Server Load Balancer:Features

Feature Category

Feature Set

Feature Set Description

References

Instances and network access

Internet access

Associate an EIP to enable IPv4 Internet access, and enable IPv6 internet bandwidth to enable IPv6 Internet access. You can also switch the instance network type between internal-facing and Internet-facing to flexibly adapt to diverse network deployment and business switching needs.

Instance lifecycle management

Supports the full instance lifecycle, including instance creation, specification changes, cloning, modification, and release. You can also enable deletion protection and configuration modification protection for an instance to prevent it from being accidentally deleted or modified.

IP version

You can create an IPv4 or a dual-stack (IPv4/IPv6) instance. An IPv4 instance provides an IPv4 private virtual IP address (VIP) in each zone. A dual-stack instance provides both an IPv4 private VIP and an IPv6 VIP in each zone. Requests from IPv4 and IPv6 clients can be forwarded to IPv4 or IPv6 backend servers, enabling unified client-side access across IP versions and flexible backend deployments.

Resource Reservation

Use resource reservation to configure an LCU capacity baseline for an instance. When traffic spikes, the reserved capacity is used immediately, with no need to wait for automatic scaling.

Listeners

Listener protocol

You can create HTTP and HTTPS listeners. HTTP/3, HTTP/2.0, and WebSocket/WSS are supported.

Forwarding rules

Match requests by conditions such as domain, path, or header, and perform actions such as forwarding, redirection, rewriting, rate limiting, cross-origin (CORS), and traffic mirroring. AScript programmable scripts are also supported.

Advanced features

Advanced features include connection idle and request timeouts, data compression, attaching additional HTTP headers, and retrieving the real source IP address of clients.

Server group

Server Group Type

Backend servers of the following types can be added to a server group: Elastic Compute Service (ECS) instances, elastic network interfaces (ENIs), elastic container instances (ECIs), IP addresses, and Function Compute (FC) functions. ECS and ECI backend servers can work with Auto Scaling (ESS) to implement automatic scaling. IP-type backend servers can be used with private network connectivity services such as Cloud Enterprise Network (CEN) and PrivateLink (PVL) to access compute resources in the cloud across VPCs and regions, or private resources in on-premises data centers.

Scheduling Algorithms

Requests are forwarded to backend servers based on the scheduling algorithm configured for a server group. Weighted round robin, weighted least connections, and consistent hashing are supported, which meet the traffic distribution requirements of different workloads.

Health Check

Health checks over TCP, HTTP, HTTPS, and gRPC are supported. Parameters such as the check port, response timeout, check interval, and thresholds can be customized. HTTP, HTTPS, and gRPC health checks support custom parameters such as the check path, domain name, and normal status codes.

Advanced features

Advanced features include session persistence, backend keep-alive, slow start, and connection draining.

Security protection

Security Group

Basic and advanced security groups can be associated with load balancer instances. Access control rules based on protocols, ports, and IP addresses can be customized to control inbound and outbound traffic of instances in a security group, so that access control and network protection can be implemented for instances.

TLS offloading

HTTPS listeners support TLS offloading, which reduces the encryption and decryption burden on backend servers. Custom TLS security policies and additional certificates are also supported to meet the requirements of multi-domain access and complex security and compliance scenarios.

• Manage certificates
• TLS security policy

Web application protection

Web Application Firewall (WAF) protection can be enabled for ALB instances to defend against malicious web attacks. WAF protection uses the WAF 3.0 service-based integration architecture. Traffic is extracted and inspected through an embedded software development kit (SDK), without WAF acting as a separate gateway in the forwarding path. This avoids extra latency and single points of failure (SPOFs), ensuring low latency and high availability for your workloads.

End-to-end HTTPS

Encrypted communication is supported across the entire request path, both from clients to ALB instances and from ALB instances to backend servers. End-to-end HTTPS meets the strict full-path data encryption requirements of industries such as finance and government, safeguarding sensitive workloads.

Mutual Authentication

Configure a CA certificate on an HTTPS listener to implement mutual authentication (mTLS). A secure channel is established only after the client and the server verify each other's certificates.

Anti-DDoS

Basic Anti-DDoS protection is provided by default, with up to 5 Gbps of mitigation capacity. For higher protection requirements, you can associate an EIP with Anti-DDoS (Enhanced) to obtain professional Tbps-level mitigation.

High availability

Multi-zone deployment

ALB uses an active-active multi-zone architecture. A single instance can be deployed across multiple zones. Traffic distribution across zones is enabled by default, and traffic can be evenly distributed to backend servers in all active zones.

High system availability

Within a zone, each VIP is served by a cluster. When a node fails, the cluster automatically distributes new connections to the remaining healthy nodes. Services on the failed node are restored through client reconnections.

Automatic zone-level disaster recovery

Automatic disaster recovery is provided. The health status of virtual IP addresses (VIPs) in each zone is actively probed. When a zone fails, its DNS records are automatically removed through integration with Alibaba Cloud DNS.

O&M and monitoring

Monitoring and alerting

CloudMonitor provides metrics by dimensions such as instance, listener, and zone (single VIP). You can configure alert rules, and monitoring data can be integrated into Alibaba Cloud Prometheus Service.

Access logs

Simple Log Service (SLS) is integrated to provide Layer 7 access logging. Information such as the headers, status codes, and latency distribution of successful HTTP/HTTPS requests is recorded. This is applicable to request auditing, troubleshooting, and performance analysis, and helps locate issues such as URLs that return errors and abnormal API latency.

ActionTrail

ActionTrail is integrated to record operational events made through API operations or the console, which facilitates compliance auditing and issue tracing.

Instance diagnosis

Instances can be diagnosed across multiple dimensions, including health checks, idle instance detection, capacity overrun, certificates, security policies, billing, and listeners. The cause of each exception and recommended actions are provided to help you quickly locate and resolve issues.

Tracing analysis

Trace headers are automatically injected when requests are forwarded, capturing the request origin, the nodes it passes through, and the response time to enable end-to-end analysis.

Enterprise-level capabilities

Quota management

You can view quota usage, configure quota alerts, and submit quota increase requests in the console. This prevents business scaling from being affected by quota limits.

Automated orchestration

Resources can be created, modified, and orchestrated automatically with Terraform. This supports infrastructure as code (IaC) and integrates with DevOps automated O&M workflows.

-

Permissions and resource isolation

Resource ownership and operation permissions can be defined by using RAM policies, resource groups, and tags. This meets the resource isolation requirements of multi-team and multi-environment scenarios.

• Reference on system permission policies for ALB
• Use resource groups for fine-grained resource control

Billing

Pay-as-you-go

Fees are settled based on the actual usage of each billable item. You use resources first and pay afterward. This billing method applies to scenarios in which workload usage varies frequently.

Resource plan

Purchase a resource plan in advance. Usage is deducted from the resource plan first during billing. You purchase first and use afterward. This billing method applies to scenarios in which workload usage is relatively stable.

Feature Category

Feature Set

Feature Set Description

References

Instances and network access

Internet access

Associate an EIP to enable IPv4 Internet access, and enable IPv6 internet bandwidth to enable IPv6 Internet access. You can also switch the instance network type between internal-facing and Internet-facing to flexibly adapt to diverse network deployment and business switching needs.

Instance lifecycle management

Supports the full instance lifecycle, including instance creation, specification changes, modification, and release. You can also enable deletion protection and configuration modification protection for an instance to prevent it from being accidentally deleted or modified.

IP version

You can create an IPv4 or a dual-stack (IPv4/IPv6) instance. An IPv4 instance provides an IPv4 private virtual IP address (VIP) in each zone. A dual-stack instance provides both an IPv4 private VIP and an IPv6 VIP in each zone. Requests from IPv4 and IPv6 clients can be forwarded to IPv4 or IPv6 backend servers, enabling unified client-side access across IP versions and flexible backend deployments.

• NLB instances
• Change the network type of an NLB instance

Resource Reservation

Use resource reservation to configure an LCU capacity baseline for an instance. When traffic spikes, the reserved capacity is used immediately, with no need to wait for automatic scaling.

Listeners

Listener protocol

You can create TCP, UDP, and TCPSSL listeners.

• Add a TCP listener
• Add a UDP listener
• Add a TCPSSL listener

Advanced features

Advanced features include any-port listening, idle connection timeout, new connection rate limiting, and Proxy Protocol.

• Add a TCP listener
• Add a UDP listener
• Add a TCPSSL listener

Server group

Server Group Type

Backend servers of the following types can be added to a server group: Elastic Compute Service (ECS) instances, elastic network interfaces (ENIs), elastic container instances (ECIs), and IP addresses. ECS and ECI backend servers can work with Auto Scaling (ESS) to implement automatic scaling. IP-type backend servers can be used with private network connectivity services such as Cloud Enterprise Network (CEN) and PrivateLink (PVL) to access compute resources in the cloud across VPCs and regions, or private resources in on-premises data centers.

Scheduling Algorithms

Requests are forwarded to backend servers based on the scheduling algorithm configured for a server group. Algorithms include round robin, weighted round robin, weighted least connections, source IP hash, four-tuple hash, and QUIC ID hash, which meet the traffic distribution requirements of different workloads.

Health checks

TCP, UDP, and HTTP health checks are supported. Parameters such as the check port, response timeout, check interval, and thresholds can be customized. HTTP health checks support custom parameters such as the check path, domain name, and normal status codes. UDP health checks support custom request and response strings.

Advanced features

Advanced features include connection draining, client IP preservation, any-port forwarding, and IP version affinity.

Security Protection

Security group

Basic and advanced security groups can be associated with load balancer instances. Custom access control rules based on protocols, ports, and IP addresses control inbound and outbound traffic for instances in the security group, providing access control and network protection for your instances.

TLS offloading

TLS offloading is performed on the NLB side. SM certificates, TLS 1.3, custom TLS security policies, and associating multiple certificates with a single listener with automatic matching are supported.

• Manage certificates
• TLS security policy
• Use NLB to implement TCPSSL offloading (one-way authentication)

Mutual Authentication

After you configure a server certificate and a CA certificate for a TCPSSL listener, the client and the server verify each other's certificates. A secure communication channel is established only after the verification succeeds.

Anti-DDoS

Basic Anti-DDoS protection is provided by default, with up to 5 Gbps of mitigation capacity. For higher protection requirements, you can associate an EIP with Anti-DDoS (Enhanced) to obtain professional Tbps-level mitigation.

High availability

Multi-zone deployment

NLB uses an active-active multi-zone architecture. A single instance can be deployed across multiple zones. Traffic distribution across zones is enabled by default, and traffic can be evenly distributed to backend servers in all active zones.

High system availability

Within a zone, each VIP is served by multiple clusters. If a node in a cluster fails, the other nodes seamlessly take over the traffic, ensuring service continuity.

Automatic zone-level disaster recovery

Automatic disaster recovery is provided. The health status of virtual IP addresses (VIPs) in each zone is actively probed. When a zone fails, its DNS records are automatically removed through integration with Alibaba Cloud DNS.

O&M and monitoring

Monitoring and alerting

CloudMonitor provides metrics by dimensions such as instance, listener, and zone (single VIP). You can configure alert rules, and second-level monitoring data is provided for Layer 4 listeners. Monitoring data can also be integrated into Alibaba Cloud Prometheus Service.

• NLB Monitoring
• Integrate NLB with Managed Service for Prometheus
• Configure alert rules for NLB metrics

ActionTrail

ActionTrail is integrated to record operational events made through API operations or the console, which facilitates compliance auditing and issue tracing.

Instance diagnosis

Instances can be diagnosed across multiple dimensions, including health checks, idle instance detection, security policies, billing, and listeners. The cause of each exception and recommended actions are provided to help you quickly locate and resolve issues.

Enterprise-level capabilities

Quota management

You can view quota usage, configure quota alerts, and self-service request quota increases, preventing quota limits from hindering business scaling.

Permissions and resource isolation

Use RAM permission policies, resource groups, and tags to define resource ownership and operation permissions, meeting resource isolation requirements across multiple teams and environments.

• Use resource groups for fine-grained access control
• NLB system permission policy reference

Automated orchestration

Use Terraform to automatically create, modify, and orchestrate resources. Infrastructure as Code is supported, fitting DevOps automated operations workflows

-

Billing

Pay-as-you-go

Fees are settled based on the actual usage of each billable item. Use first, pay later-ideal for scenarios where usage frequently changes

Resource plan

Purchase resource plans in advance. During billing settlement, usage is first deducted from the resource plan. Buy first, deduct later-ideal for scenarios with relatively stable usage

Feature categories

Feature Set

Feature Set Description

References

Instances and network access

Instance lifecycle management

Provides full lifecycle operations for instances, including creation, configuration changes, modification, and release. You can also enable deletion protection and configuration modification protection for instances to prevent them from being deleted or modified due to accidental operations.

Internet access

An Internet-facing instance is assigned a static public IPv4 or IPv6 address upon creation. You can also associate an Elastic IP Address (EIP) with an internal-facing instance to enable Internet access.

IP version

When you create an Internet-facing CLB instance, you can select IPv4 or IPv6 as the IP version. Internal-facing CLB instances support only IPv4. An Internet-facing instance is allocated a static public IP address, while an internal-facing instance is allocated a private IP address within a VPC.

Listener

Listener protocol

Supports the TCP, UDP, HTTP, and HTTPS listener protocols.

• Add a TCP listener
• Add a UDP listener
• Add an HTTP listener
• Add an HTTPS listener

Server group

Supports ECS instances, elastic network interfaces (ENIs), and elastic container instances (ECIs) as backend servers. ECS and ECI backends can work with Auto Scaling (ESS) to automatically add or remove instances.

Scheduling Algorithms

Forwards client requests to backend servers based on the scheduling algorithm configured for each server group. Supported scheduling algorithms include weighted round robin, round robin, and consistent hashing, which meet the traffic distribution requirements of different workloads.

Health Check

Supports the TCP, UDP, and HTTP protocols. You can customize parameters such as the check port, response timeout period, check interval, and thresholds. HTTP health checks allow you to configure parameters such as the check path, domain name, and expected HTTP status codes. UDP health checks allow you to configure request and response parameters.

Forwarding rules

You can configure forwarding rules for HTTP and HTTPS listeners based on domain names and URL paths to distribute requests from different workloads to different server groups.

Advanced features

Supports common advanced features such as session persistence and retrieval of client real IP addresses. For HTTP and HTTPS listeners, it supports idle connection timeout and request timeout configurations, additional HTTP headers, and data compression.

• Add a TCP listener
• Add a UDP listener
• Add an HTTP listener
• Add an HTTPS listener

Security protection

Access Control

You can attach IP access control lists (ACLs) to listeners as allowlists or blocklists to filter requests based on client source IP addresses.

TLS offloading

HTTPS listeners support TLS offloading, which reduces the encryption and decryption overhead on backend servers. Supports predefined TLS security policies and additional certificates to flexibly meet the requirements of multi-domain access and security compliance.

• CLB certificates management
• TLS security policy

Anti-DDoS

Includes basic DDoS protection that defends against attacks of up to 5 Gbps.

Mutual Authentication

After you configure a server certificate and a CA certificate for an HTTPS listener, the client and the server verify each other's certificates, and a secure communication channel is established only after the verification succeeds.

High availability

High system availability

Adopts a cluster deployment with session synchronization to eliminate single points of failure, increase redundancy, and ensure service stability.

-

Primary and secondary zone deployment

In regions that support multiple zones, CLB is deployed across a primary zone and a secondary zone by default for intra-region disaster recovery. If the primary zone fails, service automatically fails over to the secondary zone, and automatically fails back when the primary zone recovers, ensuring service continuity.

O&M and monitoring

Monitoring and alerting

CloudMonitor provides metrics at both the instance and listener levels, supports alert rules, and delivers second-level monitoring data for Layer 4 listeners. Monitoring data can also be integrated into Managed Service for Prometheus.

• CLB monitoring
• Integrate CLB with Managed Service for Prometheus

Access logs

CLB provides the access log feature for Layer-7 (HTTP/HTTPS) listeners, recording detailed information about every request that reaches a CLB instance, including the request time, client IP address, latency, request path, and server response. This helps you analyze user behavior, gain insights into geographic distribution, and quickly locate faults, supporting operations decisions and business optimization.

ActionTrail

Integration with ActionTrail records operational events performed through API operations or the console, making it easier to conduct compliance audits and trace issues.

Instance diagnosis

Instance diagnostics checks instances across multiple dimensions, including health checks, idle instances, capacity, certificates, costs, and listeners. It identifies the causes of detected issues and provides recommendations to help you quickly locate and resolve problems.

Enterprise-level capabilities

Quota management

You can view quota usage, configure quota alerts, and request quota increases on your own, preventing quota limits from holding back business scaling.

Permissions and resource isolation

Use RAM permission policies, resource groups, and tags to define resource ownership and operation permissions, meeting the requirements for resource isolation across multiple teams and environments.

• Use resource groups for fine-grained access control
• Use a RAM role to access load balancing resources across accounts

Automated orchestration

Terraform enables automated creation, modification, and orchestration of resources, supporting infrastructure as code (IaC) to fit automated DevOps O&M workflows.

-

Billing

Pay-as-you-go

You are charged based on the actual usage of each billable item. With this pay-as-you-go model, you use resources first and pay for them later, which suits scenarios where usage fluctuates frequently.