Add cross-region servers to an NLB-Server Load Balancer(SLB)-阿里云帮助中心

Network Load Balancer (NLB) allows you to add Elastic Compute Service (ECS) instances from different regions as backend servers. This topic explains how to use an NLB instance with Cloud Enterprise Network (CEN) transit routers to forward requests across regions.

Scenario

An enterprise has a VPC (VPC1) in the China (Chengdu) region that contains an NLB instance and an ECS instance (ECS1). ECS1 serves as a client to test cross-region load balancing. The enterprise also has two other VPCs: VPC2 in China (Shanghai) and VPC3 in China (Qingdao). These VPCs contain ECS2 and ECS3, respectively, both of which run the same service.

To achieve cross-region high availability, the enterprise will add the ECS instances in VPC2 and VPC3 as backend servers to the NLB instance in VPC1. This guide shows how to add backend servers to an NLB instance across regions.

Limitations

Backend server limitations

You can add cross-region backend servers only by specifying their IP addresses.
Only private IP addresses are supported; public IP addresses cannot be used.

Transit router and VPC limitations

An Enterprise Edition transit router creates an elastic network interface (ENI) on a vSwitch in a specified zone. This ENI serves as the entry point for traffic from the VPC to the Enterprise Edition transit router. When you create a VPC, you must create at least one vSwitch in a zone supported by the Enterprise Edition transit router. See Regions and zones supported by Enterprise Edition transit routers for more information.

Prerequisites

Before you begin, ensure you have created the resources described in the following table.

Resource plan

Parameter	Description	Example value
Network Load Balancer (NLB)
Region	The region where the NLB instance is deployed.	China (Chengdu)
Instance network type	NLB supports internal-facing and internet-facing network types. An internal-facing instance provides load balancing services within a VPC and cannot be accessed over the internet. An internet-facing instance uses an Elastic IP Address (EIP). You are charged for the EIP instance, bandwidth, and data transfer.	Internal-facing
VPC	The VPC that contains the NLB instance.	VPC1-test
Zone	NLB supports multi-zone deployment. If the current region supports two or more zones, select at least two zones to ensure high availability for your business.	China (Chengdu) Zone A China (Chengdu) Zone B
Instance name	The name of the NLB instance.	nlb-test
Cloud Enterprise Network (CEN)
Instance name	The name of the CEN instance.	cen-test
Transit Router TR1
Region	You can create only one Transit Router (TR) per region within a CEN instance.	China (Chengdu)
Transit Router TR2
Region	You can create only one Transit Router (TR) per region within a CEN instance.	China (Shanghai)
Transit Router TR3
Region	You can create only one Transit Router (TR) per region within a CEN instance.	China (Qingdao)
Virtual Private Cloud VPC1
Region	The region where the VPC is deployed.	China (Chengdu)
Name	The name of the VPC instance.	VPC1-test
IPv4 CIDR block	The private IPv4 CIDR block of the VPC.	172.16.0.0/16
vSwitch1	To enable multi-zone disaster recovery, you must configure vSwitches in at least two zones. vSwitch1 is required when you create the ECS instance.	Name: vswitch-1-vpc1 Zone: China (Chengdu) Zone A IPv4 CIDR block: 172.16.20.0/24
vSwitch2	To enable multi-zone disaster recovery, you must configure vSwitches in at least two zones.	Name: vswitch-2-vpc1 Zone: China (Chengdu) Zone B IPv4 CIDR block: 172.16.21.0/24
Virtual Private Cloud VPC2
Region	The region where the VPC is deployed.	China (Shanghai)
Name	The name of the VPC instance.	VPC2-test
IPv4 CIDR block	The private IPv4 CIDR block of the VPC.	10.0.0.0/16
vSwitch1	To enable multi-zone disaster recovery, you must configure vSwitches in at least two zones. vSwitch1 is required when you create the ECS instance.	Name: vswitch-1-vpc2 Zone: China (Shanghai) Zone E IPv4 CIDR block: 10.0.20.0/24
vSwitch2	To enable multi-zone disaster recovery, you must configure vSwitches in at least two zones.	Name: vswitch-2-vpc2 Zone: China (Shanghai) Zone F IPv4 CIDR block: 10.0.21.0/24
Virtual Private Cloud VPC3
Region	The region where the VPC is deployed.	China (Qingdao)
Name	The name of the VPC instance.	VPC3-test
IPv4 CIDR block	The private IPv4 CIDR block of the VPC.	192.168.0.0/16
vSwitch1	To enable multi-zone disaster recovery, you must configure vSwitches in at least two zones. vSwitch1 is required when you create the ECS instance.	Name: vswitch-1-vpc3 Zone: China (Qingdao) Zone B IPv4 CIDR block: 192.168.20.0/24
vSwitch2	To enable multi-zone disaster recovery, you must configure vSwitches in at least two zones.	Name: vswitch-2-vpc3 Zone: China (Qingdao) Zone C IPv4 CIDR block: 192.168.21.0/24
Elastic Compute Service (ECS) 1
Billing method	For testing, we recommend using the pay-as-you-go billing method.	Pay-as-you-go
Region	The region where the instance is deployed.	China (Chengdu)
Network and zone	The network and zone where the ECS instance is deployed.	Network Type: Virtual Private Cloud VPC: VPC1-test vSwitch: vswitch-1-vpc1 Select "Assign private IPv4 address for primary ENI" and set the IP address to 172.16.20.100.
Instance type	The instance type for the ECS instance.	ecs.t5-lc2m1.nano
Image	The ECS instance's operating system image.	CentOS 7.9 64-bit
Security group	A security group is a virtual firewall that controls network access to ECS instances. Each ECS instance must belong to at least one security group.	Create a new security group. Security Group Name: sg-ecs1
Logon credentials	The logon credentials for the ECS instance.	Logon Credential: Custom Password Username: root Password/Confirm Password: Enter a password that meets the complexity requirements.
Elastic Compute Service (ECS) 2
Billing method	For testing, we recommend using the pay-as-you-go billing method.	Pay-as-you-go
Region	The region where the instance is deployed.	China (Shanghai)
Network and zone	The network and zone where the ECS instance is deployed.	Network Type: Virtual Private Cloud VPC: VPC2-test vSwitch: vswitch-1-vpc2 Select "Assign private IPv4 address for primary ENI" and set the IP address to 10.0.20.100.
Instance type	The instance type for the ECS instance.	ecs.t5-lc2m1.nano
Image	The ECS instance's operating system image.	CentOS 7.9 64-bit
Security group	A security group is a virtual firewall that controls network access to ECS instances. Each ECS instance must belong to at least one security group.	Create a new security group. Security Group Name: sg-ecs2
Logon credentials	The logon credentials for the ECS instance.	Logon Credential: Custom Password Username: root Password/Confirm Password: Enter a password that meets the complexity requirements.
Elastic Compute Service (ECS) 3
Billing method	For testing, we recommend using the pay-as-you-go billing method.	Pay-as-you-go
Region	The region where the instance is deployed.	China (Qingdao)
Network and zone	The network and zone where the ECS instance is deployed.	Network Type: Virtual Private Cloud VPC: VPC3-test vSwitch: vswitch-1-vpc3 Select "Assign private IPv4 address for primary ENI" and set the IP address to 192.168.20.100.
Instance type	The instance type for the ECS instance.	ecs.t5-lc2m1.nano
Image	The ECS instance's operating system image.	CentOS 7.9 64-bit
Security group	A security group is a virtual firewall that controls network access to ECS instances. Each ECS instance must belong to at least one security group.	Create a new security group. Security Group Name: sg-ecs3
Logon credentials	The logon credentials for the ECS instance.	Logon Credential: Custom Password Username: root Password/Confirm Password: Enter a password that meets the complexity requirements.

To learn how to create these resources, see the following topics:
- Create a Cloud Enterprise Network instance
- Create a Transit Router instance
- Create and manage a VPC
- Create and manage NLB instances
- Create an ECS instance. Ensure that the security groups for ECS2 and ECS3 allow inbound traffic on the application service port. Port 80 is used in this solution.

Step 1: Connect VPCs to transit routers

Log on to the CEN console, click the ID of the CEN instance that you created, and go to the Basic Settings > Transit Router page.

Find the TR1 instance and click Create Connection in the Actions column to connect VPC1 to TR1. On the Connection with Peer Network Instance page, configure the key parameters as shown in the following table, leave the other parameters at their default values, and then click OK.

Parameter	Description	Value
Instance Type	The type of network instance to attach to CEN.	VPC
Region	The region where the network instance is located. In this example, this is the region of VPC1.	China (Chengdu)
Account	The account that owns the network instance.	My Account
Networks	The VPC to attach to CEN.	VPC1
vSwitch	The vSwitch to attach to CEN.	A vSwitch within VPC1

Repeat the steps above to connect VPC2 to TR2 and VPC3 to TR3.

Step 2: Create inter-region connections

Log on to the Cloud Enterprise Network (CEN) console, click the instance ID, and go to the Basic Settings > Transit Router page.

Click Create Connection to the right of the TR1 instance to create an inter-region connection between TR1 and TR2. Configure the parameters as shown in the table, leave the other settings at their default values, and then click OK.

Parameter	Description	Value
Instance Type	The type of network instance to attach to the Cloud Enterprise Network.	inter-region connection
Region	The region where the transit router is deployed. In this example, this is the same region as TR1.	China (Chengdu)
Peer Region	The region where the peer transit router is deployed. You can select only a region that already contains a transit router.	China (Shanghai)
Bandwidth Allocation Mode	Use Cloud Data Transfer (CDT) to reduce costs for inter-region traffic in CEN. If you have not activated CDT, we recommend that you upgrade to CDT billing. Activating CDT is free of charge. You can also select a bandwidth plan based on your business requirements.	pay-by-data-transfer

Repeat the preceding step to create an inter-region connection between TR1 and TR3.

Step 3: Configure an NLB server group

Log on to the Network Load Balancer (NLB) server group console in the China (Chengdu) region and click Create Server Group.

Configure the parameters as described in the following table, leaving the other parameters at their default values. Then, click Create.

Parameter	Description	Value
Server Group Type	The type of backend servers to add.	IP
Server Group Name	-	test
VPC	The VPC where the server group resides.	VPC1
Resource Group	The resource group where the server group resides.	Default Resource Group

In the Actions column for the server group, click Modify Backend Server, and then click Add IP Address.
Add the IP addresses of ECS2 and ECS3. Then, click Next.
Set the port to the application service port on ECS2 and ECS3 (for example, port 80), leaving the other settings at their default values. Then, click OK.

Step 4: Configure the NLB listener

Log in to the Network Load Balancer console in the China (Chengdu) region. Find the instance and in the Actions column, click Create Listener.
Set the listener protocol to TCP and configure the listener port (for example, 80). Click Next.
Select the IP-based server group that you configured. Click Next.
Review the configuration and click Submit.

Step 5: Verify the results

Deploy test applications on ECS2 and ECS3:
1. Log in to the ECS instance console in the China (Shanghai) region. Find the ECS2 instance and click Connect in the Actions column. Use Workbench to remotely connect to the instance.
2. Run the following commands to deploy a test application on ECS2.
  Commands to deploy the test application on ECS2
  yum install -y nginx systemctl start nginx.service cd /usr/share/nginx/html/ echo "Hello World ! This is ECS02." > index.html
3. Log in to the ECS instance console in the China (Qingdao) region. Find the ECS3 instance and click Connect in the Actions column. Use Workbench to remotely connect to the instance.
4. Run the following commands to deploy a test application on ECS3.
  Commands to deploy the test application on ECS3
  yum install -y nginx systemctl start nginx.service cd /usr/share/nginx/html/ echo "Hello World ! This is ECS03." > index.html
Test availability from ECS1:
1. Log in to the ECS instance console in the China (Chengdu) region. Find the ECS1 instance and click Connect in the Actions column. Use Workbench to remotely connect to the instance.
2. Run the sudo yum install -y telnet command to install Telnet.
3. Run the telnet <domain_name> <port> command. A response containing Connected to nlb-... indicates that the NLB instance can forward requests to the backend servers.
```
[root@ym3ezdm85z35oijZ ~]# telnet xxx-xxx.cn-chengdu.elb.aliyuncs.com 80
Trying 172.16.xxx.xxx...
Connected to xxx-xxx.cn-chengdu.elb.aliyuncs.com.
Escape character is '^]'.
```
Simulate failures:
1. On ECS2, run the systemctl stop nginx.service command to stop the application.
2. Wait for a few minutes, and then run the telnet <domain_name> <port> command on ECS1 again. The command still returns a response containing Connected to nlb-....
3. On ECS2, run the systemctl start nginx.service command to restart the application. On ECS3, run the systemctl stop nginx.service command to stop the application.
4. Wait for a few minutes, and then run the telnet <domain_name> <port> command on ECS1 again. The command still returns a response containing Connected to nlb-..., as shown in the following output.
```
[root@xxxym3ezdm85z35oijZ ~]# telnet xxx-xxx.cn-chengdu.elb.aliyuncs.com 80
Trying 172.16.xxx.xxx...
Connected to xxx-xxx.cn-chengdu.elb.aliyuncs.com.
Escape character is '^]'.
```
5. This result shows that the NLB instance's availability is not affected when a single backend server fails.

Release resources

Release the CEN instance and Transit Routers (TRs):
1. Log on to the CEN console. Click the ID of the cen-test CEN instance to open the instance details page.
2. Delete the TR1 instance:
  1. On the Basic Settings > Transit Router tab, click the ID of the TR1 instance to open its details page.
  2. On the Intra-Region Connections tab, for each connected network instance, click Detach in the Actions column and confirm.
  3. On the Inter-Region Connections tab, click Delete in the Actions column and confirm.
  4. Return to the CEN instance details page. Click Delete to the right of the TR1 instance and confirm.
3. Repeat this process to delete the TR2 and TR3 instances.
4. Return to the CEN instances page. Find the CEN instance, click Delete in the Actions column, and confirm.
Release the ECS instances and their security groups:
1. Delete the ECS1 instance and its security group:
  1. Log on to the ECS instance console for the China (Chengdu) region. Find the ECS1 instance, click the icon in the Actions column, and then select Release. In the dialog box that appears, confirm your choice.
  2. Log on to the ECS security group console for the China (Chengdu) region. Select the checkbox for the custom security group of ECS1 and click Delete.
2. Repeat this process to delete the ECS2 and ECS3 instances and their security groups.
Delete the DNS records.

For details, see Delete a DNS Record.
Release the NLB resources:
1. Log on to the NLB instance console for the China (Chengdu) region. Find the NLB instance, click the icon in the Actions column, and select Release. In the dialog box that appears, confirm your choice.
2. Log on to the NLB server group console for the China (Chengdu) region. Find the server group, click the icon in the Actions column, and select Delete. In the dialog box that appears, confirm your choice.
Release the VPC resources:
1. Log on to the VPC console for the China (Chengdu) region. Click Delete to the right of the VPC. In the dialog box that appears, select the force deletion checkbox and confirm. This deletes the VPC and its vSwitches.
2. Log on to the VPC console for the China (Shanghai) region. Click Delete to the right of the VPC. In the dialog box that appears, select the force deletion checkbox and confirm. This deletes the VPC and its vSwitches.
3. Log on to the VPC console for the China (Qingdao) region. Click Delete to the right of the VPC. In the dialog box that appears, select the force deletion checkbox and confirm. This deletes the VPC and its vSwitches.