Alibaba Cloud 3-factor KYC verification Alibaba Cloud Load Balancer Setup Tutorial

Alibaba Cloud / 2026-06-30 13:35:06

Chapter 1: Why a Load Balancer Matters

Alibaba Cloud 3-factor KYC verification When you run real services, you quickly discover that a single server is rarely enough. Traffic grows, deployments need to be safer, and failures happen. A load balancer helps you handle these realities by distributing incoming requests across multiple backend instances.

In Alibaba Cloud (阿里云), the Load Balancer service is designed for this exact job: it receives client traffic, forwards it to healthy backend servers, and can handle various networking modes. Even if you’ve never configured one before, the process is straightforward as long as you follow a clean order.

Alibaba Cloud 3-factor KYC verification This tutorial walks you through a practical setup: creating a load balancer, choosing listeners and forwarding rules, attaching backend servers, and configuring health checks. The goal is not just to “make it work,” but to understand what each part is doing so you can adjust it later.

Chapter 2: Before You Start—Plan Your Architecture

Before touching any console, decide what you want the traffic flow to look like.

2.1 Decide the Network Type

Alibaba Cloud load balancers typically work with either internet-facing access or internal access, depending on your needs. If your users are coming from the public internet, you’ll likely choose an internet-facing configuration. If services are only consumed within a VPC (Virtual Private Cloud), an internal one makes more sense.

2.2 Choose Backend Instances

Pick the servers (ECS instances) that will actually serve requests. Your load balancer will not “run your application.” It will only route traffic to instances that are healthy and correctly configured.

For a typical web setup, all backend servers should host the same application (or at least a compatible service) and listen on the same port.

2.3 Prepare Security Group Rules

Load balancers rely on network connectivity to your backend instances. You must ensure that:

The backend instances allow inbound traffic on the application port from the appropriate source (often the load balancer, depending on your configuration).
If you’re using strict firewall rules, you confirm the required ports are open.
Network ACLs (if used) do not block the traffic.

This is one of the most common reasons a load balancer shows unhealthy targets.

Chapter 3: Create the Load Balancer

Now we move from planning to implementation.

3.1 Open the Alibaba Cloud Console

Log in to Alibaba Cloud and navigate to the Load Balancer product area in the console. The interface may vary slightly based on your region and product version, but the workflow is consistent.

3.2 Create a New Load Balancer Instance

Click to create a new load balancer. You will be asked to choose key options such as:

Load Balancer Type: Usually internet-facing or internal-facing.
Region: Must match the region where your ECS instances exist.
VPC: Select the same VPC as your backend servers.
Network: Make sure the subnets you choose align with your ECS placement.

After you submit, the console will create the load balancer and assign it an address depending on the type.

Alibaba Cloud 3-factor KYC verification Chapter 4: Add Listeners and Forwarding Rules

Listeners are the “front doors.” A listener tells the load balancer what kind of traffic to accept and where to send it.

4.1 What Is a Listener?

A listener binds a protocol and port to your load balancer. For example:

HTTP on port 80
HTTPS on port 443
TCP on a custom port

When a client connects to the load balancer, it hits the listener first. The listener then applies a forwarding rule to decide which backend target group to use.

4.2 Create the Listener

In the load balancer configuration page, create a listener with these common settings:

Protocol: HTTP (or HTTPS if you have TLS set up)
Port: The port clients will use
VServer / Listener Action: Forward to backend servers

If you’re doing a simple HTTP setup, start with HTTP on port 80 and forward to the same port on your backend ECS instances.

4.3 Set the Forwarding Rule

Forwarding rules link the listener to a backend target group. Depending on the service version, you might configure an entire backend group first, then attach it to a forwarding rule.

At this stage, keep it simple: one listener, one backend group, one forwarding rule. When that works, you can add more advanced routing later.

Chapter 5: Configure Backend Servers (Target Groups)

Your load balancer needs a list of backend servers. In many cloud load balancer designs, this is represented by a “backend server group” or “target group.”

5.1 Create a Backend Server Group

In the load balancer section, create a backend server group and specify:

Protocol: usually HTTP for web
Port: the port your application listens on in the ECS instances
VPC / Network: should match your load balancer VPC

5.2 Add ECS Instances as Backends

Next, add your ECS instances into that backend group. You typically select instances by ID and choose the port. After this, the load balancer knows where it should forward traffic.

5.3 Confirm Application Ports

Double-check that your application really listens on the port you configured. For example, if your listener forwards to backend port 8080, your ECS instances must accept connections on 8080.

It sounds obvious, but mismatched ports are an easy way to waste an afternoon.

Chapter 6: Health Checks—The Secret to Reliable Routing

Health checks decide whether a backend server is considered “healthy” and eligible to receive traffic. If health checks fail, the load balancer will stop routing requests to that instance.

6.1 Choose Health Check Type

Common options include:

HTTP health checks: send an HTTP request to a specific path
TCP health checks: only verify the port is reachable

For HTTP services, HTTP health checks are usually better because they can verify that the application is responding, not just that a port is open.

6.2 Configure Health Check Path and Port

If using HTTP health checks, set a health check URL path such as:

/health
/status

Make sure your application returns an expected response for that path.

Also confirm the health check port matches the backend application port.

6.3 Tune Timing Parameters

Alibaba Cloud 3-factor KYC verification You’ll see options like interval, timeout, and unhealthy threshold. In most cases:

Interval: how often checks run
Timeout: how long to wait for a response
Healthy/unhealthy thresholds: how many consecutive failures trigger status change

If you keep defaults, that’s fine to start. Later, if you deploy frequently or your app has slow start behavior, you may need to adjust to prevent premature marking as unhealthy.

Chapter 7: Finalize Networking and Security

Once listeners, backend groups, and health checks are set, the configuration still won’t work if networking isn’t ready. This chapter focuses on the most common fixes.

7.1 Security Group Inbound Rules for ECS

On each ECS instance’s security group, add inbound rules that allow:

The load balancer to reach the backend port
Health check traffic (if health checks come from specific sources, ensure they’re allowed)

Because console labels differ, you may need to check which security group source the load balancer uses in your environment. If you only allow traffic from your own IP, health checks will fail.

7.2 Outbound Rules and Return Paths

Make sure outbound rules allow responses. Usually default outbound is “allow all,” but if yours is locked down, verify return traffic isn’t blocked.

7.3 Application-Level Firewall

Even if cloud security groups allow traffic, the instance OS might block it (for example via firewall settings). Confirm that your application can accept connections on the configured port.

Chapter 8: Verify the Load Balancer Status

After saving your configuration, you should check whether:

Alibaba Cloud 3-factor KYC verification The listener is active
The backend servers appear as healthy
Alibaba Cloud 3-factor KYC verification No forwarding errors are shown

Cloud consoles usually show a health status per backend instance. If you see “unhealthy,” treat it like a debugging checklist problem rather than a mystery.

8.1 Read Health Check Failure Information

Many dashboards provide details such as response code mismatch, timeout, or connection failure. Use those signals to narrow down whether it’s:

Security group or network routing
Wrong port
Health check path not found
Application down or misconfigured

8.2 Test From the Backend Instances

Alibaba Cloud 3-factor KYC verification Before testing the load balancer publicly, verify your application works on each ECS instance directly. Confirm that:

Your health check endpoint returns a valid response
The main service endpoint behaves correctly

If the health endpoint fails locally on an instance, the load balancer can’t magically fix it.

Chapter 9: Test Traffic Through the Load Balancer

Once backend instances are healthy, test traffic using the load balancer address.

9.1 Basic HTTP Test

Use a browser or command-line request to hit the load balancer listener. Example steps:

Open the load balancer public address (or internal address if it’s internal)
Verify the response comes from one of the backend instances

If you run multiple instances, you can observe whether requests distribute across them.

9.2 Confirm Session Behavior (If Needed)

Some apps rely on session state. If your backend sessions are stored in memory, different requests might land on different instances and break expectations.

To address this, you can either:

Use sticky sessions (if supported by your load balancer settings)
Store session data externally (recommended for many production setups)

Whether you need this depends on your application.

Chapter 10: Common Mistakes and How to Fix Them

Even with careful configuration, mistakes happen. Here are the issues that most often prevent a working setup, plus practical fixes.

10.1 Listener Port Doesn’t Match Backend Port

Symptom: health checks fail, or requests time out.

Fix: ensure the forwarding port and the backend application port are consistent. Remember: listener port is what clients connect to; backend port is what your ECS instances listen on.

10.2 Health Check Path Returns Wrong Status

Alibaba Cloud 3-factor KYC verification Symptom: backend shows unhealthy despite the service being reachable.

Alibaba Cloud 3-factor KYC verification Fix: check that the health check path exists and returns an expected response code. If your console expects HTTP 200 but your app returns 404 or 500, health checks will mark it unhealthy.

10.3 Security Group Source Is Too Restrictive

Symptom: connection failures or timeouts during health checks.

Fix: allow inbound traffic to the backend port from the load balancer’s relevant source (or from the load balancer security group, depending on your setup).

10.4 Wrong Region or VPC Selection

Symptom: configuration seems incomplete, or you can’t attach expected resources.

Fix: verify that load balancer, VPC, and ECS instances are in the same region and compatible VPC/subnet configuration.

Chapter 11: Upgrade Your Setup (Optional but Useful)

Once the basic tutorial works, you can make your load balancing setup more production-ready.

11.1 Add HTTPS with Certificates

If you need encryption from clients, configure an HTTPS listener. This usually involves uploading a certificate and setting the TLS policy. After that, your backend can still be HTTP or HTTPS depending on your security needs.

11.2 Multiple Listeners and Routing Rules

You can run multiple listeners, such as:

HTTP for redirects
HTTPS for real traffic
Different ports for different services

Some deployments also use path-based routing or host-based rules, depending on what Alibaba Cloud supports in your load balancer configuration.

11.3 Scale Backend Servers

When you add or remove ECS instances, update the backend group membership. To avoid manual work, teams often integrate with auto-scaling, so new instances are automatically registered and unhealthy ones are removed.

Even without automation, keep your backend group tidy to ensure predictable traffic distribution.

Chapter 12: A Minimal Checklist to Complete This Tutorial

If you want a quick “do I have everything?” checklist, use this:

Create a load balancer in the correct region and VPC
Create a listener (HTTP or HTTPS) on the desired frontend port
Create a backend server group using the correct protocol and backend port
Add ECS instances to that backend group
Configure health checks with a valid path (or TCP check if applicable)
Open security group inbound rules on ECS for the backend port
Verify that health checks show healthy
Test requests using the load balancer address

Follow this order and your setup should go smoothly.

Chapter 13: Final Thoughts

Setting up an Alibaba Cloud Load Balancer is largely about correctness: correct networking, correct listener-forwarding mapping, and correct health checks. Once those three pieces line up, the rest becomes manageable and repeatable.

Start small with one service and a simple health check, then expand. As you gain confidence, you can introduce HTTPS, multiple listeners, and autoscaling patterns that make your system resilient under real-world traffic.