Classic Load Balancer (CLB) instance FAQ-Server Load Balancer(SLB)-阿里云帮助中心

This topic answers frequently asked questions (FAQs) about Classic Load Balancer (CLB) instances.

This topic contains the following questions:

Category	FAQ
Instance selection	How do I select a guaranteed-performance instance? Why does a guaranteed-performance instance sometimes fail to reach its performance limits?
Instance type	Can I change the instance type of a guaranteed-performance instance? After I change the instance type of a guaranteed-performance instance, why does the change not take effect immediately? Can I downgrade a subscription guaranteed-performance instance?
Instance configuration	Can I change the primary and secondary availability zones after a CLB instance is created? Does the processing time of a CLB instance include the time to receive data from and send data to a client? How do I obtain the public IP CIDR blocks that are automatically assigned to a CLB instance?
Instance O&M	Does the service address of a CLB instance support disabling Ping? A CLB instance only listens on TCP ports, but a scan shows that all UDP ports are open. Why?

How do I select a guaranteed-performance instance?

Pay-as-you-go instances

If your workload is stable, select the pay-by-specification billing method. This method charges a fixed hourly fee based on the selected instance type.
If your workload is periodic or fluctuates significantly, select the pay-by-LCU billing method. The performance of a pay-by-LCU instance automatically scales with usage, and you do not need to specify an instance type. You pay an hourly fee based on the Load Balancer Capacity Units (LCUs) you use.

Note

Beginning 00:00:00 (UTC+8), December 1, 2024, subscription CLB instances are no longer available for purchase. For more information, see End of sale for subscription CLB instances.

Subscription instances

When purchasing a subscription instance, select an appropriate instance type based on your business traffic to avoid unnecessary costs. Consider the following principles:

For a Layer 4 listener, the primary performance metric is concurrent connections. Select an instance type based on the maximum concurrent connections the CLB instance will handle.
For a Layer 7 listener, the primary performance metric is queries per second (QPS). QPS determines the throughput of a Layer 7 application system. Estimate the required QPS based on your experience. After you select an initial instance type, you can fine-tune the instance type during stress tests and real-world tests.
Use other key monitoring metrics available for guaranteed-performance instances to view the trends and peaks of your business traffic. This helps you select a more precise instance type. For more information, see View CLB monitoring data.

Failure to reach performance limits

A guaranteed-performance instance does not guarantee that all its performance metrics, including bandwidth, can reach their limits simultaneously. The instance is throttled as soon as one of the metrics reaches its upper limit.

If you purchase a pay-by-bandwidth instance, other metrics may not reach their upper limits if the bandwidth reaches its peak.

For example, a user selects an slb.s3.small instance. If the QPS of the instance reaches 20,000 but the number of concurrent connections has not reached 200,000, the maximum number of connections may never reach the upper limit of the instance type. This is because new connection requests are dropped when the QPS reaches its upper limit.

Changing the guaranteed-performance instance type

Yes.

You can modify the configuration of a guaranteed-performance instance in the console. For more information, see Modify the configurations of a pay-as-you-go CLB instance and Upgrade a subscription instance.

You can upgrade or downgrade the instance type of a pay-as-you-go guaranteed-performance instance. To downgrade a subscription guaranteed-performance instance, you must be added to a whitelist. To apply for the whitelist, contact your account manager.

Therefore, we recommend first using a pay-as-you-go instance for business testing. After you confirm the required instance type, purchase a subscription instance of that type.

Note

You can change only shared-resource CLB instances to high-performance ones. You cannot change high-performance CLB instances to shared-resource ones.
If you change the instance type and the billing method (from pay-by-data-transfer to pay-by-bandwidth or vice versa) of a guaranteed-performance instance at the same time, the changes take effect at 00:00:00 on the next day. If you only change the instance type, the change takes effect immediately. We recommend that you do not change the billing method when you change the instance type.
Changing a shared-resource instance to a guaranteed-performance instance does not affect your services or change the IP address of the CLB instance.
Configuration modifications do not change the IP address of the CLB instance.
We recommend that you change a shared-resource instance to a guaranteed-performance instance during off-peak hours. You can also use DNS to implement load balancing among instances before you modify the configuration.

Delayed effect of an instance type change

If you change the instance type and billing method (from pay-by-bandwidth to pay-by-data-transfer or vice versa) simultaneously, the changes take effect at 00:00:00 on the next day.

Can I downgrade a subscription guaranteed-performance instance?

Note

Beginning 00:00:00 (UTC+8), December 1, 2025, renewal of subscription CLB instances is no longer supported. For more information, see End of sale for subscription CLB instances.

By default, you cannot downgrade a subscription instance in real time. To use this feature, contact your account manager to apply for the whitelist.
You can change the instance type and bandwidth when you renew the instance. The change takes effect in the next billing cycle. For more information, see Renewal with configuration change.

Changing availability zones after creation

No.

You cannot change the primary availability zone after a CLB instance is created. The system automatically selects the most appropriate secondary availability zone based on regional resources, so you do not need to configure it manually.

We recommend using Application Load Balancer (ALB) or Network Load Balancer (NLB), as both support multi-availability zone deployment. For more information, see Introduction to the SLB product family, What is Application Load Balancer (ALB)?, and What is Network Load Balancer (NLB)?.

What CLB processing time includes

Yes, the processing time of a CLB instance includes the time to receive client data and send response data.

Time to receive client data: This is read_request_time. It is the total time CLB spends reading a client request and includes the time to receive the HTTP request header (read_header_time) and the request body (read_body_time).
Time to send response data: the time required to return a response to the client.s

Obtaining public IP CIDR blocks

CLB instances use dynamically allocated public IP addresses. To prevent access restrictions, obtain the IP CIDR blocks in advance to configure your firewall's allowlist.

Elastic IP Addresses (EIPs) and the public IP addresses of CLB instances are allocated from the same public IP address pool. You can call the DescribePublicIpAddress operation to obtain the public IP CIDR blocks in a specified region.

Note

This API supports pagination (100 entries per page by default). If the result set is large, adjust the pagination parameters to retrieve the full list.

Does the service address of a CLB instance support disabling Ping?

This is not directly supported. You can add the public IP address of a public-facing CLB instance or the EIP of a private-facing CLB instance to Cloud Firewall and configure an inbound rule to deny ICMP requests.

A CLB instance only listens on TCP ports, but a scan shows that all UDP ports are open. Why?

This is a false positive caused by the algorithm of the scanning tool. For UDP ports that are not configured with a listener, CLB uses a silent packet drop policy and does not send an "ICMP Port Unreachable" message back to the client. However, when some scanning tools do not receive this response packet, their logic mistakenly determines that the port is open. In reality, CLB does not process or forward any service requests on non-listening ports, and this does not affect the security of the instance.