Server Load Balancer:Enable an NLB instance to use an EIP protected by Anti-DDoS Pro/Premium to access the Internet

Overview of EIPs protected by Anti-DDoS Pro/Premium

Alibaba Cloud provides EIPs that are protected by Anti-DDoS Pro/Premium. You can purchase EIPs that are protected by Anti-DDoS Pro/Premium in the EIP console. EIPs protected by Anti-DDoS Pro/Premium can mitigate DDoS attacks at the Tbit/s level. If you use EIPs protected by Anti-DDoS Pro/Premium, you do not need to perform additional configurations or change the IP address that is used by your NLB instance to provide services. For more information, see Best practices for using EIPs protected by Anti-DDoS Pro/Premium.

Limits

The NLB instance and the EIP protected by Anti-DDoS Pro/Premium must be deployed in the same region.

Billing

After an NLB instance is associated with an EIP protected by Anti-DDoS Pro/Premium, Anti-DDoS Pro/Premium charges protection fees.

Billable item	Fee calculation	References
Instance fee	Instance fee = Instance unit price (USD per hour) × Duration of usage (hours)	Instance fee
Load Balancer Capacity Unit (LCU) fee	LCU fee = max{Number of LCUs consumed by new connections, Number of LCUs consumed by concurrent connections, Number of LCUs consumed by data scrubbing, Number of LCUs consumed by rule evaluations} × Duration of usage (hours)	LCU fee
Data transfer fee	You are not charged for data transfer over the Internet if you use internal-facing NLB instances. You are charged for data transfer over the Internet only if you use Internet-facing NLB instances. After an NLB instance is associated with an EIP protected by Anti-DDoS Pro/Premium, EIP charges an instance fee and a data transfer fee for the EIP instance. For more information, see Pay-as-you-go.
Protection fee	After an NLB instance is associated with an EIP protected by Anti-DDoS Pro/Premium, you are charged a protection fee. For more information, see Anti-DDoS Origin 2.0 (Pay-as-you-go). Warning To purchase an EIP protected by Anti-DDoS Pro/Premium, you must activate Anti-DDoS Origin on a pay-as-you-go basis for at least 30 days. You are charged for Anti-DDoS Origin on a monthly basis. You cannot deactivate Anti-DDoS Origin before the first 30 days elapse.

Prerequisites

• A virtual private cloud (VPC) named VPC1 is created. For more information, see Create a VPC.

• Elastic Compute Service (ECS) instances named ECS01 and ECS02 are created in VPC1. An NGINX service is deployed on each ECS instance.

  • For more information about how to create an ECS instance, see Create an instance by using the wizard.

  • For more information about how to deploy an NGINX service, see Deploy an LNMP environment on CentOS 7.

• A server group named RS01 is created for the NLB instance. ECS01 and ECS02 are added to RS01 as backend servers. For more information, see Create and manage a server group.

• If you want to associate the NLB instance with an Internet Shared Bandwidth instance, you must purchase an Internet Shared Bandwidth instance. In this example, an Internet Shared Bandwidth instance that uses BGP (Multi-ISP) lines is purchased. For more information, see Create an Internet Shared Bandwidth.

Procedure

Step 1: Create an EIP protected by Anti-DDoS Pro/Premium

Before you can associate the NLB instance with an EIP protected by Anti-DDoS Pro/Premium, you must purchase an EIP protected by Anti-DDoS Pro/Premium in the EIP console.

1. Log on to the Elastic IP Address console .

2. On the Elastic IP Addresses page, click Create EIP.

3. If this is the first time you purchase an EIP protected by Anti-DDoS Pro/Premium, click Anti-DDoS Origin (Pay-as-you-go) to activate Anti-DDos Origin that uses the pay-as-you-go billing method.

   Warning

   To purchase an EIP protected by Anti-DDoS Pro/Premium, you must first activate Anti-DDoS Origin on a pay-as-you-go basis. Anti-DDoS Origin is billed on a monthly basis. The minimum subscription duration is 30 days. You cannot disable Anti-DDoS Origin before the first 30 days end.

   After you activate pay-as-you-go Anti-DDoS Origin, log on to the Traffic Security console. In the left-side navigation pane, choose Network Security > Anti-DDoS Origin > Billing Center or Network Security > Anti-DDoS Origin > Instance Management to view the details about the Anti-DDoS Origin instance.

4. Configure the parameters on the EIP buy page, click Buy Now, and then complete the payment.

   The following table describes the parameters that are involved in this topic. For more information, see Apply for an EIP.

   Parameter	Description
   Billing Method	Select a billing method for the EIP. In this example, Pay-as-you-go is selected.
   Region	Select the region where you want to create the EIP. The EIP and the NLB instance must be deployed in the same region. In this example, China (Hangzhou) is selected.
   Internet Connection Type	Select a line type for the EIP. In this example, BGP(Multi ISP) is selected.
   Security Protection	Select an edition of Anti-DDoS based on your business requirements. In this example, Anti-DDoS (Enhanced Edition) is selected. Valid values: Default: Anti-DDoS Origin, which can mitigate DDoS attacks at up to 5 Gbit/s. Anti-DDoS (Enhanced Edition): Anti-DDoS Pro/Premium, which can mitigate DDoS attacks at the Tbit/s level.
   Network Traffic	Select a metering method for data transfer. In this example, By traffic is selected.
   Quantity	Select the number of EIPs that you want to purchase.

Step 2: Associate the NLB instance with the EIP protected by Anti-DDoS Pro/Premium

You can associate an NLB instance with an EIP protected by Anti-DDoS Pro/Premium when you purchase the NLB instance or change the network type of the NLB instance. Select one of the following methods based on the scenario.

Purchase an NLB instance

You can associate an NLB instance with an EIP protected by Anti-DDoS Pro/Premium when you purchase the NLB instance.

1. Log on to the NLB console.

2. In the top navigation bar, select the region in which you want to deploy the NLB instance. In this example, China (Hangzhou) is selected.

3. On the Instances page, click Create NLB.

4. On the NLB (Pay-As-You-Go) International Site page, configure the following parameters, click Buy Now, and then complete the payment as prompted.

   The following section describes only the parameters that are involved in this topic. For more information, see Create an NLB instance.

   • Network Type: Select Internet-facing.

   • VPC: Select VPC1.

   • Zone: Select a zone and a vSwitch. The EIP protected by Anti-DDoS Pro/Premium is created in the specified zone.

     Note

     • NLB supports multi-zone deployment. If the selected region supports two or more zones, select at least two zones to ensure high availability. No additional fee is charged by NLB.

     • If no vSwitch is available in a zone, create a vSwitch in the zone in the NLB console as prompted.

     • An NLB instance can be associated with an EIP protected by Anti-DDoS Pro/Premium and an EIP protected by Anti-DDoS Origin at the same time. If you select the default option Automatically assign EIP, a pay-as-you-go EIP that uses the pay-by-data-transfer metering method and BGP (Multi-ISP) lines is created. The EIP is protected by Anti-DDoS Origin.

5. Configure a listener for the NLB instance. In this example, a TCP listener is configured and associated with RS01.

   1. On the Instances page, find the NLB instance that you want to manage and click Create Listener in the Actions column.

   2. In the Configure Listener step, configure the following parameters and click Next.

      The following section describes the parameters that are involved in this topic. Use the default values for other parameters. For more information, see .

      • Listener Protocol: Select a protocol based on your business requirements. In this example, TCP is selected.

      • Listener Port: Select the port on which the NLB instance listens. In this example, port 80 is specified.

   3. In the Server Group step, select RS01 and click Next.

   4. In the Confirm step, confirm the configurations and click Submit.

Use an existing internal-facing NLB instance

If you need to associate an existing NLB instance with an EIP protected by Anti-DDoS Pro/Premium, perform the association by changing the network type of the NLB instance.

1. Log on to the NLB console.

2. In the top navigation bar, select the region where the NLB instance is deployed. In this example, China (Hangzhou) is selected.

3. On the Instances page, find the internal-facing NLB instance that you want to manage and click the instance ID.

4. On the Instance Details tab of the instance details page, go to the Basic Information section, and click Change Network Type next to IPv4 on the right side of the Network Type parameter.

   

5. In the Change Network Type dialog box, set the IP Type parameter to EIP, select the EIP that you created in Step 1: Create an EIP protected by Anti-DDoS Pro/Premium from the Assign EIP drop-down list, and then click OK.

   An NLB instance can be associated with an EIP protected by Anti-DDoS Pro/Premium and an EIP protected by Anti-DDoS Origin at the same time. If you select Purchase EIP, a pay-as-you-go EIP that uses the pay-by-data-transfer metering method and BGP (Multi-ISP) lines is created. The EIP is protected by Anti-DDoS Origin.

Use an existing Internet-facing NLB instance

If an Internet-facing NLB instance has been associated with an EIP protected by Anti-DDoS Origin, and you want to associate the NLB instance with an EIP protected by Anti-DDoS Pro/Premium, perform the following operations:

1. Change the network type of the NLB instance from Internet-facing to internal-facing.

2. When you change the network type, associate the NLB instance with an EIP protected by Anti-DDoS Pro/Premium.

Note

If you select the default option Automatically assign EIP when you create an Internet-facing NLB instance, the NLB instance is associated with a pay-as-you-go EIP that uses the pay-by-data-transfer metering and BGP (Multi-ISP) lines, and the EIP is protected by Anti-DDoS Origin.

Step 1: Change the network type of the NLB instance from Internet-facing to internal-facing

1. On the Instances page, find the Internet-facing NLB instance that you want to manage and click the instance ID.

2. On the Instance Details tab of the instance details page, go to the Basic Information section, and click Change Network Type next to IPv4 on the right side of the Instance Details parameter.

   

3. In the Change Network Type message, confirm the information and click OK.

   It takes about 1 minute for the change to take effect. When the value of the Network Type parameter on the Instance Details tab changes to Private, the network type is changed.

Step 2: Change the network type of the NLB instance from internal-facing to Internet-facing

1. On the Instances page, find the internal-facing NLB instance that you want to manage and click the instance ID.

2. On the Instance Details tab of the instance details page, go to the Basic Information section, and click Change Network Type next to IPv4 on the right side of the Network Type parameter.

   

3. In the Change Network Type dialog box, set the IP Type parameter to EIP, select the EIP created in Step 1: Create an EIP protected by Anti-DDoS Pro-Premium from the Assign EIP drop-down list, and then click OK.

   An NLB instance can be associated with an EIP protected by Anti-DDoS Pro/Premium and an EIP protected by Anti-DDoS Origin at the same time. If you select Purchase EIP, a pay-as-you-go EIP that uses the pay-by-data-transfer metering method and BGP (Multi-ISP) lines is created. The EIP is protected by Anti-DDoS Origin.

(Optional) Step 3: Associate an Internet Shared Bandwidth instance with the NLB instance

If the NLB instance is not associated with an Internet Shared Bandwidth instance, the bandwidth of the NLB instance deployed in two zones can reach 400 Mbit/s by default. If you require a higher bandwidth, you can associate the NLB instance with an Internet Shared Bandwidth instance.

1. On the Instances page, find the NLB instance that you want to manage and use one of the following methods to associate the NLB instance with an Internet Shared Bandwidth instance:

   • Click the icon in the Actions column and select Associate with EIP Bandwidth Plan. Alternatively, click Associate in the EIP Bandwidth Plan column.

   • Click the ID of the NLB instance that you want to manage. On the Instance Details tab of the instance details page, click Associate with EIP Bandwidth Plan in the Billing Information section.

2. In the Associate with EIP Bandwidth Plan dialog box, select an Internet Shared Bandwidth instance from the drop-down list and click OK.

Step 4: Create a DNS record

NLB allows you to map your frequently visited domain names to the publicly accessible domain name of the NLB instance by using CNAME records. This facilitates access to network resources.

1. In the left-side navigation pane, choose NLB > Instances.

2. In the top navigation bar, select the region where the NLB instance is deployed. In this example, China (Hangzhou) is selected.

3. On the Instances page, copy the domain name of the NLB instance that you want to manage.

4. Perform the following steps to create a CNAME record:

   1. Log on to the Alibaba Cloud DNS console.

   2. On the Domain Name Resolution page, click the Authoritative Domain Names tab. On the Authoritative Domain Names tab, click Add Domain Name.

   3. In the Add Domain Name dialog box, enter your domain name and click OK.

      Important

      Before you create the CNAME record, you must use a TXT record to verify the ownership of the domain name.

   4. Find the domain name that you want to manage and click Configure in the Actions column.

   5. On the DNS Settings tab of the domain name details page, click Add DNS Record.

   6. In the Add DNS Record panel, configure the parameters and click OK. The following table describes the parameters.

      Parameter	Description
      Record Type	Select CNAME from the drop-down list.
      Hostname	Enter the prefix of the domain name. In this example, @ is entered.
      DNS Request Source	Select Default.
      Record Value	Enter the CNAME, which is the domain name of the NLB instance.
      TTL	Specify the time-to-live (TTL) value for the CNAME record to be cached on the DNS server. In this example, the default value is used.

      Note

      • Newly created CNAME records immediately take effect. The amount of time that is required for a modified CNAME record to take effect is determined by the TTL value, which is 10 minutes by default.

      • If the CNAME record that you want to create conflicts with an existing record, specify another domain name.

Step 5: Test network connectivity

After you create a DNS record for the NLB instance, you can visit the domain name configured in Step 4: Create a DNS record in your browser to test whether the NLB instance can use the EIP protected by Anti-DDoS Pro/Premium to access the Internet.