AWS ELB migration

Migrate AWS Elastic Load Balancing (ELB) resources — CLB, ALB, and NLB — to Alibaba Cloud SLB using Cloud Migration Hub (CMH).

Prerequisites

To migrate an ALB, associate the AliyunServiceRoleForAlb service-linked role with your Alibaba Cloud account.
To migrate an NLB, associate the AliyunServiceRoleForNlb service-linked role with your Alibaba Cloud account.
CMH supports only CLB, ALB, and NLB migration.
CMH only migrates listeners that forward to ECS instances. Migrate EC2 instances to ECS in the CMH migration plan first. Configure other listener types manually in the SLB console.

Important

If you do not migrate EC2 instances through CMH, CMH cannot associate destination ECS instances during ELB migration. The related listeners are skipped. Configure them manually in the SLB console.

Resource discovery

Complete ELB resource discovery on the Resource Discovery page before you start the migration.

1. Go to Resource Discovery > Other Cloud Discovery. Set Source Cloud Vendor to AWS and include ELB in Resource Type.

2. After the discovery task completes, click Details to view the results.

ELB types:

Type	Meaning
clb	Classic Load Balancer
application	Application Load Balancer
network	Network Load Balancer

3. Click a resource to view its details.

Information	Type	Description
Basic information	CLB ALB NLB	Load balancer basic information, such as name and network type.
Listener List	CLB ALB NLB	Source listener details.
Health Check List	CLB	Source health check configuration.
Target Instance List	CLB	Source target instance details.
Target Group List	ALB NLB	Source target group details.

Cross-cloud migration

Migrate AWS ELB to Alibaba Cloud SLB from the Migration Plan page.

Note

Prerequisite: Migrate EC2 instances to ECS before migrating ELB. Otherwise, CMH creates only the SLB instance without listeners or server group configuration.

EC2 and ELB migrations can be in different plans, but EC2 migration must complete first.

1. Go to Scenario-based Migration > Migration Plan and create a new migration plan.

2. Confirm that destination ECS instances are created before mapping source listeners.

3. Configure load balancer parameters. Expand the mapped listeners and target groups, then click Modify Parameters to configure instance, listener, and target group settings. Select the resources to create and click Batch Create Resources.

CLB parameter descriptions

Instance

Parameter	Description
Zone	CLB uses multi-zone mode by default. Select the primary zone; the backend automatically assigns a secondary zone.
Network Type	Internal Internet
Name	Name of the CLB instance.
VPC ID	Required only for the internal network type. VPC ID
vSwitch	Required only for the internal network type. ID of the vSwitch in the primary zone.
Metering method for Internet-facing instance	Required only for the Internet network type. Important Pay-by-traffic metering requires the pay-as-you-go billing method. Pay-by-traffic Pay-by-bandwidth
Billing method	Pay-as-you-go Pay-by-specification
IP Version	IPv4 IPv6 (Only Internet-facing instances support IPv6)
Specify private IP address for the instance	Leave this empty to use a randomly assigned IP address.

Listener

Parameter	Description
Listener Protocol	Mapped from the source. Read-only.
Listener Port
Backend Port
Listener bandwidth peak	Peak listener bandwidth in Mbps. Valid values: -1: No bandwidth limit. 1 to 5120: Peak listener bandwidth. Total bandwidth of all listeners cannot exceed the instance bandwidth.
Scheduling Algorithm	Weighted Round-robin (wrr): Backend servers with higher weights receive more requests. Round-robin (rr): Requests are distributed to backend servers in sequence.
Access Control Type	Whitelist: Only requests from IP addresses or CIDR blocks in the access control policy group are forwarded. Setting a whitelist poses business risks: only whitelisted IP addresses can access the SLB listener. If you enable a whitelist but do not add any IP addresses to the access control policy group, the SLB listener forwards all requests. Blacklist: Requests from IP addresses or CIDR blocks in the access control policy group are blocked. If you enable a blacklist but do not add any IP addresses to the access control policy group, the SLB listener forwards all requests. Important Leave empty to auto-map the access control policy from the source. Otherwise, the mapping is overwritten.
Access Control Policy Group ID	Important Leave empty to auto-map the access control policy from the source. Otherwise, the mapping is overwritten.
Enable Health Check
Health Check Type
Health Check Port
Health Check Timeout	Maximum wait time for a health check response. The check fails if the backend server does not respond within this period.
Health Check Interval
Consecutive Successes	Consecutive successful checks required to change a backend server's status from fail to success.
Consecutive Failures	Consecutive failed checks required to change a backend server's status from success to fail.
Health Check Status	HTTP status codes that indicate a successful health check.
Health Check Domain Name	Important Leave empty to use the target server's IP address as the health check domain name.
Health Check URI
HTTP Health Check Method
Custom Listener Name
Enable getting the client IP address through the X-Forwarded-For header
Enable Session Persistence
Cookie Handling Method	insert: Insert a cookie. SLB inserts a cookie into the first response. Subsequent requests with this cookie are forwarded to the same backend server. server: Rewrite a cookie. When SLB detects a custom cookie, it rewrites the original cookie. Subsequent requests with the new cookie are forwarded to the same backend server.
Cookie Timeout
Cookie configured on the server
Get the virtual IP address (VIP) of the client request through the SLB-IP header
Get the SLB instance ID through the SLB-ID header
Get the listener protocol of the SLB instance through the X-Forwarded-Proto header
Enable Gzip compression for specific file types
Enable HTTP to HTTPS forwarding
Connection Idle Timeout	SLB closes the connection after this idle period. A new connection is established on the next request.
Request Timeout	SLB returns an `HTTP 504` error if the backend server does not respond within this period.
Get the listener port of the SLB instance through the XForwardedFor_SLBPORT header
Get the client port for accessing the SLB instance through the XForwardedFor_ClientSrcPort header
Server Certificate ID
CA Certificate ID
Enable HTTP/2
TLS Protocol	tls_cipher_policy_1_0: Supported TLS versions: TLSv1.0, TLSv1.1, and TLSv1.2. Supported encryption algorithm suites: ECDHE-RSA-AES128-GCM-SHA256, ECDHE-RSA-AES256-GCM-SHA384, ECDHE-RSA-AES128-SHA256, ECDHE-RSA-AES256-SHA384, AES128-GCM-SHA256, AES256-GCM-SHA384, AES128-SHA256, AES256-SHA256, ECDHE-RSA-AES128-SHA, ECDHE-RSA-AES256-SHA, AES128-SHA, AES256-SHA, and DES-CBC3-SHA. tls_cipher_policy_1_1: Supported TLS versions: TLSv1.1 and TLSv1.2. Supported encryption algorithm suites: ECDHE-RSA-AES128-GCM-SHA256, ECDHE-RSA-AES256-GCM-SHA384, ECDHE-RSA-AES128-SHA256, ECDHE-RSA-AES256-SHA384, AES128-GCM-SHA256, AES256-GCM-SHA384, AES128-SHA256, AES256-SHA256, ECDHE-RSA-AES128-SHA, ECDHE-RSA-AES256-SHA, AES128-SHA, AES256-SHA, and DES-CBC3-SHA. tls_cipher_policy_1_2 Supported TLS version: TLSv1.2. Supported encryption algorithm suites: ECDHE-RSA-AES128-GCM-SHA256, ECDHE-RSA-AES256-GCM-SHA384, ECDHE-RSA-AES128-SHA256, ECDHE-RSA-AES256-SHA384, AES128-GCM-SHA256, AES256-GCM-SHA384, AES128-SHA256, AES256-SHA256, ECDHE-RSA-AES128-SHA, ECDHE-RSA-AES256-SHA, AES128-SHA, AES256-SHA, and DES-CBC3-SHA. tls_cipher_policy_1_2_strict Supported TLS version: TLSv1.2. Supported encryption algorithm suites: ECDHE-RSA-AES128-GCM-SHA256, ECDHE-RSA-AES256-GCM-SHA384, ECDHE-RSA-AES128-SHA256, ECDHE-RSA-AES256-SHA384, ECDHE-RSA-AES128-SHA, and ECDHE-RSA-AES256-SHA. tls_cipher_policy_1_2_strict_with_1_3 Supported TLS versions: TLSv1.2 and TLSv1.3. Supported encryption algorithm suites: TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_AES_128_CCM_SHA256, TLS_AES_128_CCM_8_SHA256, ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES256-GCM-SHA384, ECDHE-ECDSA-AES128-SHA256, ECDHE-ECDSA-AES256-SHA384, ECDHE-RSA-AES128-GCM-SHA256, ECDHE-RSA-AES256-GCM-SHA384, ECDHE-RSA-AES128-SHA256, ECDHE-RSA-AES256-SHA384, ECDHE-ECDSA-AES128-SHA, ECDHE-ECDSA-AES256-SHA, ECDHE-RSA-AES128-SHA, and ECDHE-RSA-AES256-SHA.
Request string for UDP listener health check
Response string for UDP listener health check

Application Load Balancer parameter descriptions

Instance

Parameter	Description
Name
VPC ID
Zone	Select at least two zones and their vSwitches.
Address Mode	Fixed IP mode (default): A fixed IP address is assigned in each zone. Dynamic IP mode: A dynamic IP address is assigned in each zone.
Instance Edition	ALB edition. Each edition has different feature limits and billing policies.
IP Version	IPv4 Dual-stack Important When you select Dual-stack, the VPC must support IPv6.
Network Type	Internet Internal
Billing Method	Pay-as-you-go
Enable Deletion Protection

Listener

Parameter	Description
Protocol
Listener Port
Listener Name
Access Control Type	Whitelist: Only requests from IP addresses or CIDR blocks in the access control policy group are forwarded. Setting a whitelist poses business risks: only whitelisted IP addresses can access the SLB listener. If you enable a whitelist but do not add any IP addresses to the access control policy group, the SLB listener forwards all requests. Blacklist: Requests from IP addresses or CIDR blocks in the access control policy group are blocked. If you enable a blacklist but do not add any IP addresses to the access control policy group, the SLB listener forwards all requests. Important Leave empty to auto-map the access control policy from the source. Otherwise, the mapping is overwritten.
Access Control Policy Group ID	Important Leave empty to auto-map the access control policy from the source. Otherwise, the mapping is overwritten.
Enable Gzip compression for specific file types
Connection Idle Timeout	SLB closes the connection after this idle period. A new connection is established on the next request.
Request Timeout	SLB returns an `HTTP 504` error if the backend server does not respond within this period.
Server Certificate ID
CA Certificate ID
Enable HTTP/2
Enable Mutual Authentication

Target Group

Parameter	Description
Name	Listener protocol type, mapped from the source. Read-only.
Listener Protocol
Enable Connection Draining
Connection Draining Timeout
Scheduling Algorithm	Wrr (default): Weighted round-robin. Backend servers with higher weights receive more requests. Wlc: Weighted least connections. This algorithm considers both the weight and the number of connections of each backend server. When weights are the same, the backend server with the fewest connections receives more requests. Sch: Consistent hashing. Requests with the same hash factor are scheduled to the same backend server. If you do not configure the UchConfig parameter, the default hash factor is the source IP address. Requests from the same source IP address are distributed to the same backend server. If you configure the UchConfig parameter, the hash factor is a URL parameter. Requests with the same URL parameter are distributed to the same backend server.
Enable Health Check
Health Check Protocol
Health Check Port
Health Check Timeout	Maximum wait time for a health check response. The check fails if the backend server does not respond within this period.
Health Check Interval
Consecutive Successes	Consecutive successful checks required to change a backend server's status from fail to success.
Consecutive Failures	Consecutive failed checks required to change a backend server's status from success to fail.
Health Check Status	HTTP status codes that indicate a successful health check.
HTTP Health Check Method
Enable getting the client IP address through the X-Forwarded-For header
Enable Session Persistence
Cookie Handling Method	insert: Insert a cookie. SLB inserts a cookie into the first response. Subsequent requests with this cookie are forwarded to the same backend server. server: Rewrite a cookie. When SLB detects a custom cookie, it rewrites the original cookie. Subsequent requests with the new cookie are forwarded to the same backend server.
Cookie Timeout
Cookie configured on the server
Enable IPv6
Enable backend keep-alive
Enable cross-zone load balancing for the server group	Enabled by default.

NLB parameter descriptions

Instance

Parameter	Description
Name
VPC ID
Zone	Select at least two zones and their vSwitches.
Protocol Version	IPv4 Dual-stack Important When you select Dual-stack, the VPC must support IPv6.
Network Type	Internet Internal
Billing Method	Pay-as-you-go
Enable Deletion Protection
Security Group

Listener

Parameter	Description
Protocol
Listener Port
Listener Name
Connection Idle Timeout	SLB closes the connection after this idle period. A new connection is established on the next request.
TLS Protocol	tls_cipher_policy_1_0 (default) tls_cipher_policy_1_1 tls_cipher_policy_1_2 tls_cipher_policy_1_2_strict tls_cipher_policy_1_2_strict_with_1_3
Support carrying the client source address to backend servers through the Proxy Protocol
Enable Mutual Authentication

Target Group

Parameter	Description
Name	Listener protocol type, mapped from the source. Read-only.
Protocol Version
Listener Protocol
Enable full-port forwarding
Enable Connection Draining
Connection Draining Timeout
Enable client IP address persistence
Scheduling Algorithm	Wrr (default): Weighted round-robin. Backend servers with higher weights receive more requests. Wlc: Weighted least connections. This algorithm considers both the weight and the number of connections of each backend server. When weights are the same, the backend server with the fewest connections receives more requests. rr: Round-robin. Requests are distributed to backend servers in sequence. sch: Source IP hash. Requests from the same source address are scheduled to the same backend server. tch: Four-tuple hash. This is a consistent hash based on a four-tuple (source IP, destination IP, source port, and destination port). The same stream is scheduled to the same backend server. qch: QUIC ID hash. This supports hashing requests with the same QUIC ID to the same backend server.
Enable Health Check
Health Check Type
Health Check Port
Health Check Timeout	Maximum wait time for a health check response. The check fails if the backend server does not respond within this period.
Health Check Interval
Consecutive Successes	Consecutive successful checks required to change a backend server's status from fail to success.
Consecutive Failures	Consecutive failed checks required to change a backend server's status from success to fail.
Health Check Status	HTTP status codes that indicate a successful health check.
HTTP Health Check Method
Health Check URI
Request string for UDP listener health check
Response string for UDP listener health check