Configure IP version affinity forwarding

Problem

During the migration from IPv4 to IPv6, services for both protocols often need to coexist. When a server group contains both IPv4 and IPv6 backend servers, an ALB instance, by default, does not differentiate between client IP protocol versions. It forwards traffic based only on the configured scheduling algorithm, such as weighted round-robin or weighted least connections.

This can lead to cross-protocol forwarding, where a request from an IPv6 client is sent to an IPv4-only backend server, or vice versa. This protocol mismatch can cause the following issues:

• Service disruptions occur when a backend application, which listens for only one protocol version, receives a request using a different protocol and fails to process it.

• Mixed forwarding does not support services that must handle traffic differently based on the client's IP protocol version, such as protocol-based traffic splitting or IPv6-first routing.

Solution

ALB server groups support IP version affinity. When enabled, IPv4 requests are forwarded exclusively to IPv4 backend servers and IPv6 requests to IPv6 backend servers, preventing service interruptions caused by cross-protocol forwarding. If all backend servers of a given protocol fail health checks, requests are distributed on a best-effort basis among those unhealthy servers rather than being routed to servers of the other protocol.

Step 1: Create ECS instances and deploy services

1. Create two ECS instances based on the following configurations.

   Instance name	Region	VPC	vSwitch	IP version	Image
   ecs-ipv4	China (Shanghai)	VPC1	VSW1	IPv4	Alibaba Cloud Linux 3.2104 LTS 64-bit
   ecs-ipv6			VSW2	IPv6 When you create the ECS instance, in the Network and Security Group section, select Assign IPv6 Address for Free.

2. Connect to ecs-ipv4 and ecs-ipv6 and run the following command to deploy the Nginx service.

   ecs-ipv4

   sudo yum install -y nginx
   sudo systemctl start nginx
   echo "Hello from IPv4 backend" | sudo tee /usr/share/nginx/html/index.html

   ecs-ipv6

   sudo yum install -y nginx
   sudo systemctl start nginx
   echo "Hello from IPv6 backend" | sudo tee /usr/share/nginx/html/index.html

3. Add inbound rules with a high priority to the security groups of both ECS instances to allow traffic on port 80.

   Instance name	Action	Protocol	Source	Destination (this instance)
   ecs-ipv4	Allow	Custom TCP	After selecting IPv4, select VPC CIDR Block.	For Port, select HTTP (80).
   ecs-ipv6			Select IPv6, and then select This VPC's CIDR block.

   For more information, see Create an instance by using the wizard, Connect to an ECS instance, and Add a security group rule.

Step 2: Create a dual-stack ALB instance

1. Log on to the ALB console, select the China (Shanghai) region, and click Create ALB.

2. Specify the following settings, keep other options at their default values, and click Buy Now:

   • Instance Network Type: Select Public.

   • VPC: Select VPC1.

   • Availability Zone: Select Availability Zone E and Availability Zone G, the corresponding vSwitches VSW1 and VSW2, and Auto-assign Public IP.

   • Address Type: Select Dual-stack.

   • Edition (Instance Fee): Select Standard.

     IP version affinity is supported only by Standard and WAF-enhanced ALB instances, not by Basic or Advanced instances.

3. After the instance is created, click its ID to open the Instance Details page. In the Basic Information section, locate Network Type, and click Change Network Type next to IPv6: Private. In the dialog box that appears, click OK.

Step 3: Create a dual-stack server group with affinity

1. In the server group console, click Create Server Group.

2. Specify the following settings and click Create:

   • Server Group Type: Select Server.

     IP version affinity is available only for server groups of the Server Type and IP Type.

   • Server Group Name: Enter sgp-alb-dualstack.

   • VPC: Select VPC1.

   • Backend Server Protocol: Select HTTP.

   • Expand Advanced Settings and complete the following configurations:

     • IP Version: Select IPv4/IPv6 dual-stack. This allows you to add both IPv4 and IPv6 backend servers.

     • IP Version Affinity: Select Affinity mode. When enabled, IPv4 requests are forwarded only to IPv4 backends, and IPv6 requests are forwarded only to IPv6 backends.

3. Click Add Backend Server in the The server group is created dialog box. In the IP column, select an IPv4 address for ecs-ipv4 and an IPv6 address for ecs-ipv6. Select two instances and click Next.

4. In the Ports/Weights step, set the Port for both servers to 80, and click OK to complete the addition.

Step 4: Create a listener

1. In the ALB console, click the ID of the target instance to go to its details page. On the Listener tab, click Create Listener.

2. In the Configure Listener step, set Listener Protocol to HTTP , enter 80 for Listener Port, and click Next.

   This topic uses an HTTP listener to demonstrate the affinity forwarding capability. We recommend using an HTTPS listener in a production environment.

3. In the Select Server Group step, select the server group sgp-alb-dualstack, and click Next.

4. On the Configuration Review step, confirm the configuration and click Submit.

Step 5: Configure DNS resolution

Create a CNAME record to map your custom domain to the DNS name of the ALB instance.

The following example uses Alibaba Cloud DNS. If your domain is not registered with Alibaba Cloud, you must first add the domain name to the Alibaba Cloud DNS console.

1. In the ALB console, copy the Domain Name of the target instance.

2. Log on to the Alibaba Cloud DNS console. In the Actions column for your target domain, click Settings. On the Settings page, click Add Record.

3. Add a CNAME record with the following settings and click OK:

   • Record Type: Select CNAME.

   • Hostname: Enter a domain name prefix, such as test. If your root domain is example.com, the domain name used to access the ALB is test.example.com.

   • Query Source and TTL: Keep the default values.

   • Record Value: Enter the DNS name of the ALB instance.

4. In the Change Resource Record Confirmation dialog box, review the DNS information and click OK.

Step 6: Verify affinity forwarding

When a client resolves the custom domain of a dual-stack ALB instance, the DNS server returns an A record (IPv4) or AAAA record (IPv6) based on the client's network capabilities.

curl -4 http://test.example.com

curl -6 http://test.example.com

Billing

• ALB instance: ALB supports pay-as-you-go (postpaid) and resource plans (prepaid). For more information, see ALB billing rules.

• ECS instance: For details, see Billing overview for ECS. If you create an ECS instance for testing, we recommend using a low-specification pay-as-you-go instance and releasing it promptly after use.

• Domain name and DNS resolution fees: In addition to the domain name fee from your provider, you must pay for public authoritative DNS resolution when you configure DNS resolution on Alibaba Cloud.

• Public network fees: You are charged for the public IP address associated with the ALB instance and for the IPv6 public bandwidth of the VPC where the instance resides.

Regions that support dual-stack ALB instances

Production considerations

• High-availability deployment: Deploy backend servers across multiple availability zones. Ensure redundancy for both IPv4 and IPv6 backends to avoid single points of failure.

• Health check configuration: Adjust the health check interval, timeout, and thresholds based on your service requirements to promptly remove faulty servers from rotation.

FAQ