All Products
Search

This Product

    Server Load Balancer:High availability of NLB

    Document Center

    Server Load Balancer:High availability of NLB

    Last Updated:Sep 22, 2026

    This design keeps your services stable during single-node, cluster, or availability zone failures, preventing disruptions. By default, NLB instances have cross-zone load balancing enabled and support automatic health checks with DNS integration for automatic failover, achieving a service level agreement (SLA) of up to 99.995%.

    High availability design

    An availability zone is a physical area within a region that has independent power and networking. Availability zones within the same region are interconnected over an internal network and linked by low-latency connections. Fault isolation is available between zones: a failure in one availability zone does not affect the normal operation of other availability zones.

    Intra-zone high availability architecture

    Within an availability zone, multiple clusters serve each VIP. Session synchronization within each cluster prevents service interruptions from single-node failures. When a node in a cluster fails, other nodes seamlessly take over traffic to ensure uninterrupted service.

    image

    Multi-zone active-active architecture

    NLB uses a multi-zone active-active architecture where a single instance is deployed across multiple, independent availability zones. Because a failure in one zone does not affect the entire instance, this design eliminates single points of failure and enhances system scalability and flexibility.

    image

    Availability zone health check mechanism

    NLB actively probes the VIP in each of its availability zones to determine its health. If a probe to a VIP in an availability zone fails, the system automatically removes the corresponding VIP (EIP) from the DNS records. New connection requests are not routed to the unhealthy availability zone. Established connections are not affected by this change.

    Cross-zone load balancing

    By default, cross-zone load balancing is enabled for NLB instances. This allows an NLB instance to distribute traffic evenly to backend servers across all enabled availability zones in the same region. This improves the high availability and disaster recovery capabilities of your system.

    Failover mechanisms

    Automatic failover mechanism

    All zones healthy

    The following steps describe how client requests to an NLB instance are processed when all availability zones are healthy:

    1. A client sends a request to a local DNS server to resolve a custom domain that maps to the DNS name of the NLB instance.

    2. The local DNS server queries Alibaba Cloud DNS for the resolution records of the NLB DNS name.

    3. Alibaba Cloud DNS returns the resolution results to the client. The results include the following information:

      • A records, which are the EIPs available for the NLB instance in multiple availability zones.

      • TTL, which is 10 minutes by default.

    4. The client uses the returned resolution results to send a request to the NLB instance. The NLB instance then distributes the traffic to the backend servers based on the configured scheduling algorithm.

    image

    Zone failure

    The following steps describe how an NLB instance processes requests during an Alibaba Cloud data center or NLB cluster failure. This example assumes that availability zone B fails.

    1. When availability zone B fails, the NLB health check service detects that the private VIP in availability zone B is unreachable. The service then works with Alibaba Cloud DNS to remove the unhealthy A record.

    2. After the DNS cache of the client expires, the client sends a new request to resolve the DNS name of the NLB instance. This time, only the A records of the healthy availability zones are returned. This achieves automatic traffic failover between multiple availability zones.

    In extreme scenarios where the NLB health check service detects that all VIPs are unreachable, it restores all previously removed A records. This ensures that the service can recover as soon as any VIP becomes healthy.
    image

    Manual failover mechanism

    Manually remove an unhealthy zone

    If you detect a service disruption in an availability zone, you can perform a manual DNS failover to immediately remove the unhealthy availability zone from the NLB instance. The change takes effect within 10 seconds and ensures that new requests are not affected.

    image

    Deployment recommendations

    Create a multi-zone NLB instance

    When creating an NLB instance, select two or more availability zones, where supported, to implement a multi-zone active-active architecture.

    Configure cross-zone load balancing

    By default, NLB instances support cross-zone load balancing. We recommend deploying backend servers across multiple availability zones to take full advantage of the cross-zone load balancing feature. This helps you build an end-to-end high availability architecture.

    Configure a CNAME record

    To benefit from enhanced failover capabilities, point your custom domain to the DNS name of the NLB instance by using a CNAME record. This topic uses Alibaba Cloud DNS as an example. The specific steps may vary depending on your DNS provider.

    1. In the NLB console, copy the Domain Name of the target instance.

    2. Log on to the Alibaba Cloud DNS console. In the Actions column of the target domain, click Settings.

    3. On the Settings page, click Add Record, add a CNAME record with the following settings, and then click OK.

      • Record Type: Select CNAME.

      • Hostname: Enter the prefix of your custom domain.

      • TTL: We recommend that you set the value to 1 minute to speed up failover.

      • Record Value: Enter the Domain Name of the NLB instance.

    4. In the Change Resource Record Confirmation dialog box, click OK to save the changes.

    Usage notes

    • When you access an NLB instance by using its DNS name, the following factors affect multi-zone failover:

      • Client-side DNS caching: Local DNS servers and clients must comply with the DNS protocol and promptly invalidate the domain name cache according to the TTL returned by the root DNS server to obtain the latest list of available A records.

      • Connectivity probes: The NLB health check service periodically runs Ping probes on all addresses of an NLB instance. To ensure that the probes are not blocked, you must allow ICMP access from the 100.64.0.0/10 CIDR block in the inbound rules of the security group that is associated with the NLB instance.

        The network links covered by the NLB health check service are limited. If an exception occurs on a public network or a dedicated connection, the probe results may not accurately reflect the link status for each source.

      • Automatic DNS removal: The NLB health check service probes the addresses in each availability zone. When an availability zone fails, NLB automatically removes the DNS record for that zone. New requests are not forwarded to the failed availability zone. The entire failover process typically completes within 100 seconds.

      • Manual DNS removal: If you manually remove the DNS records of an availability zone, the NLB health check service no longer probes the VIP in that availability zone.

    • When you access an NLB instance by using its instance IP address (the corresponding public EIP or private VIP), NLB cannot provide multi-zone automatic failover. Your client must implement periodic health checks and failover for the IP addresses of the NLB instance.