Console

1. In the Google Cloud console, go to theVPC networks page.

   Go to VPC networks

2. ClickCreate VPC network.

3. ForName, enterlb-network.

4. In theSubnets section, do the following:

   1. Set theSubnet creation mode toCustom.
   2. In theNew subnet section, enter the following information:
      • Name:lb-subnet
      • Region:us-west1
      • IP stack type:IPv4 (single-stack)
      • IP address range:10.1.2.0/24
   3. ClickDone.
   4. ClickAdd subnet and enter the following information:
      • Name:europe-subnet
      • Region:europe-west1
      • IP stack type:IPv4 (single-stack)
      • IP address range:10.3.4.0/24
   5. ClickDone.

5. ClickCreate.

gcloud

1. Create the custom VPC network:

   gcloud compute networks create lb-network --subnet-mode=custom

2. In thelb-network network, create a subnet for backends in theus-west1 region:

   gcloud compute networks subnets create lb-subnet \    --network=lb-network \    --range=10.1.2.0/24 \    --region=us-west1

3. In thelb-network network, create another subnet for testing global access in theeurope-west1 region:

   gcloud compute networks subnets create europe-subnet \    --network=lb-network \    --range=10.3.4.0/24 \    --region=europe-west1

API

Make aPOST request to thenetworks.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks{ "routingConfig": {   "routingMode": "REGIONAL" }, "name": "lb-network", "autoCreateSubnetworks": false}

Make twoPOST requests to thesubnetworks.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/subnetworks{ "name": "lb-subnet", "network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/lb-network", "ipCidrRange": "10.1.2.0/24", "privateIpGoogleAccess": false}

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/europe-west1/subnetworks{ "name": "europe-subnet", "network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/lb-network",  "ipCidrRange": "10.3.4.0/24",  "privateIpGoogleAccess": false}

Console

1. In the Google Cloud console, go to theFirewall policies page.

   Go to Firewall policies

2. To allow subnet traffic, clickCreate firewall rule and enter the following information:

   • Name:fw-allow-lb-access
   • Network:lb-network
   • Priority:1000
   • Direction of traffic:ingress
   • Action on match:allow
   • Targets:All instances in the network
   • Source filter:IPv4 ranges
   • Source IPv4 ranges:10.1.2.0/24
   • Protocols and ports:Allow all

3. ClickCreate.

4. To allow incoming SSH connections, clickCreate firewall rule again and enter the following information:

   • Name:fw-allow-ssh
   • Network:lb-network
   • Priority:1000
   • Direction of traffic:ingress
   • Action on match:allow
   • Targets:Specified target tags
   • Target tags:allow-ssh
   • Source filter:IPv4 ranges
   • Source IPv4 ranges:0.0.0.0/0
   • Protocols and ports: SelectSpecified protocols and ports,select theTCP checkbox, and then enter22 inPorts.

5. ClickCreate.

6. To allow Google Cloud health checks, clickCreate firewall rule a third time and enter the following information:

   • Name:fw-allow-health-check
   • Network:lb-network
   • Priority:1000
   • Direction of traffic:ingress
   • Action on match:allow
   • Targets:Specified target tags
   • Target tags:allow-health-check
   • Source filter:IPv4 ranges
   • Source IPv4 ranges:130.211.0.0/22 and35.191.0.0/16
   • Protocols and ports:Allow all

7. ClickCreate.

gcloud

1. Create thefw-allow-lb-access firewall rule to allow communication fromwithin the subnet:

   gcloud compute firewall-rules create fw-allow-lb-access \    --network=lb-network \    --action=allow \    --direction=ingress \    --source-ranges=10.1.2.0/24,10.3.4.0/24 \    --rules=tcp,udp,icmp

2. Create thefw-allow-ssh firewall rule to allow SSH connectivity toVMs with the network tagallow-ssh. When you omitsource-ranges,Google Cloudinterprets the rule to mean anysource.

   gcloud compute firewall-rules create fw-allow-ssh \    --network=lb-network \    --action=allow \    --direction=ingress \    --target-tags=allow-ssh \    --rules=tcp:22

3. Create thefw-allow-health-check rule to allow Google Cloudhealth checks.

   gcloud compute firewall-rules create fw-allow-health-check \    --network=lb-network \    --action=allow \    --direction=ingress \    --target-tags=allow-health-check \    --source-ranges=130.211.0.0/22,35.191.0.0/16 \    --rules=tcp,udp,icmp

API

Create thefw-allow-lb-access firewall rule by making aPOST request tothefirewalls.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls{ "name": "fw-allow-lb-access", "network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/lb-network", "priority": 1000, "sourceRanges": [   "10.1.2.0/24", "10.3.4.0/24" ], "allowed": [   {     "IPProtocol": "tcp"   },   {     "IPProtocol": "udp"   },   {     "IPProtocol": "icmp"   } ], "direction": "INGRESS", "logConfig": {   "enable": false }, "disabled": false}

Create thefw-allow-ssh firewall rule by making aPOST request tothefirewalls.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls{ "name": "fw-allow-ssh",      "network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/lb-network", "priority": 1000, "sourceRanges": [   "0.0.0.0/0" ], "targetTags": [   "allow-ssh" ], "allowed": [  {    "IPProtocol": "tcp",    "ports": [      "22"    ]  } ],"direction": "INGRESS","logConfig": {  "enable": false},"disabled": false}

Create thefw-allow-health-check firewall rule by making aPOST request tothefirewalls.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls{ "name": "fw-allow-health-check", "network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/lb-network", "priority": 1000, "sourceRanges": [   "130.211.0.0/22",   "35.191.0.0/16" ], "targetTags": [   "allow-health-check" ], "allowed": [   {     "IPProtocol": "tcp"   },   {     "IPProtocol": "udp"   },   {     "IPProtocol": "icmp"   } ], "direction": "INGRESS", "logConfig": {   "enable": false }, "disabled": false}

Console

Create backend VMs

1. In the Google Cloud console, go to theVM instances page.

   Go to VM instances

2. Repeat steps 3 to 8 for each VM, using the following nameand zone combinations.

   • Name:vm-a1, zone:us-west1-a
   • Name:vm-a2, zone:us-west1-a
   • Name:vm-c1, zone:us-west1-c
   • Name:vm-c2, zone:us-west1-c

3. ClickCreate instance.

4. Set theName as indicated in step 2.

5. ForRegion, selectus-west1, and choose aZone asindicated in step 2.

6. In theBoot disk section, ensure thatDebian GNU/Linux 12 (bookworm) is selected for the boot diskoptions. If necessary, clickChange to change the image.

7. ClickAdvanced options.

8. ClickNetworking and configure the following fields:

   1. ForNetwork tags, enterallow-ssh andallow-health-check.
   2. ForNetwork interfaces, select the following:
      • Network:lb-network
      • Subnet:lb-subnet
      • IP stack type:IPv4 (single-stack)
      • Primary internal IPv4 address:Ephemeral (automatic)
      • External IPv4 address:Ephemeral

9. ClickManagement, and then in theStartup script field, enter the following script. The script contents are identical for all four VMs.

   #! /bin/bashif [ -f /etc/startup_script_completed ]; thenexit 0fiapt-get updateapt-get install apache2 -ya2ensite default-ssla2enmod sslfile_ports="/etc/apache2/ports.conf"file_http_site="/etc/apache2/sites-available/000-default.conf"file_https_site="/etc/apache2/sites-available/default-ssl.conf"http_listen_prts="Listen 80\nListen 8008\nListen 8080\nListen 8088"http_vh_prts="*:80 *:8008 *:8080 *:8088"https_listen_prts="Listen 443\nListen 8443"https_vh_prts="*:443 *:8443"vm_hostname="$(curl -H "Metadata-Flavor:Google" \http://metadata.google.internal/computeMetadata/v1/instance/name)"echo "Page served from: $vm_hostname" | \tee /var/www/html/index.htmlprt_conf="$(cat "$file_ports")"prt_conf_2="$(echo "$prt_conf" | sed "s|Listen 80|${http_listen_prts}|")"prt_conf="$(echo "$prt_conf_2" | sed "s|Listen 443|${https_listen_prts}|")"echo "$prt_conf" | tee "$file_ports"http_site_conf="$(cat "$file_http_site")"http_site_conf_2="$(echo "$http_site_conf" | sed "s|*:80|${http_vh_prts}|")"echo "$http_site_conf_2" | tee "$file_http_site"https_site_conf="$(cat "$file_https_site")"https_site_conf_2="$(echo "$https_site_conf" | sed "s|_default_:443|${https_vh_prts}|")"echo "$https_site_conf_2" | tee "$file_https_site"systemctl restart apache2touch /etc/startup_script_completed

10. ClickCreate.

Create instance groups

1. In the Google Cloud console, go to theInstance groups page.

   Go to Instance groups

2. Repeat the following steps to create two unmanaged instance groups eachwith two VMs in them, using these combinations.

   • Instance group name:ig-a, zone:us-west1-a, VMs:vm-a1 andvm-a2
   • Instance group name:ig-c, zone:us-west1-c, VMs:vm-c1 andvm-c2

3. ClickCreate instance group.

4. ClickNew unmanaged instance group.

5. SetName as indicated in step 2.

6. In theLocation section, selectus-west1 forRegion, andthen choose aZone as indicated in step 2.

7. ForNetwork, selectlb-network.

8. ForSubnetwork, selectlb-subnet.

9. In theVM instances section, add the VMs as indicated in step 2.

10. ClickCreate.

gcloud

1. Create the four VMs by running the following command four times, usingthese four combinations for[VM-NAME] and[ZONE]. The script contentsare identical for all four VMs.

   • VM-NAME:vm-a1,ZONE:us-west1-a
   • VM-NAME:vm-a2,ZONE:us-west1-a
   • VM-NAME:vm-c1,ZONE:us-west1-c
   • VM-NAME:vm-c2,ZONE:us-west1-c

     gcloud compute instances createVM-NAME \      --zone=ZONE \      --image-family=debian-12 \      --image-project=debian-cloud \      --tags=allow-ssh,allow-health-check \      --subnet=lb-subnet \      --metadata=startup-script='#! /bin/bashif [ -f /etc/startup_script_completed ]; thenexit 0fiapt-get updateapt-get install apache2 -ya2ensite default-ssla2enmod sslfile_ports="/etc/apache2/ports.conf"file_http_site="/etc/apache2/sites-available/000-default.conf"file_https_site="/etc/apache2/sites-available/default-ssl.conf"http_listen_prts="Listen 80\nListen 8008\nListen 8080\nListen 8088"http_vh_prts="*:80 *:8008 *:8080 *:8088"https_listen_prts="Listen 443\nListen 8443"https_vh_prts="*:443 *:8443"vm_hostname="$(curl -H "Metadata-Flavor:Google" \http://metadata.google.internal/computeMetadata/v1/instance/name)"echo "Page served from: $vm_hostname" | \tee /var/www/html/index.htmlprt_conf="$(cat "$file_ports")"prt_conf_2="$(echo "$prt_conf" | sed "s|Listen 80|${http_listen_prts}|")"prt_conf="$(echo "$prt_conf_2" | sed "s|Listen 443|${https_listen_prts}|")"echo "$prt_conf" | tee "$file_ports"http_site_conf="$(cat "$file_http_site")"http_site_conf_2="$(echo "$http_site_conf" | sed "s|*:80|${http_vh_prts}|")"echo "$http_site_conf_2" | tee "$file_http_site"https_site_conf="$(cat "$file_https_site")"https_site_conf_2="$(echo "$https_site_conf" | sed "s|_default_:443|${https_vh_prts}|")"echo "$https_site_conf_2" | tee "$file_https_site"systemctl restart apache2touch /etc/startup_script_completed'

2. Create the two unmanaged instance groups in each zone:

   gcloud compute instance-groups unmanaged create ig-a \    --zone=us-west1-agcloud compute instance-groups unmanaged create ig-c \    --zone=us-west1-c

3. Add the VMs to the appropriate instance groups:

   gcloud compute instance-groups unmanaged add-instances ig-a \    --zone=us-west1-a \    --instances=vm-a1,vm-a2gcloud compute instance-groups unmanaged add-instances ig-c \    --zone=us-west1-c \    --instances=vm-c1,vm-c2

API

For the four VMs, use the following VM names and zones:

• VM-NAME:vm-a1,ZONE:us-west1-a
• VM-NAME:vm-a2,ZONE:us-west1-a
• VM-NAME:vm-c1,ZONE:us-west1-c
• VM-NAME:vm-c2,ZONE:us-west1-c

You can get the currentDEBIAN_IMAGE_NAME by running the followinggcloud command:

gcloud compute images list \ --filter="family=debian-12"

Create four backend VMs by making fourPOST requests to theinstances.insert method:

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances{ "name": "VM-NAME", "tags": {   "items": [     "allow-health-check",     "allow-ssh"   ] }, "machineType": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/[ZONE]/machineTypes/e2-standard-2", "canIpForward": false, "networkInterfaces": [   {     "network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/lb-network",     "subnetwork": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/subnetworks/lb-subnet",     "accessConfigs": [       {         "type": "ONE_TO_ONE_NAT",         "name": "external-nat",         "networkTier": "PREMIUM"       }     ]   } ], "disks": [   {     "type": "PERSISTENT",     "boot": true,     "mode": "READ_WRITE",     "autoDelete": true,     "deviceName": "VM-NAME",     "initializeParams": {       "sourceImage": "projects/debian-cloud/global/images/debian-image-name",       "diskType": "projects/PROJECT_ID/zones/zone/diskTypes/pd-standard",       "diskSizeGb": "10"     }   } ], "metadata": {   "items": [     {       "key": "startup-script",       "value": "#! /bin/bash\napt-get update\napt-get install apache2 -y\na2ensite default-ssl\na2enmod ssl\nfile_ports=\"/etc/apache2/ports.conf\"\nfile_http_site=\"/etc/apache2/sites-available/000-default.conf\"\nfile_https_site=\"/etc/apache2/sites-available/default-ssl.conf\"\nhttp_listen_prts=\"Listen 80\\nListen 8008\\nListen 8080\\nListen 8088\"\nhttp_vh_prts=\"*:80 *:8008 *:8080 *:8088\"\nhttps_listen_prts=\"Listen 443\\nListen 8443\"\nhttps_vh_prts=\"*:443 *:8443\"\nvm_hostname=\"$(curl -H \"Metadata-Flavor:Google\" \\\nhttp://metadata.google.internal/computeMetadata/v1/instance/name)\"\necho \"Page served from: $vm_hostname\" | \\\ntee /var/www/html/index.html\nprt_conf=\"$(cat \"$file_ports\")\"\nprt_conf_2=\"$(echo \"$prt_conf\" | sed \"s|Listen 80|${http_listen_prts}|\")\"\nprt_conf=\"$(echo \"$prt_conf_2\" | sed \"s|Listen 443|${https_listen_prts}|\")\"\necho \"$prt_conf\" | tee \"$file_ports\"\nhttp_site_conf=\"$(cat \"$file_http_site\")\"\nhttp_site_conf_2=\"$(echo \"$http_site_conf\" | sed \"s|*:80|${http_vh_prts}|\")\"\necho \"$http_site_conf_2\" | tee \"$file_http_site\"\nhttps_site_conf=\"$(cat \"$file_https_site\")\"\nhttps_site_conf_2=\"$(echo \"$https_site_conf\" | sed \"s|_default_:443|${https_vh_prts}|\")\"\necho \"$https_site_conf_2\" | tee \"$file_https_site\"\nsystemctl restart apache2"     }   ] }, "scheduling": {   "preemptible": false }, "deletionProtection": false}

Create two instance groups by making aPOST request to theinstanceGroups.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-a/instanceGroups{ "name": "ig-a", "network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/lb-network", "subnetwork": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/subnetworks/lb-subnet"}

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-c/instanceGroups{ "name": "ig-c", "network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/lb-network", "subnetwork": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/subnetworks/lb-subnet"}

Add instances to each instance group by making aPOST request to theinstanceGroups.addInstances method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-a/instanceGroups/ig-a/addInstances{ "instances": [   {     "instance": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-a/instances/vm-a1",     "instance": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-a/instances/vm-a2"   } ]}

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-c/instanceGroups/ig-c/addInstances{ "instances": [   {     "instance": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-c/instances/vm-c1",     "instance": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-c/instances/vm-c2"   } ]}

Console

Start your configuration

1. In the Google Cloud console, go to theLoad balancing page.

   Go to Load balancing

2. ClickCreate load balancer.
3. ForType of load balancer, selectNetwork Load Balancer (TCP/UDP/SSL) and clickNext.
4. ForProxy or passthrough, selectPassthrough load balancer and clickNext.
5. ForPublic facing or internal, selectInternal and clickNext.
6. ClickConfigure.

Basic configuration

On theCreate internal passthrough Network Load Balancer page, enter thefollowing information:

• Load balancer name:be-ilb
• Region:us-west1
• Network:lb-network

Configure the backends

1. ClickBackend configuration.

2. In theHealth check list, clickCreate a health check,and enter the following information.

   • Name:hc-http-80
   • Protocol:HTTP
   • Port:80
   • Proxy protocol:None
   • Request:/

   Note that when you use the Google Cloud console to create your loadbalancer, the health check is global. If you want to create aregional health check, usegcloud or the API.

3. ClickCreate.

4. To handle only IPv4 traffic, in theNew Backend section, forIP stack type, select theIPv4 (single-stack) option.

5. In theInstance group list, select theig-c instance group andclickDone.

6. ClickAdd a backend and repeat the step to add theig-a instancegroup.

7. Verify that there is a blue check mark next toBackend configuration before continuing.

Configure the frontend

1. ClickFrontend configuration.
2. In theNew Frontend IP and port section, do the following:
   1. ForName, enterfr-ilb.
   2. ForSubnetwork, selectlb-subnet.
   3. In theInternal IP purpose section, in theIP address list,selectCreate IP address, enter the following information, andthen clickReserve.
      • Name:ip-ilb
      • IP version:IPv4
      • Static IP address:Let me choose
      • Custom IP address:10.1.2.99
   4. ForPorts, selectMultiple and then inPort numbers, enter80,8008,8080, and8088.
   5. Verify that there is a blue check mark next toFrontend configuration before continuing.

Review the configuration

1. ClickReview and finalize.
2. Review your load balancer configuration settings.
3. Optional: ClickEquivalent code to view the REST API requestthat will be used to create the load balancer.
4. ClickCreate.

gcloud

1. Create a new regional HTTP health check to test HTTP connectivity to theVMs on port 80.

   gcloud compute health-checks create http hc-http-80 \    --region=us-west1 \    --port=80

2. Create the backend service for HTTP traffic:

   gcloud compute backend-services create be-ilb \    --load-balancing-scheme=internal \    --protocol=tcp \    --region=us-west1 \    --health-checks=hc-http-80 \    --health-checks-region=us-west1

3. Add the two instance groups to the backend service:

   gcloud compute backend-services add-backend be-ilb \    --region=us-west1 \    --instance-group=ig-a \    --instance-group-zone=us-west1-agcloud compute backend-services add-backend be-ilb \    --region=us-west1 \    --instance-group=ig-c \    --instance-group-zone=us-west1-c

4. Create a forwarding rule for the backend service. When you create theforwarding rule, specify10.1.2.99 for the internal IP address in thesubnet.

   gcloud compute forwarding-rules create fr-ilb \    --region=us-west1 \    --load-balancing-scheme=internal \    --network=lb-network \    --subnet=lb-subnet \    --address=10.1.2.99 \    --ip-protocol=TCP \    --ports=80,8008,8080,8088 \    --backend-service=be-ilb \    --backend-service-region=us-west1

API

Create the health check by making aPOST request to theregionHealthChecks.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/regionHealthChecks{"name": "hc-http-80","type": "HTTP","httpHealthCheck": {  "port": 80}}

Create the regional backend service by making aPOST request to theregionBackendServices.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/backendServices{"name": "be-ilb","backends": [  {    "group": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-a/instanceGroups/ig-a",    "balancingMode": "CONNECTION"  },  {    "group": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-c/instanceGroups/ig-c",    "balancingMode": "CONNECTION"  }],"healthChecks": [  "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/healthChecks/hc-http-80"],"loadBalancingScheme": "INTERNAL","connectionDraining": {  "drainingTimeoutSec": 0 }}

Create the forwarding rule by making aPOST request to theforwardingRules.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/forwardingRules{"name": "fr-ilb","IPAddress": "10.1.2.99","IPProtocol": "TCP","ports": [  "80", "8008", "8080", "8088"],"loadBalancingScheme": "INTERNAL","subnetwork": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/subnetworks/lb-subnet","network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/lb-network","backendService": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/backendServices/be-ilb","networkTier": "PREMIUM"}

Console

1. In the Google Cloud console, go to theVM instances page.

   Go to VM instances

2. ClickCreate instance.

3. ForName, entervm-client.

4. ForRegion, selectus-west1.

5. ForZone, selectus-west1-a.

6. ClickAdvanced options.

7. ClickNetworking and configure the following fields:

   1. ForNetwork tags, enterallow-ssh.
   2. ForNetwork interfaces, select the following:
      • Network:lb-network
      • Subnet:lb-subnet

8. ClickCreate.

gcloud

The client VM can be in any zone in the same region as theload balancer, and it can use any subnet in that region. In this example,the client is in theus-west1-a zone, and it uses the samesubnet as the backend VMs.

gcloud compute instances create vm-client \    --zone=us-west1-a \    --image-family=debian-12 \    --image-project=debian-cloud \    --tags=allow-ssh \    --subnet=lb-subnet

API

Make aPOST request to theinstances.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-a/instances{ "name": "vm-client", "tags": {   "items": [     "allow-ssh"   ] }, "machineType": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-a/machineTypes/e2-standard-2", "canIpForward": false, "networkInterfaces": [   {     "network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/lb-network",     "subnetwork": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/subnetworks/lb-subnet",     "accessConfigs": [       {         "type": "ONE_TO_ONE_NAT",         "name": "external-nat",         "networkTier": "PREMIUM"       }     ]   } ], "disks": [   {     "type": "PERSISTENT",     "boot": true,     "mode": "READ_WRITE",     "autoDelete": true,     "deviceName": "vm-client",     "initializeParams": {       "sourceImage": "projects/debian-cloud/global/images/debian-image-name",       "diskType": "projects/PROJECT_ID/zones/us-west1-a/diskTypes/pd-standard",       "diskSizeGb": "10"     }   } ], "scheduling": {   "preemptible": false }, "deletionProtection": false}

Console

1. In the Google Cloud console, go to theVPC networks page.

   Go to VPC networks

2. Clickadd_boxCreate VPC network.

3. ForName, enterlb-network-dual-stack.

4. If you want to configure internal IPv6 address ranges on subnets in thisnetwork, complete these steps:

   1. ForPrivate IPv6 address settings, selectConfigure a ULAinternal IPv6 range for this VPC Network.
   2. ForAllocate internal IPv6 range, selectAutomatically orManually.If you selectManually, enter a/48 range from within thefd20::/20 range. If the range is in use, you are prompted to providea different range.

5. ForSubnet creation mode, selectCustom.

6. In theNew subnet section, specify the following configurationparameters for a subnet:

   • Name:lb-subnet
   • Region:us-west1
   • IP stack type:IPv4 and IPv6 (dual-stack)
   • IPv4 range:10.1.2.0/24.
   • IPv6 access type:Internal

7. ClickDone.

8. ClickAdd subnet and enter the following information:

   • Name:europe-subnet
   • Region:europe-west1
   • IP stack type:IPv4 (single-stack)
   • IP address range:10.3.4.0/24

9. ClickDone.

10. ClickCreate.

gcloud

1. To create a new custom mode VPC network, run thegcloud compute networks create command.

   To configureinternal IPv6 ranges on any subnets in this network, use the--enable-ula-internal-ipv6 flag. This option assigns a/48 ULA prefixfrom within thefd20::/20 range used by Google Cloud forinternal IPv6 subnet ranges. If you want to select the/48 IPv6 rangethat is assigned, use the--internal-ipv6-range flag to specify a range.

   gcloud compute networks create lb-network-dual-stack \   --subnet-mode=custom \   --enable-ula-internal-ipv6 \   --internal-ipv6-range=ULA_IPV6_RANGE \   --bgp-routing-mode=regional

   ReplaceULA_IPV6_RANGE with a/48 prefix from within thefd20::/20 range used by Google for internal IPv6 subnet ranges. If youdon't use the--internal-ipv6-range flag, Google selects a/48 prefixfor the network, such asfd20:bc7:9a1c::/48.

2. Within theNETWORK network, create a subnet for backendsin theus-west1 region and another subnet for testing global access intheeurope-west1 region.

   To create the subnets, run thegcloud compute networks subnets create command.

   gcloud compute networks subnets create lb-subnet \   --network=lb-network-dual-stack \   --range=10.1.2.0/24 \   --region=us-west1 \   --stack-type=IPV4_IPV6 \   --ipv6-access-type=INTERNAL

   gcloud compute networks subnets create europe-subnet \   --network=lb-network-dual-stack \   --range=10.3.4.0/24 \   --region=europe-west1 \   --stack-type=IPV4_IPV6 \   --ipv6-access-type=INTERNAL

API

Create a new custom mode VPC network.

To configureinternal IPv6 ranges on any subnets in thisnetwork, setenableUlaInternalIpv6 to true. This option assigns a/48range from within thefd20::/20 range used by Google for internal IPv6subnet ranges. If you want to select which/48 IPv6 range that is assigned,also use theinternalIpv6Range field to specify a range.

 POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks {   "autoCreateSubnetworks": false,   "name": "lb-network-dual-stack",   "mtu":MTU,   "enableUlaInternalIpv6": true,   "internalIpv6Range": "ULA_IPV6_RANGE",   "routingConfig": {   "routingMode": "DYNAMIC_ROUTING_MODE"  } }

Replace the following:

• PROJECT_ID: the ID of the project where the VPCnetwork is created.
• MTU: the maximum transmission unit of the network. MTU caneither be1460 (default) or1500. Review themaximum transmissionunit overview before setting the MTU to1500.
• ULA_IPV6_RANGE: a/48 prefix from within thefd20::/20 range used by Google for internal IPv6 subnet ranges. If youdon't provide a value forinternalIpv6Range, Google selects a/48 prefixfor the network.

• DYNAMIC_ROUTING_MODE: eitherglobal orregional tocontrol the route advertisement behavior of Cloud Routers in thenetwork. For more information, refer todynamic routingmode.

  For more information, refer to thenetworks.insert method.

Make twoPOST requests to thesubnetworks.insert method.

 POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/subnetworks {   "ipCidrRange": "10.1.2.0/24",   "network": "lb-network-dual-stack",   "name": "lb-subnet"   "stackType": IPV4_IPV6,   "ipv6AccessType": Internal }

 POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/subnetworks {   "ipCidrRange": "10.3.4.0/24",   "network": "lb-network-dual-stack",   "name": "europe-subnet"   "stackType": IPV4_IPV6,   "ipv6AccessType": Internal }

Console

1. In the Google Cloud console, go to theFirewall policies page.

   Go to Firewall policies

2. To create the rule to allow subnet traffic, clickCreate firewall rule and enter the following information:

   • Name:fw-allow-lb-access
   • Network:lb-network-dual-stack
   • Priority:1000
   • Direction of traffic:ingress
   • Action on match:allow
   • Targets:All instances in the network
   • Source filter:IPv4 ranges
   • Source IPv4 ranges:10.1.2.0/24 and10.3.4.0/24
   • Protocols and ports:Allow all

3. ClickCreate.

4. To allow IPv6 subnet traffic, clickCreate firewall rule again and enter the following information:

   • Name:fw-allow-lb-access-ipv6
   • Network:lb-network-dual-stack
   • Priority:1000
   • Direction of traffic:ingress
   • Action on match:allow
   • Targets:All instances in the network
   • Source filter:IPv6 ranges
   • Source IPv6 ranges:IPV6_ADDRESS assigned in thelb-subnet
   • Protocols and ports:Allow all

5. ClickCreate.

6. To allow incoming SSH connections, clickCreate firewall rule againand enter the following information:

   • Name:fw-allow-ssh
   • Network:lb-network-dual-stack
   • Priority:1000
   • Direction of traffic:ingress
   • Action on match:allow
   • Targets:Specified target tags
   • Target tags:allow-ssh
   • Source filter:IPv4 ranges
   • Source IPv4 ranges:0.0.0.0/0
   • Protocols and ports: SelectSpecified protocols and ports,select theTCP checkbox, and then enter22 inPorts.

7. ClickCreate.

8. To allow Google Cloud IPv6 health checks, clickCreate firewall rule again and enter the following information:

   • Name:fw-allow-health-check-ipv6
   • Network:lb-network-dual-stack
   • Priority:1000
   • Direction of traffic:ingress
   • Action on match:allow
   • Targets:Specified target tags
   • Target tags:allow-health-check-ipv6
   • Source filter:IPv6 ranges
   • Source IPv6 ranges:2600:2d00:1:b029::/64
   • Protocols and ports:Allow all

9. ClickCreate.

10. To allow Google Cloud health checks, clickCreate firewall ruleagain and enter the following information:

    • Name:fw-allow-health-check
    • Network:lb-network-dual-stack
    • Priority:1000
    • Direction of traffic:ingress
    • Action on match:allow
    • Targets:Specified target tags
    • Target tags:allow-health-check
    • Source filter:IPv4 ranges
    • Source IPv4 ranges:130.211.0.0/22 and35.191.0.0/16
    • Protocols and ports:Allow all

11. ClickCreate.

gcloud

1. Create thefw-allow-lb-access firewall rule to allow communicationwith the subnet:

   gcloud compute firewall-rules create fw-allow-lb-access \    --network=lb-network-dual-stack \    --action=allow \    --direction=ingress \    --source-ranges=10.1.2.0/24,10.3.4.0/24 \    --rules=all

2. Create thefw-allow-lb-access-ipv6 firewall rule to allow communicationwith the subnet:

   gcloud compute firewall-rules create fw-allow-lb-access-ipv6 \    --network=lb-network-dual-stack \    --action=allow \    --direction=ingress \    --source-ranges=IPV6_ADDRESS \    --rules=all

   ReplaceIPV6_ADDRESS with the IPv6 address assignedin thelb-subnet.

3. Create thefw-allow-ssh firewall rule to allow SSH connectivity toVMs with the network tagallow-ssh. When you omitsource-ranges,Google Cloudinterprets the rule to mean anysource.

   gcloud compute firewall-rules create fw-allow-ssh \    --network=lb-network-dual-stack \    --action=allow \    --direction=ingress \    --target-tags=allow-ssh \    --rules=tcp:22

4. Create thefw-allow-health-check-ipv6 rule to allowGoogle Cloud IPv6 health checks.

   gcloud compute firewall-rules create fw-allow-health-check-ipv6 \    --network=lb-network-dual-stack \    --action=allow \    --direction=ingress \    --target-tags=allow-health-check-ipv6 \    --source-ranges=2600:2d00:1:b029::/64 \    --rules=tcp,udp

5. Create thefw-allow-health-check rule to allow Google Cloudhealth checks.

   gcloud compute firewall-rules create fw-allow-health-check \    --network=lb-network-dual-stack \    --action=allow \    --direction=ingress \    --target-tags=allow-health-check \    --source-ranges=130.211.0.0/22,35.191.0.0/16 \    --rules=tcp,udp,icmp

API

1. Create thefw-allow-lb-access firewall rule by making aPOST request tothefirewalls.insert method.

   POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls{"name": "fw-allow-lb-access","network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/lb-network-dual-stack","priority": 1000,"sourceRanges": [  "10.1.2.0/24", "10.3.4.0/24"],"allowed": [  {    "IPProtocol": "tcp"  },  {    "IPProtocol": "udp"  },  {    "IPProtocol": "icmp"  }],"direction": "INGRESS","logConfig": {  "enable": false},"disabled": false}

2. Create thefw-allow-lb-access-ipv6 firewall rule by making aPOST request tothefirewalls.insert method.

   POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls{ "name": "fw-allow-lb-access-ipv6", "network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/lb-network-dual-stack", "priority": 1000, "sourceRanges": [   "IPV6_ADDRESS" ], "allowed": [   {      "IPProtocol": "tcp"    },    {      "IPProtocol": "udp"    },    {      "IPProtocol": "icmp"    } ], "direction": "INGRESS", "logConfig": {    "enable": false }, "disabled": false}

   ReplaceIPV6_ADDRESS with the IPv6 address assigned in thelb-subnet.

3. Create thefw-allow-ssh firewall rule by making aPOST request tothefirewalls.insert method.

   POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls{"name": "fw-allow-ssh",     "network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/lb-network-dual-stack","priority": 1000,"sourceRanges": [  "0.0.0.0/0"],"targetTags": [  "allow-ssh"],"allowed": [ {   "IPProtocol": "tcp",   "ports": [     "22"   ] }],"direction": "INGRESS","logConfig": { "enable": false},"disabled": false}

4. Create thefw-allow-health-check-ipv6 firewall rule by making aPOST request tothefirewalls.insert method.

   POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls{"name": "fw-allow-health-check-ipv6","network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/lb-network-dual-stack","priority": 1000,"sourceRanges": [  "2600:2d00:1:b029::/64"],"targetTags": [  "allow-health-check-ipv6"],"allowed": [  {    "IPProtocol": "tcp"  },  {    "IPProtocol": "udp"  }],"direction": "INGRESS","logConfig": {  "enable": false},"disabled": false}

5. Create thefw-allow-health-check firewall rule by making aPOST request tothefirewalls.insert method.

   POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls{"name": "fw-allow-health-check","network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/lb-network-dual-stack","priority": 1000,"sourceRanges": [  "130.211.0.0/22",  "35.191.0.0/16"],"targetTags": [  "allow-health-check"],"allowed": [  {    "IPProtocol": "tcp"  },  {    "IPProtocol": "udp"  },  {    "IPProtocol": "icmp"  }],"direction": "INGRESS","logConfig": {  "enable": false},"disabled": false}

Console

Create backend VMs

1. In the Google Cloud console, go to theVM instances page.

   Go to VM instances

2. Repeat steps 3 to 8 for each VM, using the following nameand zone combinations.

   • Name:vm-a1, zone:us-west1-a
   • Name:vm-a2, zone:us-west1-a
   • Name:vm-c1, zone:us-west1-c
   • Name:vm-c2, zone:us-west1-c

3. ClickCreate instance.

4. Set theName as indicated in step 2.

5. ForRegion, selectus-west1, and choose aZone asindicated in step 2.

6. In theBoot disk section, ensure thatDebian GNU/Linux 12 (bookworm) is selected for the boot diskoptions. If necessary, clickChange to change the image.

7. ClickAdvanced options.

8. ClickNetworking and configure the following fields:

   1. ForNetwork tags, enterallow-ssh andallow-health-check-ipv6.
   2. ForNetwork interfaces, select the following:
      • Network:lb-network-dual-stack
      • Subnet:lb-subnet
      • IP stack type:IPv4 and IPv6 (dual-stack)
      • Primary internal IPv4 address:Ephemeral (automatic)
      • External IPv4 address:Ephemeral

   3. ClickManagement, and then in theStartup script field, enter the following script. The script contents are identical for all four VMs.

      #! /bin/bashif [ -f /etc/startup_script_completed ]; thenexit 0fiapt-get updateapt-get install apache2 -ya2ensite default-ssla2enmod sslfile_ports="/etc/apache2/ports.conf"file_http_site="/etc/apache2/sites-available/000-default.conf"file_https_site="/etc/apache2/sites-available/default-ssl.conf"http_listen_prts="Listen 80\nListen 8008\nListen 8080\nListen 8088"http_vh_prts="*:80 *:8008 *:8080 *:8088"https_listen_prts="Listen 443\nListen 8443"https_vh_prts="*:443 *:8443"vm_hostname="$(curl -H "Metadata-Flavor:Google" \http://metadata.google.internal/computeMetadata/v1/instance/name)"echo "Page served from: $vm_hostname" | \tee /var/www/html/index.htmlprt_conf="$(cat "$file_ports")"prt_conf_2="$(echo "$prt_conf" | sed "s|Listen 80|${http_listen_prts}|")"prt_conf="$(echo "$prt_conf_2" | sed "s|Listen 443|${https_listen_prts}|")"echo "$prt_conf" | tee "$file_ports"http_site_conf="$(cat "$file_http_site")"http_site_conf_2="$(echo "$http_site_conf" | sed "s|*:80|${http_vh_prts}|")"echo "$http_site_conf_2" | tee "$file_http_site"https_site_conf="$(cat "$file_https_site")"https_site_conf_2="$(echo "$https_site_conf" | sed "s|_default_:443|${https_vh_prts}|")"echo "$https_site_conf_2" | tee "$file_https_site"systemctl restart apache2touch /etc/startup_script_completed

9. ClickCreate.

Create instance groups

1. In the Google Cloud console, go to theInstance groups page.

   Go to Instance groups

2. Repeat the following steps to create two unmanaged instance groups eachwith two VMs in them, using these combinations.

   • Instance group name:ig-a, zone:us-west1-a, VMs:vm-a1 andvm-a2
   • Instance group name:ig-c, zone:us-west1-c, VMs:vm-c1 andvm-c2

3. ClickCreate instance group.

4. ClickNew unmanaged instance group.

5. SetName as indicated in step 2.

6. In theLocation section, selectus-west1 for theRegion, andthen choose aZone as indicated in step 2.

7. ForNetwork, selectlb-network-dual-stack.

8. ForSubnetwork, selectlb-subnet.

9. In theVM instances section, add the VMs as indicated in step 2.

10. ClickCreate.

gcloud

1. To create the four VMs, run thegcloud compute instances create command four times, usingthese four combinations for[VM-NAME] and[ZONE]. The script contentsare identical for all four VMs.

   • VM-NAME:vm-a1,ZONE:us-west1-a
   • VM-NAME:vm-a2,ZONE:us-west1-a
   • VM-NAME:vm-c1,ZONE:us-west1-c

   • VM-NAME:vm-c2,ZONE:us-west1-c

     gcloud compute instances createVM-NAME \  --zone=ZONE \  --image-family=debian-12 \  --image-project=debian-cloud \  --tags=allow-ssh,allow-health-check-ipv6 \  --subnet=lb-subnet \  --stack-type=IPV4_IPV6 \  --metadata=startup-script='#! /bin/bashif [ -f /etc/startup_script_completed ]; thenexit 0fiapt-get updateapt-get install apache2 -ya2ensite default-ssla2enmod sslfile_ports="/etc/apache2/ports.conf"file_http_site="/etc/apache2/sites-available/000-default.conf"file_https_site="/etc/apache2/sites-available/default-ssl.conf"http_listen_prts="Listen 80\nListen 8008\nListen 8080\nListen 8088"http_vh_prts="*:80 *:8008 *:8080 *:8088"https_listen_prts="Listen 443\nListen 8443"https_vh_prts="*:443 *:8443"vm_hostname="$(curl -H "Metadata-Flavor:Google" \http://metadata.google.internal/computeMetadata/v1/instance/name)"echo "Page served from: $vm_hostname" | \tee /var/www/html/index.htmlprt_conf="$(cat "$file_ports")"prt_conf_2="$(echo "$prt_conf" | sed "s|Listen 80|${http_listen_prts}|")"prt_conf="$(echo "$prt_conf_2" | sed "s|Listen 443|${https_listen_prts}|")"echo "$prt_conf" | tee "$file_ports"http_site_conf="$(cat "$file_http_site")"http_site_conf_2="$(echo "$http_site_conf" | sed "s|*:80|${http_vh_prts}|")"echo "$http_site_conf_2" | tee "$file_http_site"https_site_conf="$(cat "$file_https_site")"https_site_conf_2="$(echo "$https_site_conf" | sed "s|_default_:443|${https_vh_prts}|")"echo "$https_site_conf_2" | tee "$file_https_site"systemctl restart apache2touch /etc/startup_script_completed'

2. Create the two unmanaged instance groups in each zone:

   gcloud compute instance-groups unmanaged create ig-a \    --zone=us-west1-agcloud compute instance-groups unmanaged create ig-c \    --zone=us-west1-c

3. Add the VMs to the appropriate instance groups:

   gcloud compute instance-groups unmanaged add-instances ig-a \    --zone=us-west1-a \    --instances=vm-a1,vm-a2gcloud compute instance-groups unmanaged add-instances ig-c \    --zone=us-west1-c \    --instances=vm-c1,vm-c2

api

For the four VMs, use the following VM names and zones:

• VM-NAME:vm-a1,ZONE:us-west1-a
• VM-NAME:vm-a2,ZONE:us-west1-a
• VM-NAME:vm-c1,ZONE:us-west1-c
• VM-NAME:vm-c2,ZONE:us-west1-c

You can get the currentDEBIAN_IMAGE_NAME by running thefollowinggcloud command:

gcloud compute images list \ --filter="family=debian-12"

Create four backend VMs by making fourPOST requests to theinstances.insert method:

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances{ "name": "VM-NAME", "tags": {   "items": [     "allow-health-check-ipv6",     "allow-ssh"   ] }, "machineType": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/[ZONE]/machineTypes/e2-standard-2", "canIpForward": false, "networkInterfaces": [   {     "stackType": "IPV4_IPV6",     "network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/lb-network-dual-stack",     "subnetwork": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/subnetworks/lb-subnet",     "accessConfigs": [       {         "type": "ONE_TO_ONE_NAT",         "name": "external-nat",         "networkTier": "PREMIUM"       }     ]   } ], "disks": [   {     "type": "PERSISTENT",     "boot": true,     "mode": "READ_WRITE",     "autoDelete": true,     "deviceName": "VM-NAME",     "initializeParams": {       "sourceImage": "projects/debian-cloud/global/images/debian-image-name",       "diskType": "projects/PROJECT_ID/zones/zone/diskTypes/pd-standard",       "diskSizeGb": "10"     }   } ], "metadata": {   "items": [     {       "key": "startup-script",       "value": "#! /bin/bash\napt-get update\napt-get install apache2 -y\na2ensite default-ssl\na2enmod ssl\nfile_ports=\"/etc/apache2/ports.conf\"\nfile_http_site=\"/etc/apache2/sites-available/000-default.conf\"\nfile_https_site=\"/etc/apache2/sites-available/default-ssl.conf\"\nhttp_listen_prts=\"Listen 80\\nListen 8008\\nListen 8080\\nListen 8088\"\nhttp_vh_prts=\"*:80 *:8008 *:8080 *:8088\"\nhttps_listen_prts=\"Listen 443\\nListen 8443\"\nhttps_vh_prts=\"*:443 *:8443\"\nvm_hostname=\"$(curl -H \"Metadata-Flavor:Google\" \\\nhttp://169.254.169.254/computeMetadata/v1/instance/name)\"\necho \"Page served from: $vm_hostname\" | \\\ntee /var/www/html/index.html\nprt_conf=\"$(cat \"$file_ports\")\"\nprt_conf_2=\"$(echo \"$prt_conf\" | sed \"s|Listen 80|${http_listen_prts}|\")\"\nprt_conf=\"$(echo \"$prt_conf_2\" | sed \"s|Listen 443|${https_listen_prts}|\")\"\necho \"$prt_conf\" | tee \"$file_ports\"\nhttp_site_conf=\"$(cat \"$file_http_site\")\"\nhttp_site_conf_2=\"$(echo \"$http_site_conf\" | sed \"s|*:80|${http_vh_prts}|\")\"\necho \"$http_site_conf_2\" | tee \"$file_http_site\"\nhttps_site_conf=\"$(cat \"$file_https_site\")\"\nhttps_site_conf_2=\"$(echo \"$https_site_conf\" | sed \"s|_default_:443|${https_vh_prts}|\")\"\necho \"$https_site_conf_2\" | tee \"$file_https_site\"\nsystemctl restart apache2"     }   ] }, "scheduling": {   "preemptible": false }, "deletionProtection": false}

Create two instance groups by making aPOST request to theinstanceGroups.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-a/instanceGroups{ "name": "ig-a", "network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/lb-network-dual-stack", "subnetwork": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/subnetworks/lb-subnet"}

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-c/instanceGroups{ "name": "ig-c", "network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/lb-network-dual-stack", "subnetwork": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/subnetworks/lb-subnet"}

Add instances to each instance group by making aPOST request to theinstanceGroups.addInstances method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-a/instanceGroups/ig-a/addInstances{ "instances": [   {     "instance": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-a/instances/vm-a1",     "instance": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-a/instances/vm-a2"   } ]}

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-c/instanceGroups/ig-c/addInstances{ "instances": [   {     "instance": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-c/instances/vm-c1",     "instance": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-c/instances/vm-c2"   } ]}

Console

Start your configuration

1. In the Google Cloud console, go to theLoad balancing page.

   Go to Load balancing

2. ClickCreate load balancer.
3. ForType of load balancer, selectNetwork Load Balancer (TCP/UDP/SSL) and clickNext.
4. ForProxy or passthrough, selectPassthrough load balancer and clickNext.
5. ForPublic facing or internal, selectInternal and clickNext.
6. ClickConfigure.

Basic configuration

On theCreate internal passthrough Network Load Balancer page, enter thefollowing information:

• Load balancer name:be-ilb
• Region:us-west1
• Network:lb-network-dual-stack

Backend configuration

1. ClickBackend configuration.
2. In theHealth check list, clickCreate a health check,and enter the following information:
   • Name:hc-http-80
   • Scope:Regional
   • Protocol:HTTP
   • Port:80
   • Proxy protocol:NONE
   • Request:/
3. ClickCreate.
4. In theNew Backend section, forIP stack type, select theIPv4 and IPv6 (dual-stack) option.
5. InInstance group, select theig-a instance group and clickDone.
6. ClickAdd a backend and repeat the step to add theig-c instancegroup.
7. Verify that a blue check mark appears next toBackend configuration.

Frontend configuration

1. ClickFrontend configuration. In theNew Frontend IP and port section, do the following:
   1. ForName, enterfr-ilb-ipv6.
   2. To handle IPv6 traffic, do the following:
      1. ForIP version, selectIPv6.
      2. ForSubnetwork, selectlb-subnet.The IPv6 address range in the forwarding rule is always ephemeral.
      3. ForPorts, selectMultiple, and then in thePort number field, enter80,8008,8080,8088.
      4. ClickDone.
   3. To handle IPv4 traffic, do the following:
      1. ClickAdd frontend IP and port.
      2. ForName, enterfr-ilb.
      3. ForSubnetwork, selectlb-subnet.
      4. In theInternal IP purpose section, from theIP address list, selectCreate IP address,enter the following information, and then clickReserve.
         • Name:ip-ilb
         • IP version:IPv4
         • Static IP address:Let me choose
         • Custom IP address:10.1.2.99
      5. ForPorts, selectMultiple, and then inPort numbers, enter80,8008,8080, and8088.
      6. ClickDone.
      7. Verify that there is a blue check mark next toFrontend configuration before continuing.

Review the configuration

1. ClickReview and finalize. Check all your settings.
2. If the settings are correct, clickCreate. It takes a few minutes forthe internal passthrough Network Load Balancer to be created.

gcloud

1. Create a new regional HTTP health check to test HTTP connectivity to theVMs on port 80.

   gcloud compute health-checks create http hc-http-80 \    --region=us-west1 \    --port=80

2. Create the backend service for HTTP traffic:

   gcloud compute backend-services create be-ilb \    --load-balancing-scheme=internal \    --protocol=tcp \    --region=us-west1 \    --health-checks=hc-http-80 \    --health-checks-region=us-west1

3. Add the two instance groups to the backend service:

   gcloud compute backend-services add-backend be-ilb \    --region=us-west1 \    --instance-group=ig-a \    --instance-group-zone=us-west1-agcloud compute backend-services add-backend be-ilb \    --region=us-west1 \    --instance-group=ig-c \    --instance-group-zone=us-west1-c

4. Create two forwarding rules for the backend service. When you create theIPv4 forwarding rule, specify10.1.2.99 for the internal IP address inthe subnet for IPv4 addresses.

   gcloud compute forwarding-rules create fr-ilb \    --region=us-west1 \    --load-balancing-scheme=internal \    --subnet=lb-subnet \    --address=10.1.2.99 \    --ip-protocol=TCP \    --ports=80,8008,8080,8088 \    --backend-service=be-ilb \    --backend-service-region=us-west1

   gcloud compute forwarding-rules create fr-ilb-ipv6 \    --region=us-west1 \    --load-balancing-scheme=internal \    --subnet=lb-subnet \    --ip-protocol=TCP \    --ports=80,8008,8080,8088 \    --backend-service=be-ilb \    --backend-service-region=us-west1 \    --ip-version=IPV6

api

Create the health check by making aPOST request to theregionHealthChecks.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/regionHealthChecks{"name": "hc-http-80","type": "HTTP","httpHealthCheck": {  "port": 80}}

Create the regional backend service by making aPOST request to theregionBackendServices.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/backendServices{"name": "be-ilb","backends": [  {    "group": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-a/instanceGroups/ig-a",    "balancingMode": "CONNECTION"  },  {    "group": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-c/instanceGroups/ig-c",    "balancingMode": "CONNECTION"  }],"healthChecks": [  "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/healthChecks/hc-http-80"],"loadBalancingScheme": "INTERNAL","connectionDraining": {  "drainingTimeoutSec": 0 }}

Create the forwarding rule by making aPOST request to theforwardingRules.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/forwardingRules{"name": "fr-ilb-ipv6","IPProtocol": "TCP","ports": [  "80", "8008", "8080", "8088"],"loadBalancingScheme": "INTERNAL","subnetwork": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/subnetworks/lb-subnet","backendService": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/backendServices/be-ilb","ipVersion": "IPV6","networkTier": "PREMIUM"}

Create the forwarding rule by making aPOST request to theforwardingRules.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/forwardingRules{"name": "fr-ilb","IPAddress": "10.1.2.99","IPProtocol": "TCP","ports": [  "80", "8008", "8080", "8088"],"loadBalancingScheme": "INTERNAL","subnetwork": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/subnetworks/lb-subnet","backendService": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/backendServices/be-ilb","networkTier": "PREMIUM"}

Console

1. In the Google Cloud console, go to theVM instances page.

   Go to VM instances

2. ClickCreate instance.

3. ForName, entervm-client.

4. ForRegion, selectus-west1.

5. ForZone, selectus-west1-a.

6. ClickAdvanced options.

7. ClickNetworking and configure the following fields:

   1. ForNetwork tags, enterallow-ssh.
   2. ForNetwork interfaces, select the following:
      • Network:lb-network-dual-stack
      • Subnet:lb-subnet
      • IP stack type:IPv4 and IPv6 (dual-stack)
      • Primary internal IP:Ephemeral (automatic)
      • External IP:Ephemeral
   3. ClickDone.

8. ClickCreate.

gcloud

The client VM can be in any zone in the same region as theload balancer, and it can use any subnet in that region. In this example,the client is in theus-west1-a zone, and it uses the samesubnet as the backend VMs.

gcloud compute instances create vm-client \    --zone=us-west1-a \    --image-family=debian-12 \    --image-project=debian-cloud \    --stack-type=IPV4_IPV6 \    --tags=allow-ssh \    --subnet=lb-subnet

api

Make aPOST request to theinstances.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-a/instances{ "name": "vm-client", "tags": {   "items": [     "allow-ssh"   ] }, "machineType": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-a/machineTypes/e2-standard-2", "canIpForward": false, "networkInterfaces": [   {     "stackType": "IPV4_IPV6",     "network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/lb-network-dual-stack",     "subnetwork": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/subnetworks/lb-subnet",     "accessConfigs": [       {         "type": "ONE_TO_ONE_NAT",         "name": "external-nat",         "networkTier": "PREMIUM"       }     ]   } ], "disks": [   {     "type": "PERSISTENT",     "boot": true,     "mode": "READ_WRITE",     "autoDelete": true,     "deviceName": "vm-client",     "initializeParams": {       "sourceImage": "projects/debian-cloud/global/images/debian-image-name",       "diskType": "projects/PROJECT_ID/zones/us-west1-a/diskTypes/pd-standard",       "diskSizeGb": "10"     }   } ], "scheduling": {   "preemptible": false }, "deletionProtection": false}

Console

1. In the Google Cloud console, go to theVPC networks page.

   Go to VPC networks

2. ClickCreate VPC network.

3. ForName, enterlb-network-ipv6-only.

4. If you want to configure internal IPv6 address ranges on subnets in thisnetwork, complete these steps:

   1. ForPrivate IPv6 address settings, selectConfigure a ULAinternal IPv6 range for this VPC Network.
   2. ForAllocate internal IPv6 range, selectAutomatically orManually.If you selectManually, enter a/48 range from within thefd20::/20 range. If the range is already in use, you are prompted toprovide a different range.

5. ForSubnet creation mode, selectCustom.

6. In theNew subnet section, specify the following configurationparameters for a subnet:

   • Name:lb-subnet-ipv6-only
   • Region:us-west1
   • IP stack type:IPv6 (single-stack)
   • IPv6 access type:Internal

7. ClickDone.

8. ClickCreate.

gcloud

1. To create a new custom mode VPC network, run thegcloud compute networks create command.

   To configureinternal IPv6 rangeson any subnets in this network, use the--enable-ula-internal-ipv6 flag.

   gcloud compute networks create lb-network-ipv6-only \  --subnet-mode=custom \  --enable-ula-internal-ipv6 \  --bgp-routing-mode=regional

2. Configure a subnet with theipv6-access-type set toINTERNAL.This indicates that the VMs in this subnet can only haveinternal IPv6 addresses.To create the subnet, run thegcloud compute networks subnets create command.

   gcloud compute networks subnets create lb-subnet-ipv6-only \  --network=lb-network-ipv6-only \  --region=us-west1 \  --stack-type=IPV6_ONLY \  --ipv6-access-type=INTERNAL

Console

1. In the Google Cloud console, go to theFirewall policies page.

   Go to Firewall policies

2. To allow IPv6 subnet traffic, clickCreate firewall rule again andenter the following information:

   • Name:fw-allow-lb-access-ipv6-only
   • Network:lb-network-ipv6-only
   • Priority:1000
   • Direction of traffic:Ingress
   • Action on match:Allow
   • Targets:All instances in the network
   • Source filter:IPv6 ranges
   • Source IPv6 ranges:::/0
   • Protocols and ports:Allow all

3. ClickCreate.

4. To allow incoming SSH connections, clickCreate firewall rule againand enter the following information:

   • Name:fw-allow-ssh
   • Network:lb-network-ipv6-only
   • Priority:1000
   • Direction of traffic:Ingress
   • Action on match:Allow
   • Targets:Specified target tags
   • Target tags:allow-ssh
   • Source filter:IPv4 ranges
   • Source IPv4 ranges:0.0.0.0/0
   • Protocols and ports: SelectSpecified protocols and ports,select theTCP checkbox, and then enter22 inPorts.

5. ClickCreate.

6. To allow Google Cloud IPv6 health checks, clickCreate firewallrule again and enter the following information:

   • Name:fw-allow-health-check-ipv6-only
   • Network:lb-network-ipv6-only
   • Priority:1000
   • Direction of traffic:Ingress
   • Action on match:Allow
   • Targets:Specified target tags
   • Target tags:allow-health-check-ipv6
   • Source filter:IPv6 ranges
   • Source IPv6 ranges:2600:2d00:1:b029::/64
   • Protocols and ports:Allow all

7. ClickCreate.

gcloud

1. Create thefw-allow-lb-access-ipv6-only firewall ruleto allow IPv6 traffic to all VM instances in theVPC network.

   gcloud compute firewall-rules create fw-allow-lb-access-ipv6-only \    --network=lb-network-ipv6-only \    --action=allow \    --direction=ingress \    --source-ranges=::/0 \    --rules=all

2. Create thefw-allow-ssh firewall rule to allow SSH connectivity toVMs with the network tagallow-ssh. When you omitsource-ranges,Google Cloudinterprets the rule to mean anysource.

   gcloud compute firewall-rules create fw-allow-ssh \    --network=lb-network-ipv6-only \    --action=allow \    --direction=ingress \    --target-tags=allow-ssh \    --rules=tcp:22

3. Create thefw-allow-health-check-ipv6 rule to allowGoogle Cloud IPv6 health checks.

   gcloud compute firewall-rules create fw-allow-health-check-ipv6-only \    --network=lb-network-ipv6-only \    --action=allow \    --direction=ingress \    --target-tags=allow-health-check-ipv6 \    --source-ranges=2600:2d00:1:b029::/64 \    --rules=tcp,udp

Console

Create backend VMs

1. In the Google Cloud console, go to theVM instances page.

   Go to VM instances

2. Repeat these steps for each VM, using the following nameand zone combinations.

   • Name:vm-a1, zone:us-west1-a
   • Name:vm-a2, zone:us-west1-a
   • Name:vm-c1, zone:us-west1-c
   • Name:vm-c2, zone:us-west1-c

3. ClickCreate instance.

4. Set theName as indicated in step 2.

5. ForRegion, selectus-west1, and choose aZone asindicated in step 2.

6. In theBoot disk section, ensure thatDebian GNU/Linux 12 (bookworm) is selected for the boot diskoptions. If necessary, clickChange to change the image.

7. ClickAdvanced options.

8. ClickNetworking and configure the following fields:

   1. ForNetwork tags, enterallow-ssh andallow-health-check-ipv6.
   2. ForNetwork interfaces, select the following:
      • Network:lb-network-ipv6-only
      • Subnet:lb-subnet-ipv6-only
      • IP stack type:IPv6 (single-stack)
      • Primary internal IPv6 address:Ephemeral (Automatic)

9. ClickCreate.

The backend VM needs to run an IPv6 TCP server that listens forincoming connections. Youinstall this server on the backend VMs after you have configured the load balancer. This isbecause the server script creates a socket that binds to the forwarding ruleof the load balancer.

Create instance groups

1. In the Google Cloud console, go to theInstance groups page.

   Go to Instance groups

2. Repeat the following steps to create two unmanaged instance groups eachwith two VMs in them, using these combinations.

   • Instance group name:ig-a, zone:us-west1-a, VMs:vm-a1 andvm-a2
   • Instance group name:ig-c, zone:us-west1-c, VMs:vm-c1 andvm-c2

3. ClickCreate instance group.

4. ClickNew unmanaged instance group.

5. SetName as indicated in step 2.

6. In theLocation section, selectus-west1 for theRegion, andthen choose aZone as indicated in step 2.

7. ForNetwork, selectlb-network-ipv6-only.

8. ForSubnetwork, selectlb-subnet-ipv6-only.

9. In theVM instances section, add the VMs as indicated in step 2.

10. ClickCreate.

gcloud

1. To create the four VMs, run thegcloud compute instances create command four times, usingthese four combinations for[VM-NAME] and[ZONE].

   • VM-NAME:vm-a1,ZONE:us-west1-a
   • VM-NAME:vm-a2,ZONE:us-west1-a
   • VM-NAME:vm-c1,ZONE:us-west1-c
   • VM-NAME:vm-c2,ZONE:us-west1-c

   gcloud beta compute instances createVM-NAME \    --zone=ZONE \    --image-family=debian-12 \    --image-project=debian-cloud \    --tags=allow-ssh,allow-health-check-ipv6 \    --subnet=lb-subnet-ipv6-only \    --stack-type=IPV6_ONLY

   The backend VM needs to run an IPv6 TCP server that listens forincoming connections. Youinstall this server on the backend VMs after you have configured the load balancer. This isbecause the server script creates a socket that binds to the forwarding ruleof the load balancer.

2. Create the two unmanaged instance groups in each zone:

   gcloud beta compute instance-groups unmanaged create ig-a \    --zone=us-west1-agcloud beta compute instance-groups unmanaged create ig-c \    --zone=us-west1-c

3. Add the VMs to the appropriate instance groups:

   gcloud beta compute instance-groups unmanaged add-instances ig-a \  --zone=us-west1-a \  --instances=vm-a1,vm-a2gcloud beta compute instance-groups unmanaged add-instances ig-c \  --zone=us-west1-c \  --instances=vm-c1,vm-c2

Console

Start your configuration

1. In the Google Cloud console, go to theLoad balancing page.

   Go to Load balancing

2. ClickCreate load balancer.
3. ForType of load balancer, selectNetwork Load Balancer (TCP/UDP/SSL) and clickNext.
4. ForProxy or passthrough, selectPassthrough load balancer and clickNext.
5. ForPublic facing or internal, selectInternal and clickNext.
6. ClickConfigure.

Basic configuration

On theCreate internal passthrough Network Load Balancer page, enter thefollowing information:

• Load balancer name:ilb-ipv6-only
• Region:us-west1
• Network:lb-network-ipv6-only

Backend configuration

1. ClickBackend configuration.
2. In theHealth check list, clickCreate a health check,and then enter the following information:
   • Name:hc-http-80
   • Scope:Regional
   • Protocol:HTTP
   • Port:80
   • Proxy protocol:None
   • Request:/
3. ClickCreate.
4. In theNew Backend section, forIP stack type, select theIPv6 (single-stack) option.
5. InInstance group, select theig-a instance group and clickDone.
6. ClickAdd a backend and repeat the step to add theig-c instancegroup.
7. Verify that a blue check mark appears next toBackendconfiguration.

Frontend configuration

1. ClickFrontend configuration. In theNew Frontend IP and portsection, do the following:
   1. ForName, enterfr-ilb-ipv6-only.
   2. To handle IPv6 traffic, do the following:
      1. ForIP version, selectIPv6. The IPv6 TCP server that youare going to create in the following section binds to the VIP ofthe forwarding rule.
      2. ForSubnetwork, selectlb-subnet-ipv6-only. The IPv6 addressrange in the forwarding rule is always ephemeral.
      3. ForPorts, selectMultiple, and then in thePortnumber field, enter80,8008,8080,8088.
      4. ClickDone.
   3. Verify that there is a blue check mark next toFrontendconfiguration before continuing.

Review the configuration

1. ClickReview and finalize. Check all your settings.
2. If the settings are correct, clickCreate. It takes a few minutes forthe internal passthrough Network Load Balancer to be created.

gcloud

1. Create a new regional HTTP health check to test HTTP connectivity to theVMs on port 80.

   gcloud beta compute health-checks create http hc-http-80 \    --region=us-west1 \    --port=80

2. Create the backend service:

   gcloud beta compute backend-services create ilb-ipv6-only \    --load-balancing-scheme=INTERNAL \    --protocol=tcp \    --region=us-west1 \    --health-checks=hc-http-80 \    --health-checks-region=us-west1

3. Add the two instance groups to the backend service:

   gcloud beta compute backend-services add-backend ilb-ipv6-only \    --region=us-west1 \    --instance-group=ig-a \    --instance-group-zone=us-west1-a

   gcloud beta compute backend-services add-backend ilb-ipv6-only \    --region=us-west1 \    --instance-group=ig-c \    --instance-group-zone=us-west1-c

4. Create the IPv6 forwarding rule with an ephemeral IPv6 address.

   gcloud beta compute forwarding-rules create fr-ilb-ipv6-only \    --region=us-west1 \    --load-balancing-scheme=INTERNAL \    --subnet=lb-subnet-ipv6-only \    --ip-protocol=TCP \    --ports=80,8008,8080,8088 \    --backend-service=ilb-ipv6-only \    --backend-service-region=us-west1 \    --ip-version=IPV6

   The IPv6 TCP server that you are going to create in the following sectionbinds to the VIP of the forwarding rule.

1. In the list of VM instances that you created earlier, click the VM instancethat you need to update.

2. ClickEdit.

3. In theMetadata section, enter the following script in theStartup script field.

   Note: The server scriptserver.py referenced in the Bash scriptis stored in the root folder of your backend VM.

   #!/bin/bash# Replace these with your actual values. Run the 'ip -6 route show table all' command to find the correct values.GATEWAY_ADDRESS=fe80::57:2ff:fe36:ffbeSUBNET_RANGE=fd20:307:120c:2000::/64# Add a custom default route to routing table 1.# The following command sends packets to the gateway using the network interface named 'ens4'.sudo ip route add default via $GATEWAY_ADDRESS dev ens4 table 1# Add a source-based policy routing rule.# The following command adds a rule to route all outgoing packets originating# from a specified subnet. If the source address matches the subnet,# the system uses the default route defined in table 1 to forward the traffic.sudo ip -6 rule add from $SUBNET_RANGE table 1# Allow the server to bind to a non-local IPv6 address--the VIP of the load balancer.sudo sysctl -w net.ipv6.ip_nonlocal_bind=1# Overview:# This script sets up a simple IPv6 TCP server using Python's socket library.# The server binds to a specific network interface and listens on a specified Virtual IP (VIP) address and port (default: 80).# It accepts incoming client connections, sends a simple response ("Thank you for connecting"), and then closes the connection.# Key features:# - Uses IPv6 (AF_INET6) for networking.# - Binds to a specific network interface using SO_BINDTODEVICE.# - Handles multiple client connections in a loop.# - Demonstrates basic socket programming concepts like binding, listening, accepting, and sending data.# Note: Replace placeholders like 'FORWARDING_RULE_VIP' and 'ens4' with actual values for your setup.# Write the Python file locally.cat<< 'EOF' > server.py# Import the socket library to work with network connectionsimport socketimport urllib.request# Fetch the VM hostname from Google Cloud metadata serverdef get_vm_hostname():    url = "http://metadata.google.internal/computeMetadata/v1/instance/name"    req = urllib.request.Request(url, headers={"Metadata-Flavor": "Google"})    with urllib.request.urlopen(req) as response:        return response.read().decode()vm_hostname = get_vm_hostname()# Create a socket object for IPv6 and TCP connections# AF_INET6 specifies IPv6, SOCK_STREAM specifies TCPserver_socket = socket.socket(socket.AF_INET6, socket.SOCK_STREAM)# Set the SO_REUSEADDR option to allow reusing the address# This is useful to avoid "address already in use" errors when restarting the serverserver_socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)# Specify the network interface to bind the server to# Replace "ens4" with the name of your network interfaceinterface_name = "ens4"# Get the index of the network interfaceinterface_index = socket.if_nametoindex(interface_name)# Bind the socket to the specified network interfaceserver_socket.setsockopt(socket.SOL_SOCKET, socket.SO_BINDTODEVICE, interface_name.encode())# Bind the socket to an address and port# Replace 'FORWARDING_RULE_VIP' with the actual VIP (Virtual IP) addressserver_address = ('FORWARDING_RULE_VIP', 80, 0, 0)server_socket.bind(server_address)# Start listening for incoming connections# The argument '5' specifies the maximum number of queued connectionsserver_socket.listen(5)# Print a message indicating that the server is ready to accept connectionsprint(f"Server listening on {server_address}, bound to {interface_name}")# Serve incoming connectionswhile True:    client_socket, client_address = server_socket.accept()    print(f"Accepted connection from {client_address}")    # Generate response body    body = f"Thank you for connecting to {vm_hostname}\n"    # Construct a proper HTTP/1.1 response    response = (        "HTTP/1.1 200 OK\r\n"        f"Content-Length: {len(body)}\r\n"        "Content-Type: text/plain\r\n"        "Connection: close\r\n"        "\r\n"        f"{body}"    )    # Send the response and close the connection    client_socket.sendall(response.encode())    client_socket.close()EOF# Make the Python script executablechmod +x server.py# Run the serversudo python3 server.py

4. ClickSave.

5. Reboot the instance.

gcloud

1. Create a startup script.

   nano startup.sh

2. Add the following script and save the file.

   Note: The server scriptserver.py referenced in the Bash scriptis stored in the root folder of your backend VM.

   #!/bin/bash# Replace these with your actual values. Run the 'ip -6 route show table all' command to find the correct values.GATEWAY_ADDRESS=fe80::57:2ff:fe36:ffbeSUBNET_RANGE=fd20:307:120c:2000::/64# Add a custom default route to routing table 1.# The following command sends packets to the gateway using the network interface named 'ens4'.sudo ip route add default via $GATEWAY_ADDRESS dev ens4 table 1# Add a source-based policy routing rule.# The following command adds a rule to route all outgoing packets originating# from a specified subnet. If the source address matches the subnet,# the system uses the default route defined in table 1 to forward the traffic.sudo ip -6 rule add from $SUBNET_RANGE table 1# Allow the server to bind to a non-local IPv6 address--the VIP of the load balancer.sudo sysctl -w net.ipv6.ip_nonlocal_bind=1# Overview:# This script sets up a simple IPv6 TCP server using Python's socket library.# The server binds to a specific network interface and listens on a specified Virtual IP (VIP) address and port (default: 80).# It accepts incoming client connections, sends a simple response ("Thank you for connecting"), and then closes the connection.# Key features:# - Uses IPv6 (AF_INET6) for networking.# - Binds to a specific network interface using SO_BINDTODEVICE.# - Handles multiple client connections in a loop.# - Demonstrates basic socket programming concepts like binding, listening, accepting, and sending data.# Note: Replace placeholders like 'FORWARDING_RULE_VIP' and 'ens4' with actual values for your setup.# Write the Python file locally.cat<< 'EOF' > server.py# Import the socket library to work with network connectionsimport socketimport urllib.request# Fetch the VM hostname from Google Cloud metadata serverdef get_vm_hostname():    url = "http://metadata.google.internal/computeMetadata/v1/instance/name"    req = urllib.request.Request(url, headers={"Metadata-Flavor": "Google"})    with urllib.request.urlopen(req) as response:        return response.read().decode()vm_hostname = get_vm_hostname()# Create a socket object for IPv6 and TCP connections# AF_INET6 specifies IPv6, SOCK_STREAM specifies TCPserver_socket = socket.socket(socket.AF_INET6, socket.SOCK_STREAM)# Set the SO_REUSEADDR option to allow reusing the address# This is useful to avoid "address already in use" errors when restarting the serverserver_socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)# Specify the network interface to bind the server to# Replace "ens4" with the name of your network interfaceinterface_name = "ens4"# Get the index of the network interfaceinterface_index = socket.if_nametoindex(interface_name)# Bind the socket to the specified network interfaceserver_socket.setsockopt(socket.SOL_SOCKET, socket.SO_BINDTODEVICE, interface_name.encode())# Bind the socket to an address and port# Replace 'FORWARDING_RULE_VIP' with the actual VIP (Virtual IP) addressserver_address = ('FORWARDING_RULE_VIP', 80, 0, 0)server_socket.bind(server_address)# Start listening for incoming connections# The argument '5' specifies the maximum number of queued connectionsserver_socket.listen(5)# Print a message indicating that the server is ready to accept connectionsprint(f"Server listening on {server_address}, bound to {interface_name}")# Serve incoming connectionswhile True:    client_socket, client_address = server_socket.accept()    print(f"Accepted connection from {client_address}")    # Generate response body    body = f"Thank you for connecting to {vm_hostname}\n"    # Construct a proper HTTP/1.1 response    response = (        "HTTP/1.1 200 OK\r\n"        f"Content-Length: {len(body)}\r\n"        "Content-Type: text/plain\r\n"        "Connection: close\r\n"        "\r\n"        f"{body}"    )    # Send the response and close the connection    client_socket.sendall(response.encode())    client_socket.close()EOF# Make the Python script executablechmod +x server.py# Run the serversudo python3 server.py

3. Add the metadata file to the VM instance.

   gcloud compute instances add-metadataVM-NAME \  --metadata-from-file=startup-script=startup.sh

4. Reboot the instance.

Console

1. In the Google Cloud console, go to theVM instances page.

   Go to VM instances

2. ClickCreate instance.

3. ForName, entervm-client.

4. ForRegion, selectus-west1.

5. ForZone, selectus-west1-a.

6. ClickAdvanced options.

7. ClickNetworking and configure the following fields:

   1. ForNetwork tags, enterallow-ssh.
   2. ForNetwork interfaces, select the following:
      • Network:lb-network-ipv6-only
      • Subnet:lb-subnet-ipv6-only
      • IP stack type:IPv6 (single-stack)
   3. ClickDone.

8. ClickCreate.

gcloud

The client VM can be in any zone in the same region as theload balancer, and it can use any subnet in that region. In this example,the client is in theus-west1-a zone, and it uses the samesubnet as the backend VMs.

gcloud beta compute instances create vm-client \    --zone=us-west1-a \    --image-family=debian-12 \    --image-project=debian-cloud \    --stack-type=IPV6_ONLY \    --tags=allow-ssh \    --subnet=lb-subnet-ipv6-only

Console

Edit the load balancer's forwarding rule

1. In the Google Cloud console, go to theLoad balancing page.

   Go to Load balancing

2. In theName column, click your internal passthrough Network Load Balancer. The example loadbalancer is namedbe-ilb.

3. ClickFrontend configuration.

4. ClickEditedit.

5. UnderGlobal access, selectEnable.

6. ClickDone.

7. ClickUpdate.

On theLoad balancer details page, verify that the frontend configurationsaysRegional (REGION) with global access.

gcloud

1. Update the example load balancer's forwarding rule,fr-ilb to includethe--allow-global-access flag.

    gcloud compute forwarding-rules update fr-ilb \     --region=us-west1 \     --allow-global-access

2. You can use theforwarding-rules describe command to determine whethera forwarding rule has global access enabled. For example:

    gcloud compute forwarding-rules describe fr-ilb \     --region=us-west1 \     --format="get(name,region,allowGlobalAccess)"

   The wordTrue appears in the output, after the name and region of theforwarding rule, when global access is enabled.

API

Make aPATCH request to theforwardingRules/patch method.

PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/forwardingRules/fr-ilb{"allowGlobalAccess": true}

Console

1. In the Google Cloud console, go to theVM instances page.

   Go to VM instances

2. ClickCreate instance.

3. Set theName tovm-client2.

4. Set theRegion toeurope-west1.

5. Set theZone toeurope-west1-b.

6. ClickAdvanced options.

7. ClickNetworking and configure the following fields:

   1. ForNetwork tags, enterallow-ssh.
   2. ForNetwork interfaces, select the following:
      • Network:lb-network
      • Subnet:europe-subnet

8. ClickCreate.

gcloud

The client VM can be in any zone in the same region as theload balancer, and it can use any subnet in that region. In this example,the client is in theeurope-west1-b zone, and it uses the samesubnet as the backend VMs.

gcloud compute instances create vm-client2 \    --zone=europe-west1-b \    --image-family=debian-12 \    --image-project=debian-cloud \    --tags=allow-ssh \    --subnet=europe-subnet

API

Make aPOST request to theinstances.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/europe-west1-b/instances{"name": "vm-client2","tags": {  "items": [    "allow-ssh"  ]},"machineType": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/europe-west1-b/machineTypes/e2-standard-2","canIpForward": false,"networkInterfaces": [  {    "network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/lb-network",    "subnetwork": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/europe-west1/subnetworks/europe-subnet",    "accessConfigs": [      {        "type": "ONE_TO_ONE_NAT",        "name": "external-nat",        "networkTier": "PREMIUM"      }    ]  }],"disks": [  {    "type": "PERSISTENT",    "boot": true,    "mode": "READ_WRITE",    "autoDelete": true,    "deviceName": "vm-client2",    "initializeParams": {      "sourceImage": "projects/debian-cloud/global/images/debian-image-name",      "diskType": "projects/PROJECT_ID/zones/europe-west1-b/diskTypes/pd-standard",      "diskSizeGb": "10"    }  }],"scheduling": {  "preemptible": false},"deletionProtection": false}

Console

Instance template

1. In the Google Cloud console, go to theVM instance templates page.

   Go to VM instance templates

2. ClickCreate instance template.

3. Set theName totemplate-vm-ilb.

4. Choose amachine type.

5. In theBoot disk section, ensure thatDebian GNU/Linux 12 (bookworm) is selected for the boot diskoptions. If necessary, clickChange to change the image.

6. ClickAdvanced options.

7. ClickNetworking and configure the following fields:

   1. ForNetwork tags, enterallow-ssh andallow-health-check.
   2. ForNetwork interfaces, select the following:
      • Network:lb-network
      • Subnet:lb-subnet

8. ClickManagement, and then in theStartup script field, enter the following script:

   #! /bin/bashif [ -f /etc/startup_script_completed ]; thenexit 0fiapt-get updateapt-get install apache2 -ya2ensite default-ssla2enmod sslfile_ports="/etc/apache2/ports.conf"file_http_site="/etc/apache2/sites-available/000-default.conf"file_https_site="/etc/apache2/sites-available/default-ssl.conf"http_listen_prts="Listen 80\nListen 8008\nListen 8080\nListen 8088"http_vh_prts="*:80 *:8008 *:8080 *:8088"https_listen_prts="Listen 443\nListen 8443"https_vh_prts="*:443 *:8443"vm_hostname="$(curl -H "Metadata-Flavor:Google" \http://metadata.google.internal/computeMetadata/v1/instance/name)"echo "Page served from: $vm_hostname" | \tee /var/www/html/index.htmlprt_conf="$(cat "$file_ports")"prt_conf_2="$(echo "$prt_conf" | sed "s|Listen 80|${http_listen_prts}|")"prt_conf="$(echo "$prt_conf_2" | sed "s|Listen 443|${https_listen_prts}|")"echo "$prt_conf" | tee "$file_ports"http_site_conf="$(cat "$file_http_site")"http_site_conf_2="$(echo "$http_site_conf" | sed "s|*:80|${http_vh_prts}|")"echo "$http_site_conf_2" | tee "$file_http_site"https_site_conf="$(cat "$file_https_site")"https_site_conf_2="$(echo "$https_site_conf" | sed "s|_default_:443|${https_vh_prts}|")"echo "$https_site_conf_2" | tee "$file_https_site"systemctl restart apache2touch /etc/startup_script_completed

9. ClickCreate.

Managed instance group

1. In the Google Cloud console, go to theInstance groups page.

   Go to Instance groups

2. ClickCreate instance group.

3. Set theName toig-ilb.

4. ForLocation, chooseMulti-zone, and set theRegion tous-west1.

5. Set theInstance template totemplate-vm-ilb.

6. Optional: Configureautoscaling. Youcannot autoscale the instance group based on HTTP load balancing usagebecause the instance group is a backend for the internal passthrough Network Load Balancer.

7. Set theMinimum number of instances to1 and theMaximum numberof instances to6.

8. Optional: Configureautohealing.If you configure autohealing, use the same health check used by the backendservice for the internal passthrough Network Load Balancer. In this example, usehc-http-80.

9. ClickCreate.

gcloud

1. Create the instance template. Optionally, you canset otherparameters,such asmachine type, for the imagetemplate to use.

   gcloud compute instance-templates create template-vm-ilb \    --image-family=debian-12 \    --image-project=debian-cloud \    --tags=allow-ssh,allow-health-check \    --subnet=lb-subnet \    --region=us-west1 \    --network=lb-network \    --metadata=startup-script='#! /bin/bashif [ -f /etc/startup_script_completed ]; thenexit 0fiapt-get updateapt-get install apache2 -ya2ensite default-ssla2enmod sslfile_ports="/etc/apache2/ports.conf"file_http_site="/etc/apache2/sites-available/000-default.conf"file_https_site="/etc/apache2/sites-available/default-ssl.conf"http_listen_prts="Listen 80\nListen 8008\nListen 8080\nListen 8088"http_vh_prts="*:80 *:8008 *:8080 *:8088"https_listen_prts="Listen 443\nListen 8443"https_vh_prts="*:443 *:8443"vm_hostname="$(curl -H "Metadata-Flavor:Google" \http://metadata.google.internal/computeMetadata/v1/instance/name)"echo "Page served from: $vm_hostname" | \tee /var/www/html/index.htmlprt_conf="$(cat "$file_ports")"prt_conf_2="$(echo "$prt_conf" | sed "s|Listen 80|${http_listen_prts}|")"prt_conf="$(echo "$prt_conf_2" | sed "s|Listen 443|${https_listen_prts}|")"echo "$prt_conf" | tee "$file_ports"http_site_conf="$(cat "$file_http_site")"http_site_conf_2="$(echo "$http_site_conf" | sed "s|*:80|${http_vh_prts}|")"echo "$http_site_conf_2" | tee "$file_http_site"https_site_conf="$(cat "$file_https_site")"https_site_conf_2="$(echo "$https_site_conf" | sed "s|_default_:443|${https_vh_prts}|")"echo "$https_site_conf_2" | tee "$file_https_site"systemctl restart apache2touch /etc/startup_script_completed'

2. Create one regional managed instance group using the template:

   gcloud compute instance-groups managed create ig-ilb \    --template=template-vm-ilb \    --region=us-west1 \    --size=6

3. Add the regional managed instance group as a backend tothe backendservice that you already created:

   gcloud compute backend-services add-backend be-ilb \    --region=us-west1 \    --instance-group=ig-ilb \    --instance-group-region=us-west1

4. Disconnect the two unmanaged (zonal) instance groups from the backendservice:

   gcloud compute backend-services remove-backend be-ilb \    --region=us-west1 \    --instance-group=ig-a \    --instance-group-zone=us-west1-agcloud compute backend-services remove-backend be-ilb \    --region=us-west1 \    --instance-group=ig-c \    --instance-group-zone=us-west1-c

Console

1. In the Google Cloud console, go to theVM instances page.

   Go to VM instances

2. Repeat the following steps for each backend VM.

3. Click the name of the backend VM, for example,vm-a1.

4. ClickeditEdit.

5. In theNetwork interfaces section, click the network.

6. From theExternal IP list, selectNone, and clickDone.

7. ClickSave.

gcloud

1. To look up the zone for an instance – for example, if you're using aregional managed instance group– run the following command for each instance to determine itszone. Replace[SERVER-VM] with the name of the VM to look up.

   gcloud compute instances list --filter="name=[SERVER-VM]"

2. Repeat the following step for each backend VM. Replace[SERVER-VM]with the name of the VM, and replace and[ZONE] with the VM's zone.

   gcloud compute instances delete-access-config [SERVER-VM] \    --zone=[ZONE] \    --access-config-name=external-nat

API

Make aPOST request to theinstances.deleteAccessConfig method for each backend VM, replacingvm-a1with the name of the VM, and replacing andus-west1-a with the VM's zone.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-a/instances/vm-a1/deleteAccessConfig?accessConfig=external-nat&networkInterface=None

Console

Delete your forwarding rule and create a new one

1. In the Google Cloud console, go to theLoad balancing page.

   Go to Load balancing

2. Click thebe-ilb load balancer and clickEdit.

3. ClickFrontend configuration.

4. Hold the pointer over the10.1.2.9 forwarding rule and clickdeleteDelete.

5. ClickAdd frontend IP and port.

6. In theNew Frontend IP and portsection, enter the following information and clickDone:

   • Name:fr-ilb
   • Subnetwork:lb-subnet
   • Internal IP:ip-ilb
   • Ports:All.

7. Verify that there is a blue check mark next toFrontend configuration before continuing.

8. ClickReview and finalize and review your load balancer configuration settings.

9. ClickCreate.

gcloud

1. Delete your existing forwarding rule,fr-ilb.

   gcloud compute forwarding-rules delete fr-ilb \    --region=us-west1

2. Create a replacement forwarding rule, with the same name, whose portconfiguration uses the keywordALL. The other parameters for theforwarding rule remain the same.

   gcloud compute forwarding-rules create fr-ilb \    --region=us-west1 \    --load-balancing-scheme=internal \    --network=lb-network \    --subnet=lb-subnet \    --address=10.1.2.99 \    --ip-protocol=TCP \    --ports=ALL \    --backend-service=be-ilb \    --backend-service-region=us-west1

API

Delete the forwarding rule by making aDELETE request to theforwardingRules.delete method.

DELETE https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/forwardingRules/fr-ilb

Create the forwarding rule by making aPOST request to theforwardingRules.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/forwardingRules{"name": "fr-ilb","IPAddress": "10.1.2.99","IPProtocol": "TCP","allPorts": true,"loadBalancingScheme": "INTERNAL","subnetwork": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/subnetworks/lb-subnet","network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/lb-network","backendService": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/backendServices/be-ilb","networkTier": "PREMIUM"}

Console

1. In the Google Cloud console, go to theForwarding rules page.

   Go to Forwarding rules

2. In theName column, clickfr-ilb, and then clickDelete.

3. In the Google Cloud console, go to theLoad balancing page.

   Go to Load balancing

4. In theName column, clickbe-ilb.

5. ClickEdit.

6. ClickFrontend configuration.

7. ClickAdd frontend IP and port.

8. In theNew Frontend IP and portsection, do the following:

   1. ForName, enterfr-ilb-http.
   2. ForSubnetwork, selectlb-subnet.
   3. ForInternal IP purpose, selectShared.
   4. From theIP address list, selectCreate IP address,enter the following information, and clickReserve:
      • Name:internal-10-1-2-99
      • Static IP address:Let me choose
      • Custom IP address:10.1.2.99
   5. ForPorts, selectMultiple, and then inPort numbers, enter80,8008,8080, and8088.
   6. ClickDone.

9. ClickAdd frontend IP and port.

10. In theNew Frontend IP and portsection, do the following:

    1. ForName, enterfr-ilb-https.
    2. ForSubnetwork, selectlb-subnet.
    3. ForInternal IP purpose, selectShared.
    4. From theIP address list, selectinternal-10-1-2-99.
    5. ForPorts, selectMultiple, and then inPort numbers, enter443 and8443.
    6. ClickDone.

11. ClickReview and finalize, and review your load balancer configuration settings.

12. ClickUpdate.

gcloud

1. Delete your existing forwarding rule,fr-ilb.

   gcloud compute forwarding-rules delete fr-ilb \    --region=us-west1

2. Create a static (reserved) internal IP address for10.1.2.99 and setits--purpose flag toSHARED_LOADBALANCER_VIP. The--purpose flagis required so that two internal forwarding rules can use the sameinternal IP address.

   gcloud compute addresses create internal-10-1-2-99 \    --region=us-west1 \    --subnet=lb-subnet \    --addresses=10.1.2.99 \    --purpose=SHARED_LOADBALANCER_VIP

   1. Create two replacement forwarding rules with the following parameters:

   gcloud compute forwarding-rules create fr-ilb-http \    --region=us-west1 \    --load-balancing-scheme=internal \    --network=lb-network \    --subnet=lb-subnet \    --address=10.1.2.99 \    --ip-protocol=TCP \    --ports=80,8008,8080,8088 \    --backend-service=be-ilb \    --backend-service-region=us-west1

   gcloud compute forwarding-rules create fr-ilb-https \    --region=us-west1 \    --load-balancing-scheme=internal \    --network=lb-network \    --subnet=lb-subnet \    --address=10.1.2.99 \    --ip-protocol=TCP \    --ports=443,8443 \    --backend-service=be-ilb \    --backend-service-region=us-west1

API

Delete the forwarding rule by making aDELETE request to theforwardingRules.delete method.

DELETE https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/forwardingRules/fr-ilb

Create a static (reserved) internal IP address for10.1.2.99 and set its purpose toSHARED_LOADBALANCER_VIP by making aPOST request to theaddresses.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/addresses{"name": "internal-10-1-2-99","address": "10.1.2.99","prefixLength": 32,"addressType": INTERNAL,"purpose": SHARED_LOADBALANCER_VIP,"subnetwork": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/subnetworks/lb-subnet"}

Create two forwarding rules by making twoPOST requests to theforwardingRules.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/forwardingRules{"name": "fr-ilb-http","IPAddress": "10.1.2.99","IPProtocol": "TCP","ports": [  "80", "8008", "8080",  "8088"],"loadBalancingScheme": "INTERNAL","subnetwork": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/subnetworks/lb-subnet","network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/lb-network","backendService": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/backendServices/be-ilb","networkTier": "PREMIUM"}

{"name": "fr-ilb-https","IPAddress": "10.1.2.99","IPProtocol": "TCP","ports": [  "443", "8443"],"loadBalancingScheme": "INTERNAL","subnetwork": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/subnetworks/lb-subnet","network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/lb-network","backendService": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/backendServices/be-ilb","networkTier": "PREMIUM"}

1. In the Google Cloud console, go to theLoad balancing page.

   Go to Load balancing

2. Clickbe-ilb (the name of the backend service that you created forthis example) and clickEdit.

3. On theEdit internal passthrough Network Load Balancer page, clickBackend configuration.

4. From theSession affinity list, selectClient IP.

5. ClickUpdate.

gcloud

Use the followinggcloud command to update thebe-ilb backend service,specifying client IP session affinity:

gcloud compute backend-services update be-ilb \    --region=us-west1 \    --session-affinity CLIENT_IP

API

Make aPATCH request to theregionBackendServices/patch method.

PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/backendServices/be-ilb{"sessionAffinity": "CLIENT_IP"}

Use the followinggcloud computebackend-services command to update the connection tracking policy for the backend service:

gcloud compute backend-services updateBACKEND_SERVICE \    --region=REGION \    --tracking-mode=TRACKING_MODE \    --connection-persistence-on-unhealthy-backends=CONNECTION_PERSISTENCE_BEHAVIOR \    --idle-timeout-sec=IDLE_TIMEOUT_VALUE

Replace the placeholders with valid values:

• BACKEND_SERVICE: the backend service that you'reupdating
• REGION: the region of the backend service that you'reupdating
• TRACKING_MODE: the connection tracking mode to be usedfor incoming packets; for the list of supported values, seeTracking mode
• CONNECTION_PERSISTENCE_BEHAVIOR: the connectionpersistence behavior when backends are unhealthy; for the list ofsupported values, seeConnection persistence on unhealthybackends
• IDLE_TIMEOUT_VALUE: the number of seconds that aconnection tracking table entry must be maintained after the load balancerprocesses the last packet that matched the entry

Console

Add the second subnet

1. In the Google Cloud console, go to theVPC networks page.

   Go to VPC networks

2. ClickCreate VPC network.

3. Clicklb-network.

4. In theSubnets section, do the following:

   1. ClickAdd subnet.
   2. In theNew subnet section, enter the following information:
      • Name:second-subnet
      • Region:us-west1
      • IP address range:10.5.6.0/24
   3. ClickAdd.

Add the second forwarding rule

1. In the Google Cloud console, go to theLoad balancing page.

   Go to Load balancing

2. Click thebe-ilb load balancer and clickEdit.

3. ClickFrontend configuration.

4. ClickAdd frontend IP and port.

5. In theNew Frontend IP and portsection, set the following fields and clickDone:

   • Name:fr-ilb-2
   • IP version:IPv4
   • Subnetwork:second-subnet
   • Internal IP:ip-ilb
   • Ports:80 and443

6. Verify that there is a blue check mark next toFrontend configuration before continuing.

7. ClickReview and finalize, and review your load balancer configuration settings.

8. ClickCreate.

gcloud

1. Create a second subnet in thelb-network network in theus-west1region:

    gcloud compute networks subnets create second-subnet \     --network=lb-network \     --range=10.5.6.0/24 \     --region=us-west1

2. Create a second forwarding rule for ports 80 and 443. The otherparameters for this rule, including IP address and backend service, arethe same as for the primary forwarding rule,fr-ilb.

    gcloud compute forwarding-rules create fr-ilb-2 \     --region=us-west1 \     --load-balancing-scheme=internal \     --network=lb-network \     --subnet=second-subnet \     --address=10.5.6.99 \     --ip-protocol=TCP \     --ports=80,443 \     --backend-service=be-ilb \     --backend-service-region=us-west1

API

Make aPOST requests to thesubnetworks.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/subnetworks{ "name": "second-subnet", "network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/lb-network", "ipCidrRange": "10.5.6.0/24", "privateIpGoogleAccess": false}

Create the forwarding rule by making aPOST request to theforwardingRules.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/forwardingRules{"name": "fr-ilb-2","IPAddress": "10.5.6.99","IPProtocol": "TCP","ports": [  "80", "443"],"loadBalancingScheme": "INTERNAL","subnetwork": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/subnetworks/lb-subnet","network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/lb-network","backendService": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/backendServices/be-ilb","networkTier": "PREMIUM"}

gcloud

Use the followinggcloud command to update thebe-ilb backend service,specifying subsetting policy:

gcloud compute backend-services update be-ilb \    --subsetting-policy=CONSISTENT_HASH_SUBSETTING

API

Make aPATCH request to theregionBackendServices/patch method.

PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-west1/backendServices/be-ilb{"subsetting":  {    "policy": CONSISTENT_HASH_SUBSETTING  }}

Console

Start your configuration

1. In the Google Cloud console, go to theLoad balancing page.

   Go to Load balancing

2. ClickCreate load balancer.
3. ForType of load balancer, selectNetwork Load Balancer (TCP/UDP/SSL) and clickNext.
4. ForProxy or passthrough, selectPassthrough load balancer and clickNext.
5. ForPublic facing or internal, selectInternal and clickNext.
6. ClickConfigure.

Basic configuration

1. ForLoad balancer name, enter a name.
2. ForRegion, select the region of the VM instances where you want to mirror packets.
3. ForNetwork, select the network where you want to mirror packets.
4. ClickBackend configuration.
5. In theNew Backend section, forInstance group, select the instance group to forward packets to.
6. In theHealth check list, clickCreate a health check, and thenenter the following information:
   • In theName field, enter a name for the health check.
   • In theProtocol list, selectHTTP.
   • In thePort field, enter80.
7. ClickCreate.
8. ClickFrontend configuration.
9. In theNew Frontend IP and port section, do the following:
   1. ForName, enter a name.
   2. ForSubnetwork, select a subnetwork in the same region as theinstances to mirror.
   3. ForPorts, selectAll.
   4. ClickAdvanced configurations and select theEnable this load balancer for packet mirroring checkbox.
   5. ClickDone.
10. ClickCreate.

gcloud

1. Create a new regional HTTP health check to test HTTP connectivity to aninstance group on port 80:

   gcloud compute health-checks create httpHEALTH_CHECK_NAME \    --region=REGION \    --port=80

   Replace the following:

   • HEALTH_CHECK_NAME: the name of the health check.
   • REGION: the region of the VM instances that youwant to mirror packets for.

2. Create a backend service for HTTP traffic:

   gcloud compute backend-services createCOLLECTOR_BACKEND_SERVICE \    --region=REGION \    --health-checks-region=REGION \    --health-checks=HEALTH_CHECK_NAME \    --load-balancing-scheme=internal \    --protocol=tcp

   Replace the following:

   • COLLECTOR_BACKEND_SERVICE: the name of thebackend service.
   • REGION: the region of the VM instances where youwant to mirror packets.
   • HEALTH_CHECK_NAME: the name of the health check.

3. Add an instance group to the backend service:

   gcloud compute backend-services add-backendCOLLECTOR_BACKEND_SERVICE \    --region=REGION \    --instance-group=INSTANCE_GROUP \    --instance-group-zone=ZONE

   Replace the following:

   • COLLECTOR_BACKEND_SERVICE: the name of thebackend service.
   • REGION: the region of the instance group.
   • INSTANCE_GROUP: the name of the instance group.
   • ZONE: the zone of the instance group.

4. Create a forwarding rule for the backend service:

   gcloud compute forwarding-rules createFORWARDING_RULE_NAME \    --region=REGION \    --network=NETWORK \    --subnet=SUBNET \    --backend-service=COLLECTOR_BACKEND_SERVICE \    --load-balancing-scheme=internal \    --ip-protocol=TCP \    --ports=all \    --is-mirroring-collector

   Replace the following:

   • FORWARDING_RULE_NAME: the name of the forwardingrule.
   • REGION: the region for the forwarding rule.
   • NETWORK: the network for the forwarding rule.
   • SUBNET: a subnetwork in the region of the VMswhere you want to mirror packets.
   • COLLECTOR_BACKEND_SERVICE: the backend servicefor this load balancer.