All Products
Search
Document Center

Server Load Balancer:CreateLoadBalancerTCPListener

Last Updated:Sep 08, 2026

Creates a TCP listener.

Operation description

Note

The newly created listener is in the stopped state. After the listener is created, call the StartLoadBalancerListener operation to start the listener to forward traffic.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

  • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

  • API: The API that you can call to perform the action.

  • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

  • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

    • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

    • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

  • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

  • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

slb:CreateLoadBalancerTCPListener

create

AccessControlList

acs:slb:{#regionId}:{#accountId}:acl/{#AclId}

*LoadBalancer

acs:slb:{#regionId}:{#accountId}:loadbalancer/{#LoadBalancerId}

  • slb:tag
  • slb:tag
  • slb:tag
None

Request parameters

Parameter

Type

Required

Description

Example

RegionId

string

No

The region ID of the Classic Load Balancer (CLB) instance.

You can query the region ID from the Regions and zones list or by invoking the DescribeRegions operation.

cn-hangzhou

LoadBalancerId

string

Yes

The ID of the CLB instance.

lb-bp1b6c719dfa08ex****

ListenerPort

integer

Yes

The frontend port used by the CLB instance.

Valid values: 1 to 65535.

80

BackendServerPort

integer

No

The backend port used by the CLB instance.

Valid values: 1 to 65535.

This parameter is required if you do not use a server group (do not specify vServerGroupId).

80

Tag

array<object>

No

The tags.

object

No

The tags.

Key

string

No

The tag key of the listener. Valid values of N: 1 to 20. The tag key cannot be an empty string. The tag key can be up to 64 characters in length and cannot start with aliyun or acs:. The tag key cannot contain http:// or https://.

TestKey

Value

string

No

The tag value of the listener. Valid values of N: 1 to 20. The tag value can be an empty string. The tag value can be up to 128 characters in length and cannot start with acs:. The tag value cannot contain http:// or https://.

TestValue

Bandwidth

integer

Yes

The peak bandwidth of the listener. Unit: Mbit/s. Valid values:

  • -1: For a pay-by-data-transfer Internet-facing SLB instance, you can set the peak bandwidth to -1, which specifies unlimited bandwidth.

  • 1 to 5120: For a pay-by-bandwidth Internet-facing SLB instance, you can set the peak bandwidth for each listener. The sum of the peak bandwidth values of all listeners cannot exceed the peak bandwidth of the instance.

-1

Scheduler

string

No

The scheduling algorithm. Valid values:

  • wrr (default): Backend servers with higher weights receive more requests through polling.

  • rr: Requests are distributed to backend servers in access sequence.

  • sch: Consistent hashing based on source IP addresses. Requests from the same source IP address are distributed to the same backend server.

  • tch: Consistent hashing based on the following parameters: source IP address, destination IP address, source port, and destination port. Requests that contain the same information based on the four factors are distributed to the same backend server.

Note

Only high-performance instances support the sch and tch consistent hashing algorithms.

wrr

PersistenceTimeout

integer

No

The timeout period of session persistence. Unit: seconds.

Valid values: 0 to 3600.

Default value: 0, which indicates that session persistence is disabled.

0

EstablishedTimeout

integer

No

The connection timeout period. Unit: seconds.

Valid values: 10 to 900.

500

HealthyThreshold

integer

No

The number of consecutive successful health checks that must occur before a backend server is declared healthy. The health check status of the backend server changes from fail to success.

Valid values: 2 to 10.

4

UnhealthyThreshold

integer

No

The number of consecutive failed health checks that must occur before a backend server is declared unhealthy. The health check status of the backend server changes from success to fail.

Valid values: 2 to 10.

4

HealthCheckConnectTimeout

integer

No

The maximum timeout period for each health check response. Unit: seconds.

Valid values: 1 to 300.

Default value: 5.

100

HealthCheckConnectPort

integer

No

The port used for health checks.

Valid values: 1 to 65535.

If this parameter is not set, the backend service port (BackendServerPort) is used for health checks.

80

healthCheckInterval

integer

No

The interval between two consecutive health checks. Unit: seconds.

Valid values: 1 to 50.

3

HealthCheckDomain

string

No

The domain name used for health checks. Valid values:

  • $_ip: the private IP address of the backend server. If you specify $_ip or do not specify this parameter, Server Load Balancer uses the private network IP address of each backend server as the domain name for health checks.

  • domain: The domain name must be 1 to 80 characters in length and can contain only letters, digits, periods (.), and hyphens (-).

172.XX.XX.6

HealthCheckURI

string

No

The URI used for health checks. The URI must be 1 to 80 characters in length and can contain only letters, digits, hyphens (-), forward slashes (/), periods (.), percent signs (%), number signs (#), and ampersands (&). The URI cannot be only a forward slash (/) but must start with a forward slash (/).

You can configure this parameter when the TCP listener requires HTTP health checks. If this parameter is not configured, TCP health checks are performed.

/test/index.html

HealthCheckHttpCode

string

No

The HTTP status code that indicates a Normal health check result. Separate multiple HTTP status codes with commas (,). Valid values:

  • http_2xx (default)

  • http_3xx

  • http_4xx

  • http_5xx

http_2xx,http_3xx

HealthCheckType

string

No

The health check type. Valid values:

  • tcp (default)

  • http

tcp

VServerGroupId

string

No

The ID of the vServer group.

rsp-cige6j****

MasterSlaveServerGroupId

string

No

The ID of the primary/secondary server group.

Note

You can specify only one of the vServer group ID and the primary/secondary server group ID.

rsp-0bfucw****

AclId

string

No

The ID of the access control list (ACL) bound to the listener.

Note

This parameter is required when the AclStatus parameter is set to on.

acl-uf60jwfiv6******

AclType

string

No

The type of access control. Valid values:

  • white: Only requests from the IP addresses or CIDR blocks in the selected access control policy group are forwarded. Whitelists are applicable to scenarios in which you want to allow only specific IP addresses to access your service. Configuring a whitelist poses risks to your workloads. After a whitelist is configured, only the IP addresses in the whitelist can access the SLB listener. If a whitelist is enabled but no IP address is added to the access control policy group, the SLB listener forwards all requests.

  • black: All requests from the IP addresses or CIDR blocks in the selected access control policy group are denied. Blacklists are applicable to scenarios in which you want to deny access from specific IP addresses. If a blacklist is enabled but no IP address is added to the access control policy group, the SLB listener forwards all requests.

Note

This parameter takes effect only when the AclStatus parameter is set to on.

black

AclStatus

string

No

Specifies whether to enable access control. Valid values:

  • on: enabled.

  • off (default): disabled.

off

Description

string

No

The custom listener name.

The name must be 1 to 256 characters in length and can contain Chinese characters, letters, digits, hyphens (-), forward slashes (/), periods (.), and underscores (_).

tcp_80

ConnectionDrain

string

No

Specifies whether to enable connection draining. Valid values:

  • on: enabled.

  • off: disabled.

off

ConnectionDrainTimeout

integer

No

The timeout period of connection draining. Unit: seconds.

Valid values: 10 to 900.

Note

This parameter is required when ConnectionDrain is set to on.

300

ProxyProtocolV2Enabled

boolean

No

Specifies whether to use the Proxy Protocol to pass the client source address to the backend server. Valid values:

  • true: enabled.

  • false (default): disabled.

false

HealthCheckSwitch

string

No

Specifies whether to enable health checks. Valid values:

  • on (default): enabled.

  • off: disabled.

on

Response elements

Element

Type

Description

Example

object

RequestId

string

The request ID.

CEF72CEB-54B6-4AE8-B225-F876FF7BA984

Examples

Success response

JSON format

{
  "RequestId": "CEF72CEB-54B6-4AE8-B225-F876FF7BA984"
}

Error codes

HTTP status code

Error code

Error message

Description

400 InvalidParameterValue.SpecNotSupport The loadBalancer of shared spec does not support the parameter value, %s. The specified parameter value is not supported by shared-resource SLB instances.
400 OperationNotSupport.Acl The cloud box instance does not support acl. CloudBox instances do not support access control configuration.
400 InvalidParameterValue.RegionNotSupport The region does not support the parameter value, %s. The specified parameter value is not supported in the current region.
400 Abs.VServerGroupIdAndMasterSlaveServerGroupId.MissMatch The parameters VServerGroupId or MasterSlaveServerGroupId miss match.
400 IpVersionConflict The ip version of this LoadBalancer and the Acl is conflict. The IP version of the specified Server Load Balancer instance conflicts with the IP type supported by the ACL.
400 InvalidParameterValue.ZoneNotSupport The zone does not support the parameter value, %s. The specified parameter value is not supported in the current zone.
400 ListenerProcessing A previous configuration of the listener is pending, please try again later. The current listener is being configured. Try again later.
400 AclNotExist Acl does not exist. The specified ACL does not exist.
400 InvalidParameter.ListenerPortConflict There is conflict listener port exists. The specified listener port already exists.
400 InvalidParameter.ZoneNotSupport The zone does not support the parameter %s. The specified parameter is not supported in the current zone.
400 InvalidParam.VServerGroupId The specified VServerGroupId is invalid. The specified VServerGroupId is invalid. Check the parameter constraints and try again.
400 MissingParam.HealthCheckConnectPort The parameter HealthCheckConnectPort is required. The HealthCheckConnectPort parameter is missing.
400 InvalidParam.ListenerPort The specified ListenerPort is invalid. The specified ListenerPort is invalid. Check the parameter constraints and try again after you make modifications.
400 InvalidParam.StartPort The specified StartPort is invalid. The specified StartPort is invalid. Check the parameter constraints and try again.
400 InvalidParamSize.PortRange The size of param PortRange is invalid. The specified PortRange is invalid. Check the parameter constraints and try again after you make modifications.
400 InvalidParam.EndPort The specified EndPort is invalid. The specified EndPort is invalid. Check the parameter constraints and try again after you make modifications.
400 Duplicated.AclEntry %s. %s
400 OperationUnsupported.SetAccessControl The singleTunnel/anyTunnel loadbalancer does not support config AccessControlList. The operation is denied because SingleTunnel and AnyTunnel SLB instances do not support ACL configuration.
400 InvalidParam.PortRange The specified PortRange is invalid. The specified PortRange is invalid. Check the parameter constraints and try again after you make modifications.
400 InvalidParameter.RegionNotSupport The region does not support the parameter: %s. The specified parameter is not supported in the current region.
400 LbNotSupportTcpssl You cannot create a TCP SSL type listener for the specified load balancer. The specified instance does not support creating listeners of the TCP/SSL type.
400 LbSupportTcpsslOnly The specified load balancer supports TCP SSL type listener only. The specified instance supports creating only listeners of the TCP/SSL type.
400 ListenerNotSupportRule You cannot create a rule for the specified listener. You cannot create a rule for the specified listener.
400 ListenerPortConflict The specified ListenerPort is conflict with other listener. The specified listener port is already in use.
400 ResourceNotFound.VServerGroup %s. The specified server group does not exist.
400 IllegalParam.FailoverThreshold The parameter FailoverThreshold is illegal. The specified FailoverThreshold is invalid. Check the parameter constraints and try again after modification.
400 IllegalParam.FailoverStrategy The parameter FailoverStrategy is illegal. The specified FailoverStrategy is invalid. Check the parameter constraints and try again after modification.
400 MasterSlaveServerConflict The servers are conflict for MasterSlaveGroup. The backend servers in the primary/secondary server group conflict.
400 OperationDenied.HealthCheckClosedForMasterSlaveMode The operation is denied because of HealthCheckClosedForMasterSlaveMode. The operation is rejected because health checks must be enabled in primary/secondary mode.
400 IllegalParam.HealthCheck The param of HelathCheck is illegal. The specified HealthCheck is invalid. Check the parameter constraints and try again.
400 Mismatch.SlbSpecTypeAndListenerProtocol The SlbSpecType and ListenerProtocol are mismatched. The instance specification type does not match the listener type.
400 OperationDenied.FullNatModeNotAllowed The operation is not allowed because of FullNatModeNotAllowed. The operation is rejected because FullNat mode is not supported.
400 OperationDenied.OnlyIpv4SlbSupport The operation is not allowed because of OnlyIpv4SlbSupport. The operation is rejected because only IPv4 instances support enabling FULL NAT mode.
400 SpecNotSupportParameter The instance with share spec does not support FullNatEnabled parameter. Shared-resource instances do not support the FullNatEnabled parameter.
400 InvalidParam.TagValue %s.
400 InvalidParam.TagKey %s.
400 SizeLimitExceeded.Tag %s.
400 MissingParam.TagKey The param MissingParam.TagKey is missing.
400 MissingParameter The BackendServerPort or VServerGroupId is required at lease one. The ListenerPort parameter is required.
400 AclListenerOverLimit This acl has reached the limit of binding to listeners. The number of listeners that can be associated with the specified ACL has reached the quota limit.
400 QuotaLimitExceeds.AclAttachedToListener The number of Acl bound listeners has reached the quota limit The number of listeners associated with the ACL has reached the quota limit.
400 QuotaLimitExceeds.TotalAclEntry The number of Acl entries has reached the quota limit. The number of ACL entries has reached the quota limit.
400 QuotaLimitExceeds.AclListenerOverLimit This acl has reached the limit of binding to listeners. The number of listeners that can be associated with the specified ACL has reached the quota limit.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.