route. If multiple back-to-origin routes exist, repeat the configuration until all are added.
Blackhole Route	Select No.
Next Hop	Select the next hop connection. This topic uses the VPC1 connection.

Follow these steps to add the ALB instance’s back-to-origin routes to your on-premises IDC.
Add the ALB back-to-origin routes on your on-premises gateway device. Example routes are shown below. If multiple back-to-origin routes exist, repeat the configuration until all are added.
Note
The route examples are for reference only. Actual commands may vary depending on your device vendor and model.
```
ip route 100.XX.XX.0/25 255.255.255.128 <VBR instance Alibaba Cloud-side IP address>
```

Public networkALB and private networkALB both support attaching on-premises data center servers?

Supported.

References

To attach servers in cross-region VPCs using ALB, see Attach servers in cross-region VPCs using ALB.
To attach same-region IDC servers or cross-region VPC servers using NLB, see Attach same-region IDC servers using NLB or Attach servers in cross-region VPCs using NLB.