Certopolis

AWS Certified Solutions Architect – Associate

ALB vs NLB vs Gateway Load Balancer: which one to choose

Use an Application Load Balancer for HTTP and HTTPS routing by path, host or header. Use a Network Load Balancer for TCP, UDP or TLS traffic that needs static IP addresses and very high throughput. Use a Gateway Load Balancer to put third-party virtual appliances, such as firewalls, transparently in the traffic path.

Application Load Balancer (layer 7)

An ALB evaluates listener rules in priority order and can route on path, host header, HTTP headers, methods, query strings and source IP. It can redirect, return fixed responses, authenticate users and use Lambda functions as targets. It integrates with AWS WAF.

An ALB must be enabled in at least two Availability Zones. Cross-zone load balancing is always on at the load balancer level, though it can be turned off per target group. The default routing algorithm is round robin; least outstanding requests is the alternative.

Network Load Balancer (layer 4)

An NLB handles millions of requests per second. It gets a static IP address in each enabled Availability Zone, and you can attach one Elastic IP address per subnet, which suits partner allow-lists.

For TCP it uses a flow hash and keeps each connection on one target for the life of the connection. Target groups support TCP, UDP, TCP_UDP, TLS, QUIC and TCP_QUIC. Targets can be instances, IP addresses, or an Application Load Balancer.

Cross-zone load balancing is off by default on an NLB. With two targets in one zone and eight in another, each node keeps its 50% in its own zone, so the two targets get 25% each. Turning it on gives each of the ten targets 10%.

Gateway Load Balancer (layer 3)

A GWLB listens for all IP packets on all ports and sends them to virtual appliances such as firewalls, intrusion detection and prevention systems, and deep packet inspection systems. It exchanges traffic with the appliances using GENEVE on port 6081.

Traffic reaches it through Gateway Load Balancer endpoints, which you set as the next hop in route tables. Flows stick to one appliance (5-tuple by default). Health checks default to TCP on port 80; use HTTP or HTTPS with a path to test the appliance's own status page. Cross-zone load balancing is off by default.

Where the exam catches people

  • Believing an ALB gives you fixed IP addresses: static and Elastic IP addresses per Availability Zone are a Network Load Balancer feature.
  • Believing cross-zone load balancing is on by default everywhere: it is always on for ALBs but off by default for NLBs and GWLBs.
  • Believing a GWLB inspects HTTP like an ALB: it works at layer 3, forwarding all IP packets to appliances over GENEVE on port 6081.
  • Believing ALB sticky sessions pin TCP connections: cookies are HTTP stickiness; NLB keeps each TCP connection on one target by flow hash.
  • Believing a GWLB health check reads the appliance's HTTP status by default: the default is a TCP check on port 80.

Written from Amazon Web Services's documentation

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

  1. A payment gateway must be reachable at fixed IP addresses that partners allow-list, must terminate long-lived TCP sessions that stay on one backend for the life of the connection, and must handle sudden traffic surges without pre-warming. A solutions architect is choosing between load balancer types for the public entry point. Which approach will meet these requirements?

    Right. In the game that’s Renown for your Design Resilient Architectures building.

    Not that one: C is right. In the game your Design Resilient Architectures building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    On addressing, "with Network Load Balancers, Elastic Load Balancing creates a network interface for each Availability Zone that you enable, and uses it to get a static IP address. You can optionally associate one Elastic IP address with each network interface" - which is what an allow-list needs. On session behaviour, the node "selects a target from the target group for the default rule using a flow hash algorithm" based on protocol, source address and port, destination address and port and the TCP sequence number, and then "routes each individual TCP connection to a single target for the life of the connection." No cookie, no HTTP awareness and no pre-warming are involved.

    Written from docs.aws.amazon.com/elasticloadbalancing/latest/userguide/how-elastic-load-balancing-works.html

  2. A Network Load Balancer with an Elastic IP address in each of two Availability Zones fronts a TCP service. The first zone has two targets and the second has eight. The two targets in the first zone run at high utilization while the other eight are lightly loaded. The load balancer uses its default settings. The company must spread connections evenly across all ten targets without adding, removing or moving targets, and must keep its static IP addresses. Which solution meets these requirements?

    Right. In the game that’s Renown for your Design Resilient Architectures building.

    Not that one: B is right. In the game your Design Resilient Architectures building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    With it disabled, "each load balancer node distributes traffic only across the registered targets in its Availability Zone", so each of the first zone's two targets gets 25% of the traffic. With it enabled, "each of the 10 targets receives 10% of the traffic."

    Written from docs.aws.amazon.com/elasticloadbalancing/latest/userguide/how-elastic-load-balancing-works.html

  3. Third-party firewall appliances run behind a Gateway Load Balancer, and the target group uses the default health check settings. The appliances accept no connections on port 80, so every target shows as unhealthy. Each appliance runs a status service on port 8080 that answers GET /status with 200 while inspection runs and with 503 when it stops. An appliance must be marked unhealthy when inspection stops. Which combination of steps should a solutions architect take to meet these requirements? (Select TWO.)

    Right. In the game that’s Renown for your Design Resilient Architectures building.

    Not that one: B,E is right. In the game your Design Resilient Architectures building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    The defaults do neither: the protocol "default is TCP" and the port "default is 80", which is why every appliance fails today. E points the check at port 8080. B makes the response code count, because a TCP check only opens a connection, and the status service keeps accepting connections while it returns 503; with HTTP, the Matcher holds "The HTTP codes to use when checking for a successful response from a target." E alone passes an appliance whose inspection has stopped, and B alone keeps probing port 80, where nothing listens.

    Written from docs.aws.amazon.com/elasticloadbalancing/latest/gateway/health-checks.html