Intelligent load balancing is a high-availability and acceleration feature for the Web Application Firewall (WAF) proxy mode. When enabled, your WAF instance is assigned multiple cross-region protection nodes, which use intelligent scheduling to ensure business continuity and low-latency access.
What is intelligent load balancing
Intelligent load balancing assigns at least three protection nodes in different regions to your WAF instance. It uses multiple monitoring nodes to perform Ping-based network reachability probes, enabling automatic, multi-region disaster recovery. Combined with intelligent DNS resolution and the least time back-to-origin algorithm, this feature routes traffic along the shortest, lowest-latency path from the protection node to your origin server.
When you add a domain to WAF in CNAME Record, the system assigns an independent VIP to receive business requests. This VIP is not shared with other tenants. Alibaba Cloud WAF provides high-availability protection. The VIP is not bound to a specific physical device but is part of the Alibaba Cloud WAF cluster resource pool. Under the same WAF instance:
If you have not enabled a dedicated IP address or intelligent load balancing, all domains share a single VIP.
After you configure intelligent load balancing, all domains share multiple VIPs.
After you enable intelligent load balancing for a domain:
WAF instances in the the Chinese mainland are assigned one protection node in each of the following regions for disaster recovery: China (Beijing), China (Hangzhou), and China (Shenzhen).
WAF instances outside the Chinese mainland are assigned multiple protection nodes in major geographical areas, such as North America, Europe, and Southeast Asia, for disaster recovery.
Capability | Disabled | Enabled |
Disaster recovery |
|
|
Access acceleration | Not available | Shortest path through proximity-based access and back-to-origin routing |
The VIPs for WAF are not static. You must update your domain's DNS settings by following the steps for proxy mode. For more information, see Can I point my DNS record to a WAF VIP?
If a WAF VIP is subject to blackhole filtering due to a DDoS attack, WAF does not automatically remove the VIP from the filtered state.
Benefits
Use case | Deployment characteristics | Benefits |
Geo-redundant active-active | Origin servers are deployed in multiple regions. |
|
Single-region active-active and active-standby | Origin servers are deployed in the same region. |
|
Enable intelligent load balancing
You can enable intelligent load balancing for a domain only when it is added to WAF in CNAME Record. Follow these steps:
On the Onboarding page of the Web Application Firewall 3.0 console, click the tab, and then click Add to open the Add Domain Name wizard.
In the Configure Listener step, click More Settings, set Protection Resource to Shared Cluster-based Intelligent Load Balancing, and then click Next.
In the Configure Forwarding Rule step, select Least time for the Load Balancing Algorithm.
For more configuration details, see Improve service availability and performance.
After you complete these steps, WAF automatically uses intelligent DNS resolution and the least time back-to-origin algorithm to process requests for the domain.
Billing
Intelligent load balancing is a paid feature that is billed on a per-WAF-instance basis, regardless of the number of domains that use it. If you enable this feature for any domain, your entire instance is billed. For more information about billing, see Pay-as-you-go and Subscription.
FAQ
Can intelligent load balancing accelerate cross-region access for Chinese mainland users?
No.
WAF instances outside the Chinese mainland: Their protection nodes are deployed outside the Chinese mainland, regardless of whether intelligent load balancing is enabled. These instances cannot accelerate access for clients in the Chinese mainland.
WAF instances in the Chinese mainland: Their protection nodes are deployed in the Chinese mainland. These instances cannot accelerate access for clients outside the Chinese mainland.
For these scenarios, we recommend using acceleration services such as CDN.
What is the difference between a WAF VIP and the WAF back-to-origin IP range?
WAF VIP
The VIP is the WAF ingress IP address that clients use to access your website.
All client requests arrive at this VIP first, where WAF inspects and filters them.
WAF back-to-origin IP range
This is the IP address range WAF uses to forward requests to your origin server after security inspection.
From the origin server's perspective, all requests from WAF originate from this IP range.
Your origin server's security policies, such as firewalls or security groups, must allow traffic from the WAF back-to-origin IP range. Otherwise, requests from WAF to your origin server will fail.
How do I view WAF VIP addresses?
After you enable intelligent load balancing, you can go to the Asset Center page. Click the WAF tab to view the VIP addresses assigned to your WAF instance. You can also run the ping or nslookup command on a client to query a WAF-protected domain.
ping example.com # Replace with a domain protected by WAF.Can I point DNS records to a WAF VIP?
No. When you add a domain to WAF using a CNAME record, point your DNS record to the CNAME address provided by WAF, not to the WAF VIP address. The VIP address may change (for example, when you enable or disable an exclusive IP or intelligent load balancing, or in extreme cases of WAF failure). Pointing your domain directly to the VIP address can cause service interruptions. Using a CNAME record ensures that the backend IP address switches automatically to guarantee business continuity.
How do I configure the default SSL/TLS policy for VIP compliance?
To meet compliance requirements, you can customize the SSL certificates and TLS policies for your WAF VIPs. Before you run a compliance scan on a WAF VIP, follow these steps to upload a compliant HTTPS certificate and enable or disable specific TLS protocol versions and cipher suites.
-
Above the list of added domains, click Default SSL/TLS Settings.
-
In the Default SSL/TLS Settings dialog box, configure the following settings and click OK.
Parameter
Description
HTTPS Upload Type
Upload an SSL certificate. The procedure is the same as for uploading a domain certificate. For details, see Upload a certificate.
TLS Version
Valid values:
-
TLS 1.0 and Later (Best Compatibility and Low Security)
-
TLS 1.1 and Later (High Compatibility and High Security): Prevents legacy clients that use the TLS 1.0 protocol from accessing your website.
-
TLS 1.2 and Later (High Compatibility and Best Security): Meets the latest security compliance requirements but prevents legacy clients that use the TLS 1.0 and 1.1 protocols from accessing your website.
-
Support TLS 1.3: Select this option if your website supports the TLS 1.3 protocol.
HTTPS Cipher Suite
Select the cipher suite that you want to enable. Valid values:
-
All Cipher Suites (High Compatibility and Low Security)
-
Custom Cipher Suite (Select It based on protocol version. Proceed with caution.): Select this option if your website supports only specific cipher suites. Proceed with caution to avoid disrupting your services. For more information about the supported custom cipher suites, see WAF-supported cipher suites.
-