Manage backend groups and servers

A backend group is the set of servers a load balancer sends traffic to, with its own health check and routing policy. On the load balancer’s Backend Mapping tab, you add groups and servers, change them in place, and remove them, on an Application Load Balancer (ALB) or a Network Load Balancer (NLB). Your changes wait until you click Save and Deploy, so you can make several and apply them together.

Before you begin

• The load balancer is powered on, and has left Creating, Deploying, or Deleting.
• Each new server’s security group allows inbound traffic on the server port from the load balancer. See Allow traffic from the load balancer to your servers.
• Your role in the project has the update permission for Load Balancers.

See the backend groups

In MyAccount, under Compute, click Load Balancers, click the load balancer, and open its Backend Mapping tab. It lists each backend group:

• On an ALB, with its Backend Group, Backend Type, Routing Policy, Protocol, Health Check, Servers, and Socket Timeout.
• On an NLB, with its Backend Group, Routing Policy, LB Listening Port, and Servers.

Each server shows its name, IP, and port, and is marked when the load balancer reports it DOWN. A scale group shows its name and its Scaler Port.

Add a backend group

1. On Backend Mapping, click Add Backend Group. The group’s form opens.
2. Enter a Backend Group name (Backend Name on a Network Load Balancer) of up to 50 characters, using letters, digits, underscores, and hyphens. Any name except none works, as long as each group on the load balancer has its own.
3. Fill in the rest of the group:
   • On an ALB: Backend Protocol, Health Check, Routing Policy, Backend Type, the servers or the scale group, and, if you want, Web Socket Timeout.
   • On an NLB: Routing Policy, LB Listening Port, and the servers.
4. Click Submit to add the group to the list, then click Save and Deploy.

Backend groups stay in the order you added them, and a new group goes to the end of the list. On an ALB, the first group takes every request that no ACL rule matches. A new group gets traffic only once an ACL rule points at it. To spread traffic across more servers, add them to the same group instead. See Route requests with ACL rules.

On an NLB, each group listens on its own LB Listening Port: 443, or a port from 1024 to 65535, other than 8080, 10050, and 9101. Clients reach the new group’s servers on that port. Port 80 is also accepted, but keep NLB groups off it: about half of the connections to a group there get 503 Service Unavailable.

Add or change servers

To change a group, edit its row on Backend Mapping. The group’s form opens with its settings and servers.

To add a server, click Add Server beside Backend Servers in the group’s form, and fill in:

• Server Name: Start typing a node’s name to pick it, and its IP fills in. The list offers your nodes outside scale groups and Kubernetes clusters. A name may use letters, digits, underscores, and hyphens, up to 64 characters.
• Server IP: the server’s IPv4 address. Without a VPC, use the node’s private IP. Once the load balancer is in a VPC, use the node’s IP in that VPC.
• Server Port: the port your application listens on, from 1 to 65535.

Click Submit. The server joins Backend Servers, ticked. A second server with the same name, or the same IP and port, is refused with Same name is not allowed.

Every server in a group takes traffic. To take a server out, untick it under Backend Servers (Backends on an NLB group). Only ticked servers are kept once you click Submit in the group’s form and then Save and Deploy.

On an NLB, server names within a group must differ, and each group must have at least one server.

Choose the health check

On an ALB, Health Check decides how the load balancer tests each server:

• Ticked, the load balancer sends each server an HTTP HEAD request for /, with the host name localhost. A server that answers with a status in the 200s or 300s passes.
• Unticked, the load balancer still checks that it can open a connection to the server’s port, so a server that refuses connections is still taken out.

An NLB always checks servers by opening a connection to their port.

Health Check is ticked for you when you create a load balancer, and unticked when you add a group on Backend Mapping. Tick it there if you want it.

The path and the host are fixed at / and localhost, so a server that hosts several sites by name answers the check from its default site. That site must answer HEAD / with a status in the 200s or 300s.

The load balancer sends traffic only to the servers that pass. When no server in the group passes, an ALB answers users with 503 Service Unavailable, and an NLB closes each connection without sending any data. If the load balancer cannot connect to a server, an ALB tries again, up to seven times, and can send the request to another server.

The load balancer checks each server every two seconds, and keeps checking a server while it is out:

• A server that fails three checks in a row stops getting traffic, about six seconds after it starts failing.
• A server that is out gets traffic again after two passing checks in a row, about four seconds after it starts answering.

To test whether the check itself is the problem, untick Health Check for a while and save. If the server then serves traffic, fix what it answers for HEAD /, and tick the check again.

Choose a routing policy

Routing Policy decides which server in the group gets each new connection:

• Source IP Hash works out the server from the client’s IP address. A client keeps reaching the same server while the set of healthy servers stays the same. Choose it when your application keeps a user’s session on one server. When a server goes down, its clients move to the others, and any change in the number of healthy servers can move many clients at once. Clients behind one shared address all reach the same server.
• Round Robin sends each new connection to the next server in turn. Choose it when any server can answer any request.
• Least Connection sends each new connection to the server with the fewest open connections. Choose it for long-lived connections, such as WebSockets.

Source IP Hash is the only way to keep a client on one server, since the load balancer sets no session cookies.

New ALB groups start on Source IP Hash. NLB groups start on Least Connection when you create the load balancer, and on Source IP Hash when you add them on Backend Mapping.

Choose the backend protocol (ALB)

Backend Protocol is what your application speaks on the server port. With HTTP, the load balancer connects to the servers over plain HTTP. With HTTPS, it connects over HTTPS, so traffic stays encrypted between the load balancer and your servers.

Requests your servers receive (ALB)

Over HTTP, your application receives each client’s IP address in a header named X-Forwarded-For. Read the client’s address from that header, since the connection to your server comes from the load balancer.

Over HTTP, a client’s connection to the load balancer stays open between its requests. It closes once it has been idle for the HTTP Keep Alive Timeout, 60 seconds unless you change it. Toward your servers, the load balancer asks each server to close its connection after every response.

The load balancer can compress HTTP responses with gzip for clients that accept it.

Use a scale group (ALB)

To let the servers grow and shrink with the load, set Backend Type to Auto Scale Group, choose the scale group under Auto Scaling Group, and enter the Scaler Port, the port your application listens on in each node, from 1 to 65535. Each backend group takes either a list of servers or a single scale group.

When the scale group adds or removes a node, the load balancer reads Deploying until it is done.

A node the scale group adds starts getting traffic about 35 seconds after it reads Running. Your users’ requests keep succeeding while the scale group grows. See Put a load balancer in front of a scale group.

(Optional) Set a WebSocket timeout (ALB)

Web Socket Timeout sets how long a WebSocket or another upgraded connection can stay idle, from 1 to 100 hours. Left blank, the load balancer’s client and server timeouts apply to these connections too.

Remove a backend group

Removing a group on an ALB also removes the ACL rules that send traffic to it, when you save. A load balancer must have at least one backend group. To remove the last one, delete the load balancer; see Delete a load balancer.

1. On Backend Mapping, delete the group’s row, and confirm.
2. Click Save and Deploy.

Save and deploy your changes

1. On Backend Mapping, click Save and Deploy.
2. Confirm the update.

The load balancer reads Deploying while your change takes effect, which takes about five to 10 minutes. Connections that are already open through the load balancer stay open while the change is applied.

Save before you leave the tab, or your changes are discarded.

Check the servers’ health

When the load balancer leaves Deploying, open Backend Mapping. Each server shows its health. One failing server turns the status to Backend Connection Failure, while the others keep serving.

To send some requests to another group, see Route requests with ACL rules. If a server shows DOWN, see The load balancer shows Backend Connection Failure. To change backend groups from a script, see Update Load Balancer in the API reference.