1. In the Google Cloud console, go to theVPC networks page.

   Go to VPC networks

2. ClickCreate VPC network.
3. ForName, enterlb-network.

4. In theSubnets section:

   1. Set theSubnet creation mode toCustom.

   2. In theNew subnet section, enter the following information:

      • Name:lb-frontend-and-backend-subnet

      • Region:us-west1

      • IP address range:10.1.2.0/24

   3. ClickDone.

5. ClickCreate.

gcloud

1. Create a VPC network with thegcloud computenetworks create command:

   gcloud compute networks create lb-network --subnet-mode=custom

2. Create a subnet in thelb-network network in theus-west1 region:

   gcloud compute networks subnets create lb-frontend-and-backend-subnet
       --network=lb-network
       --range=10.1.2.0/24
       --region=us-west1

Terraform

1. Create a VPC network:

   # Shared VPC networkresource "google_compute_network" "lb_network" {  name                    = "lb-network"  provider                = google-beta  project                 = "my-host-project-id"  auto_create_subnetworks = false}

2. Create a subnet in theus-west1 region:

   # Shared VPC network - backend subnetresource "google_compute_subnetwork" "lb_frontend_and_backend_subnet" {  name          = "lb-frontend-and-backend-subnet"  provider      = google-beta  project       = "my-host-project-id"  region        = "us-west1"  ip_cidr_range = "10.1.2.0/24"  role          = "ACTIVE"  network       = google_compute_network.lb_network.id}

Console

1. In the Google Cloud console, go to theVPC networks page.

   Go to VPC networks

2. Click the name of the Shared VPC network:lb-network.
3. ClickAdd subnet.
4. ForName, enterproxy-only-subnet.
5. ForRegion, selectus-west1.
6. SetPurpose toRegional Managed Proxy.
7. ForIP address range, enter10.129.0.0/23.
8. ClickAdd.

gcloud

Create the proxy-only subnet with thegcloud compute networks subnetscreate command:

gcloud compute networks subnets create proxy-only-subnet \    --purpose=REGIONAL_MANAGED_PROXY \    --role=ACTIVE \    --region=us-west1 \    --network=lb-network \    --range=10.129.0.0/23

Terraform

Create the proxy-only subnet:

# Shared VPC network - proxy-only subnetresource "google_compute_subnetwork" "proxy_only_subnet" {  name          = "proxy-only-subnet"  provider      = google-beta  project       = "my-host-project-id"  region        = "us-west1"  ip_cidr_range = "10.129.0.0/23"  role          = "ACTIVE"  purpose       = "REGIONAL_MANAGED_PROXY"  network       = google_compute_network.lb_network.id}

Console

1. In the Google Cloud console, go to theFirewall policies page.

   Go to Firewall policies

2. ClickCreate firewall rule to create the rule to allow Google Cloud health checks:
• Name:fw-allow-health-check
• Network:lb-network
• Direction of traffic: Ingress
• Action on match: Allow
• Targets: Specified target tags
• Target tags:load-balanced-backend
• Source filter: IPv4 ranges
• Source IPv4 ranges:130.211.0.0/22 and35.191.0.0/16
• Protocols and ports:
  • ChooseSpecified protocols and ports.
  • CheckTCP and enter80 for the port number.

  As a best practice, limit this rule to just the protocols and ports that match those used by your health check. If you usetcp:80 for the protocol and port, Google Cloud can use HTTP on port80 to contact your VMs, but it cannot use HTTPS on port443 to contact them.

3. ClickCreate.
4. ClickCreate firewall rule to create the rule to allow Google Cloud health checks:
• Name:fw-allow-proxies
• Network:lb-network
• Direction of traffic: Ingress
• Action on match: Allow
• Targets: Specified target tags
• Target tags:load-balanced-backend
• Source filter: IPv4 ranges
• Source IPv4 ranges:10.129.0.0/23
• Protocols and ports:
  • ChooseSpecified protocols and ports.
  • CheckTCP and enter80, 443, 8080 for the port numbers.
5. ClickCreate.

gcloud

1. Create thefw-allow-health-check firewall rule to allowGoogle Cloud health checks. This example allows all TCP trafficfrom health check probers. However, you can configure a narrower setof ports to meet your needs.

   gcloud compute firewall-rules create fw-allow-health-check \   --network=lb-network \   --action=allow \   --direction=ingress \   --source-ranges=130.211.0.0/22,35.191.0.0/16 \   --target-tags=load-balanced-backend \   --rules=tcp

2. Create thefw-allow-proxies firewall rule to allow trafficfrom the Envoy proxy-only subnet to reach your backends.

   gcloud compute firewall-rules create fw-allow-proxies \   --network=lb-network \   --action=allow \   --direction=ingress \   --source-ranges=10.129.0.0/23 \   --target-tags=load-balanced-backend \   --rules=tcp:80,tcp:443,tcp:8080

Terraform

1. Create a firewall rule to allow Google Cloud health checks.

   resource "google_compute_firewall" "fw_allow_health_check" {  name          = "fw-allow-health-check"  provider      = google-beta  project       = "my-host-project-id"  direction     = "INGRESS"  network       = google_compute_network.lb_network.id  source_ranges = ["130.211.0.0/22", "35.191.0.0/16"]  allow {    protocol = "tcp"  }  target_tags = ["load-balanced-backend"]}

2. Create a firewall rule to allow traffic from the Envoy proxy-only subnetto reach your backends.

   resource "google_compute_firewall" "fw_allow_proxies" {  name          = "fw-allow-proxies"  provider      = google-beta  project       = "my-host-project-id"  direction     = "INGRESS"  network       = google_compute_network.lb_network.id  source_ranges = ["10.129.0.0/23"]  allow {    protocol = "tcp"    ports    = ["80", "443", "8080"]  }  target_tags = ["load-balanced-backend"]}

Console

1. Create an instance template. In the Google Cloud console, go to theInstance templates page.

   Go to Instance templates

   1. ClickCreate instance template.
   2. ForName, enterl7-xlb-backend-template.
   3. Ensure that theBoot disk is set to a Debian image, such asDebian GNU/Linux 12 (bookworm). These instructions use commands thatare only available on Debian, such asapt-get. If you need to changetheBoot disk, clickChange.
      1. ForOperating System, selectDebian.
      2. ForVersion, select one of the available Debian images suchasDebian GNU/Linux 12 (bookworm).
      3. ClickSelect.
   4. ClickAdvanced options, and then clickNetworking.
   5. Enter the followingNetwork tags:load-balanced-backend.
   6. ForNetwork interfaces,selectNetworks shared with me(from host project:HOST_PROJECT_ID).
   7. Select thelb-frontend-and-backend-subnet subnet from thelb-network network.

   8. ClickManagement. ForManagement, insert the followingscript into theStartup script field.

      #! /bin/bashapt-get updateapt-get install apache2 -ya2ensite default-ssla2enmod sslvm_hostname="$(curl -H "Metadata-Flavor:Google" \http://metadata.google.internal/computeMetadata/v1/instance/name)"echo "Page served from: $vm_hostname" | \tee /var/www/html/index.htmlsystemctl restart apache2

   9. ClickCreate.

2. Create a managed instance group. In the Google Cloud console, go to theInstance groups page.
   

   Go to Instance groups

   1. ClickCreate instance group.
   2. ChooseNew managed instance group (stateless). For moreinformation, seeStateless or stateful MIGs.
   3. ForName, enterl7-xlb-backend-example.
   4. ForLocation, selectSingle zone.
   5. ForRegion, selectus-west1.
   6. ForZone, selectus-west1-a.
   7. ForInstance template, selectl7-xlb-backend-template.

   8. Specify the number of instances that you want to create in the group.

      For this example, specify the following options forAutoscaling:

      • ForAutoscaling mode, selectOff:do not autoscale.
      • ForMaximum number of instances, enter2.

      Optionally, in theAutoscaling section, you can configurethe instance group toautomatically add or removeinstances based on instance CPU usage.

   9. ClickCreate.

gcloud

Thegcloud instructions in this guide assume that you are usingCloudShell or another environment with bash installed.

1. Create a VM instance template with HTTP server with thegcloud compute instance-templates createcommand.

   gcloud compute instance-templates create l7-xlb-backend-template \--region=us-west1 \--network=projects/HOST_PROJECT_ID/global/networks/lb-network \--subnet=projects/HOST_PROJECT_ID/regions/us-west1/subnetworks/lb-frontend-and-backend-subnet \--tags=load-balanced-backend \--image-family=debian-12 \--image-project=debian-cloud \--metadata=startup-script='#! /bin/bashapt-get updateapt-get install apache2 -ya2ensite default-ssla2enmod sslvm_hostname="$(curl -H "Metadata-Flavor:Google" \http://metadata.google.internal/computeMetadata/v1/instance/name)"echo "Page served from: $vm_hostname" | \tee /var/www/html/index.htmlsystemctl restart apache2' \--project=SERVICE_PROJECT_ID

2. Create a managed instance group in the zone with thegcloud computeinstance-groups managed createcommand.

   gcloud compute instance-groups managed create l7-xlb-backend-example \    --zone=us-west1-a \    --size=2 \    --template=l7-xlb-backend-template \    --project=SERVICE_PROJECT_ID

Console

1. In the Google Cloud console, go to theReserve a static address page.

   Go to Reserve a static address

2. Enter a name for the new address.

3. ForNetwork Service Tier, selectStandard.

4. ForIP version, selectIPv4. IPv6 addresses can only be global and can only be usedwith global load balancers.

5. ForType, selectRegional.

6. ForRegion, selectus-west1.

7. Leave theAttached to option set toNone. After you create theload balancer, this IP address is attached to the loadbalancer's forwarding rule.

8. To reserve the IP address, clickReserve.

gcloud

To reserve a static external IP address, use thecompute addresses create command.

gcloud compute addresses createIP_ADDRESS_NAME  \    --region=us-west1 \    --network-tier=STANDARD \    --project=SERVICE_PROJECT_ID

Replace the following:

• IP_ADDRESS_NAME: the name that you want to call thisaddress.
• SERVICE_PROJECT_ID: the project ID for theservice project where the load balancer is being created.

Console

Switch context to the service project

1. In the Google Cloud console, go to theDashboard page.

   Go to Dashboard

2. Click theSelect from list at the top of the page. In theSelect from window that appears, select the service project whereyou want to create the load balancer.

Select the load balancer type

1. In the Google Cloud console, go to theLoad balancing page.

   Go to Load balancing

2. ClickCreate load balancer.
3. ForType of load balancer, selectApplication Load Balancer (HTTP/HTTPS) and clickNext.
4. ForPublic facing or internal, selectPublic facing (external) and clickNext.
5. ForGlobal or single region deployment, selectBest for regional workloads and clickNext.
6. ClickConfigure.

Basic configuration

1. For theName of the load balancer, enterl7-xlb-shared-vpc.
2. For theRegion, selectus-west1.

3. For theNetwork, selectlb-network(fromProject:HOST_PROJECT_ID).

   If you see aProxy-only subnet required in Shared VPC network warning, confirm that the host project admin has created theproxy-only-subnet in theus-west1 region in thelb-network Shared VPC network. Load balancer creation will succeed even if you do not have permission to view the proxy-only subnet on this page.

4. Keep the page open to continue.

Configure the frontend

For HTTP:

1. ClickFrontend configuration.
2. ClickAdd frontend IP and port.
3. Set theName tol7-xlb-forwarding-rule.
4. Set theProtocol toHTTP.
5. Set thePort to80.

6. For theIP address that you created inReserving the load balancer's IP address.

7. ClickDone.

For HTTPS:

If you are using HTTPS between the client and the load balancer,you need one or more SSL certificate resources to configure the proxy.For information about how to create SSL certificate resources, seeSSL certificates. Google-managedcertificates aren't currently supported with regional external Application Load Balancers.

1. ClickFrontend configuration.
2. ClickAdd frontend IP and port.
3. In theName field, enterl7-xlb-forwarding-rule.
4. In theProtocol field, selectHTTPS (includes HTTP/2).
5. Ensure that thePort is set to443, to allow HTTPS traffic.
6. Select theIP address that you created inReserving the load balancer's IP address.
7. Click theCertificate list.
   1. If you already have aself-managed SSLcertificate resourceyou want to use as the primary SSL certificate, select it from themenu.
   2. Otherwise, selectCreate a new certificate.
      1. Fill in aName ofl7-xlb-cert.
      2. In the appropriate fields upload your PEM-formatted files:
         • Public key certificate
         • Certificate chain
         • Private key
      3. ClickCreate.
8. To add certificate resources in addition tothe primary SSL certificate resource:
   1. ClickAdd certificate.
   2. Select a certificate from theCertificates list or clickCreate a new certificate and follow the instructions above.
9. ClickDone.

Configure the backend

1. ClickBackend configuration.
2. From theCreate or select backend services menu,selectCreate a backend service.
3. Set theName of the backend service tol7-xlb-backend-service.
4. Set theBackend type toInstance groups.
5. In theNew backend section:
   1. Set theInstance group tol7-xlb-backend-example.
   2. Set thePort numbers to80.
   3. Set theBalancing mode toUtilization.
   4. ClickDone.
6. In theHealth check section, chooseCreate a health check with thefollowing parameters:
   1. Name:l7-xlb-basic-check
   2. Protocol:HTTP
   3. Port:80
7. ClickSave and Continue.
8. ClickCreate.

Configure the routing rules

• ClickRouting rules. Ensure that thel7-xlb-backend-serviceis the only backend service for any unmatched host and any unmatchedpath.

For information about traffic management, seeSetting up trafficmanagement.

Review and finalize the configuration

• ClickCreate.

gcloud

1. Define the HTTP health check with thegcloud compute health-checkscreate httpcommand.

   gcloud compute health-checks create http l7-xlb-basic-check \   --region=us-west1 \   --use-serving-port \   --project=SERVICE_PROJECT_ID

2. Define the backend service with thegcloud compute backend-servicescreate command.

   gcloud compute backend-services create l7-xlb-backend-service \  --load-balancing-scheme=EXTERNAL_MANAGED \  --protocol=HTTP \  --health-checks=l7-xlb-basic-check \  --health-checks-region=us-west1 \  --region=us-west1 \  --project=SERVICE_PROJECT_ID

3. Add backends to the backend service with thegcloud compute backend-servicesadd-backend command.

   gcloud compute backend-services add-backend l7-xlb-backend-service \  --balancing-mode=UTILIZATION \  --instance-group=l7-xlb-backend-example \  --instance-group-zone=us-west1-a \  --region=us-west1 \  --project=SERVICE_PROJECT_ID

4. Create the URL map with thegcloud compute url-mapscreate command.

   gcloud compute url-maps create l7-xlb-map \  --default-service=l7-xlb-backend-service \  --region=us-west1 \  --project=SERVICE_PROJECT_ID

5. Create the target proxy.

   For HTTP:

   For an HTTP load balancer, create the target proxywith thegcloud compute target-http-proxiescreate command.

   gcloud compute target-http-proxies create l7-xlb-proxy \  --url-map=l7-xlb-map \  --url-map-region=us-west1 \  --region=us-west1 \  --project=SERVICE_PROJECT_ID

   For HTTPS:

   For information about how to create SSL certificate resources, seeSSL certificates. Google-managedcertificates aren't currently supported with regional external Application Load Balancers.

   Assign your filepaths to variable names.

   export LB_CERT=path to PEM-formatted file

   export LB_PRIVATE_KEY=path to PEM-formatted file

   Create a regional SSL certificate using thegcloud computessl-certificatescreate command.

   gcloud compute ssl-certificates create l7-xlb-cert \  --certificate=$LB_CERT \  --private-key=$LB_PRIVATE_KEY \  --region=us-west1

   Use the regional SSL certificate to create a target proxy with thegcloudcompute target-https-proxiescreatecommand.

   gcloud compute target-https-proxies create l7-xlb-proxy \  --url-map=l7-xlb-map \  --region=us-west1 \  --ssl-certificates=l7-xlb-cert \  --project=SERVICE_PROJECT_ID

6. Create the forwarding rule.

   For custom networks, you must reference the subnet in the forwarding rule.

   For the forwarding rule's IP address, use thelb-frontend-and-backend-subnet. If you tryto use theproxy-only subnet,forwarding rule creation fails.

   For HTTP:

   Use thegcloud compute forwarding-rulescreate commandwith the correct flags.

   gcloud compute forwarding-rules create l7-xlb-forwarding-rule \  --load-balancing-scheme=EXTERNAL_MANAGED \  --network=projects/HOST_PROJECT_ID/global/networks/lb-network \  --address=IP_ADDRESS_NAME \  --ports=80 \  --region=us-west1 \  --target-http-proxy=l7-xlb-proxy \  --target-http-proxy-region=us-west1 \  --network-tier=STANDARD \  --project=SERVICE_PROJECT_ID

   For HTTPS:

   Create the forwarding rule with thegcloud compute forwarding-rulescreate commandwith the correct flags.

   gcloud compute forwarding-rules create l7-xlb-forwarding-rule \  --load-balancing-scheme=EXTERNAL_MANAGED \  --network=projects/HOST_PROJECT_ID/global/networks/lb-network \  --address=IP_ADDRESS_NAME \  --ports=443 \  --region=us-west1 \  --target-https-proxy=l7-xlb-proxy \  --target-https-proxy-region=us-west1 \  --network-tier=STANDARD \  --project=SERVICE_PROJECT_ID

Console

1. In the Google Cloud console, go to theLoad balancing page.

   Go to Load balancing

2. Click the load balancer that you just created.
3. Note the load balancer's IP address. This IP address is referred to asLB_IP_ADDRESS in the following steps.
4. In theBackend section, confirm that the VMs are healthy. TheHealthy column should be populated, indicating that both VMs are healthy (2/2). If you see otherwise, first try reloading the page. It can take a few moments for the Google Cloud console to indicate that the VMs are healthy. If the backends do not appear healthy after a few minutes, review the firewall configuration and the network tag assigned to your backend VMs.
5. After the Google Cloud console shows that the backend instances are healthy, you can test your load balancer using a web browser by going tohttps://LB_IP_ADDRESS (orhttp://LB_IP_ADDRESS). ReplaceLB_IP_ADDRESS with theload balancer's IP address.
6. If you used a self-signed certificate for testing HTTPS, your browser displays a warning. You must explicitly instruct your browser to accept a self-signed certificate.
7. Your browser should render a page with content showing the name of the instance that served the page, along with its zone (for example,Page served from: lb-backend-example-xxxx). If your browser doesn't render this page, review the configuration settings in this guide.

gcloud

Note the IP address that was reserved:

gcloud compute addresses describeIP_ADDRESS_NAME \    --format="get(address)" \    --region=us-west1

You can test your load balancer using a web browser by going tohttps://IP_ADDRESS_NAME (orhttp://IP_ADDRESS_NAME). ReplaceIP_ADDRESS_NAME with theload balancer's IP address.

If you used a self-signed certificate for testing HTTPS, your browserdisplays a warning. You must explicitly instruct your browser to accept aself-signed certificate.

Your browser should render a page with minimal information about the backendinstance. If your browser doesn't render this page, review the configurationsettings in this guide.

Console

1. In the Google Cloud console, go to theReserve a static addresspage.

   Go to Reserve a static address

2. For the name of the new address, entercross-ref-ip-address.

3. ForNetwork Service Tier, selectStandard.

4. ForIP version, selectIPv4. IPv6 addresses can only be global and can only be usedwith global load balancers.

5. ForType, selectRegional.

6. ForRegion, selectus-west1.

7. Leave theAttached to option set toNone. After you create theload balancer, this IP address is attached to the loadbalancer's forwarding rule.

8. To reserve the IP address, clickReserve.

gcloud

To reserve a static external IP address, use thecompute addresses create command.

gcloud compute addresses createIP_ADDRESS_CROSS_REF  \    --region=us-west1 \    --network-tier=STANDARD \    --project=SERVICE_PROJECT_A_ID

Replace the following:

• IP_ADDRESS_CROSS_REF: the name that you want to callthis IP address.
• SERVICE_PROJECT_A_ID: the project ID forservice project A, where the load balancer's frontend is being created.

Console

1. Create an instance template. In the Google Cloud console, go to theInstance templates page.

   Go to Instance templates

   1. ClickCreate instance template.
   2. Enter aName for the instance template:cross-ref-backend-template.
   3. Ensure that theBoot disk is set to a Debian image, such asDebian GNU/Linux 12 (bookworm). These instructions use commands thatare only available on Debian, such asapt-get. If you need to changetheBoot disk, clickChange.
      1. ForOperating System, selectDebian.
      2. ForVersion, select one of the available Debian images suchasDebian GNU/Linux 12 (bookworm).
      3. ClickSelect.
   4. ClickAdvanced options, and then clickNetworking.
   5. Enter the followingNetwork tags:load-balanced-backend.
   6. ForNetwork interfaces,selectNetworks shared with me(from host project:HOST_PROJECT_ID).
   7. Select thelb-frontend-and-backend-subnet subnet from thelb-network network.

   8. ClickManagement. ForManagement, insert the followingscript into theStartup script field:

      #! /bin/bashapt-get updateapt-get install apache2 -ya2ensite default-ssla2enmod sslvm_hostname="$(curl -H "Metadata-Flavor:Google" \http://metadata.google.internal/computeMetadata/v1/instance/name)"echo "Page served from: $vm_hostname" | \tee /var/www/html/index.htmlsystemctl restart apache2

   9. ClickCreate.

2. Create a managed instance group. In the Google Cloud console, go to theInstance groups page.

   Go to Instance groups

   1. ClickCreate instance group.
   2. ChooseNew managed instance group (stateless). For moreinformation, seeStateless or stateful MIGs.
   3. Enter aName for the instance group:cross-ref-ig-backend.
   4. ForLocation, selectSingle zone.
   5. ForRegion, selectus-west1.
   6. ForZone, selectus-west1-a.
   7. ForInstance template, selectcross-ref-backend-template.

   8. Specify the number of instances that you want to create in the group.

      For this example, specify the following options forAutoscaling:

      • ForAutoscaling mode, selectOff:do not autoscale.
      • ForMaximum number of instances, enter2.

      Optionally, in theAutoscaling section, you can configurethe instance group toautomatically add or removeinstances based on instance CPU usage.

   9. ClickCreate.

3. Create a regional backend service. As a part of this step, we alsocreate the health check and add backends to the backend service.In the Google Cloud console, go to theBackends page.

   Go to Backends

   1. ClickCreate regional backend service.
   2. Enter aName for the backend service:cross-ref-backend-service.
   3. ForRegion, selectus-west1.
   4. ForLoad balancer type, selectRegional external Application Load Balancer (EXTERNAL_MANAGED).
   5. SetBackend type toInstance groups.
   6. In theBackends section, setNetwork tolb-network.
   7. ClickAdd backend and set the following fields:
      1. SetInstance group tocross-ref-ig-backend.
      2. SetPort numbers to80.
      3. SetBalancing mode toUtilization.
      4. ClickDone.
   8. In theHealth check section, chooseCreate a health check with thefollowing parameters:
      1. Name:cross-ref-http-health-check
      2. Protocol:HTTP
      3. Port:80
      4. ClickSave.

   9. Optional: In theAdd permissions section, enter theIAM principals (typically an email address) of LoadBalancer Admins from other projects so that they can use this backendservice for load balancers in their own projects. Without thispermission, you cannot use cross-project service referencing.

      If you don't have permission to set access control policies forbackend services in this project, you can still create the backendservice now, and an authorized user can perform this step later asdescribed in the section,Grant permissions to the Load BalancerAdmin to use the backend service. That section alsodescribes how to grant access to all the backend services in thisproject, so that you don't have to grant access every time you createa new backend service.

   10. ClickCreate.

gcloud

1. Create a VM instance template with an HTTP server with thegcloud computeinstance-templatescreate command.

   gcloud compute instance-templates createBACKEND_IG_TEMPLATE \    --region=us-west1 \    --network=projects/HOST_PROJECT_ID/global/networks/lb-network \    --subnet=projects/HOST_PROJECT_ID/regions/us-west1/subnetworks/lb-frontend-and-backend-subnet \    --tags=load-balanced-backend \    --image-family=debian-12 \    --image-project=debian-cloud \    --metadata=startup-script='#! /bin/bash    apt-get update    apt-get install apache2 -y    a2ensite default-ssl    a2enmod ssl    vm_hostname="$(curl -H "Metadata-Flavor:Google" \    http://metadata.google.internal/computeMetadata/v1/instance/name)"    echo "Page served from: $vm_hostname" | \    tee /var/www/html/index.html    systemctl restart apache2' \    --project=SERVICE_PROJECT_B_ID

   Replace the following:

   • BACKEND_IG_TEMPLATE: the name for theinstance group template.
   • SERVICE_PROJECT_B_ID: the project ID forservice project B, where the load balancer's backends and the backendservice are being created.
   • HOST_PROJECT_ID: the project ID for theShared VPC host project.

2. Create a managed instance group in the zone with thegcloud computeinstance-groups managedcreatecommand.

   gcloud compute instance-groups managed createBACKEND_MIG \    --zone=us-west1-a \    --size=2 \    --template=BACKEND_IG_TEMPLATE \    --project=SERVICE_PROJECT_B_ID

   Replace the following:

   • BACKEND_MIG: the name for thebackend instance group.

3. Define the HTTP health check with thegcloud compute health-checkscreate httpcommand.

   gcloud compute health-checks create httpHTTP_HEALTH_CHECK_NAME \  --region=us-west1 \  --use-serving-port \  --project=SERVICE_PROJECT_B_ID

   Replace the following:

   • HTTP_HEALTH_CHECK_NAME: the name for theHTTP health check.

4. Define the backend service with thegcloud compute backend-servicescreate command.

   gcloud compute backend-services createBACKEND_SERVICE_NAME \  --load-balancing-scheme=EXTERNAL_MANAGED \  --protocol=HTTP \  --health-checks=HTTP_HEALTH_CHECK_NAME \  --health-checks-region=us-west1 \  --region=us-west1 \  --project=SERVICE_PROJECT_B_ID

   Replace the following:

   • BACKEND_SERVICE_NAME: the name for thebackend service created in service project B.

5. Add backends to the backend service with thegcloud computebackend-servicesadd-backendcommand.

   gcloud compute backend-services add-backendBACKEND_SERVICE_NAME \  --balancing-mode=UTILIZATION \  --instance-group=BACKEND_MIG \  --instance-group-zone=us-west1-a \  --region=us-west1 \  --project=SERVICE_PROJECT_B_ID

Console

Select the load balancer type

1. In the Google Cloud console, go to theLoad balancing page.

   Go to Load balancing

2. ClickCreate load balancer.
3. ForType of load balancer, selectApplication Load Balancer (HTTP/HTTPS) and clickNext.
4. ForPublic facing or internal, selectPublic facing (external) and clickNext.
5. ForGlobal or single region deployment, selectBest for regional workloads and clickNext.
6. ClickConfigure.

Prepare the load balancer

1. Enter theName of the load balancer:cross-ref-l7-xlb-shared-vpc.
2. For theRegion, selectus-west1.

3. For theNetwork, selectlb-network(fromProject:HOST_PROJECT_ID).

   If you see aProxy-only subnet required in Shared VPC network warning, confirm that the host project administrator has created theproxy-only-subnet in theus-west1 region in thelb-network Shared VPC network. Load balancer creation will succeed even if you don't have permission to view the proxy-only subnet on this page.

4. Keep the page open to continue.

Configure the frontend

For cross-project service referencing to work, the frontend must usethe same network (lb-network) from the Shared VPC host projectthat was used to create the backend service.

For HTTP:

1. ClickFrontend configuration.
2. Enter aName for the forwarding rule:cross-ref-http-forwarding-rule.
3. Set theProtocol toHTTP.

4. Set theSubnetwork tolb-frontend-and-backend-subnet.

   Don't select the proxy-only subnet for the frontend even if itis an option in the list.

5. Select theIP address that you created inReserving the load balancer's IP address, calledcross-ref-ip-address.

6. Set thePort to80.

7. ClickDone.

For HTTPS:

If you are using HTTPS between the client and the load balancer,you need one or more SSL certificate resources to configure the proxy.For information about how to create SSL certificate resources, seeSSL certificates. Google-managedcertificates aren't currently supported with regional external Application Load Balancers.

1. ClickFrontend configuration.
2. Enter aName for the forwarding rule:cross-ref-https-forwarding-rule.
3. In theProtocol field, selectHTTPS (includes HTTP/2).

4. Set theSubnetwork tolb-frontend-and-backend-subnet.

   Don't select the proxy-only subnet for the frontend even if itis an option in the list.

5. Select theIP address that you created inReserving the load balancer's IP address, calledcross-ref-ip-address.

6. Ensure that thePort is set to443 to allow HTTPS traffic.

7. Click theCertificate list.

   1. If you already have aself-managed SSLcertificate resourcethat you want to use as the primary SSL certificate, select it from themenu.
   2. Otherwise, selectCreate a new certificate.
      1. Enter aName for the SSL certificate.
      2. In the appropriate fields upload your PEM-formatted files:
         • Public key certificate
         • Certificate chain
         • Private key
      3. ClickCreate.

8. To add certificate resources in addition tothe primary SSL certificate resource:

   1. ClickAdd certificate.
   2. Select a certificate from theCertificates list or clickCreate a new certificate and follow the previous instructions.

9. ClickDone.

Configure the backend

1. ClickBackend configuration.
2. ClickCross-project backend services.
3. ForProject ID, enter theprojectIDfor service project B.
4. From theSelect backend services list, select the backend servicesfrom service project B that you want to use. For this example, you entercross-ref-backend-service.
5. ClickOK.

Configure the routing rules

• ClickRouting rules. Ensure that thecross-ref-backend-serviceis the only backend service for any unmatched host and any unmatchedpath.

For information about traffic management, seeSetting up trafficmanagement.

Review and finalize the configuration

• ClickCreate.

Test the load balancer

After the load balancer is created, test the load balancer by using thesteps described inTest the load balancer.

gcloud

1. Optional: Before creating a load balancer with cross-referencing backend services, find out whether the backend services you want to refer to can be referenced using a URL map:

   gcloud compute backend-services list-usable \    --region=us-west1 \    --project=SERVICE_PROJECT_B_ID

2. Create the URL map and set the default service to the backend servicecreated in service project B.

   gcloud compute url-maps createURL_MAP_NAME \    --default-service=projects/SERVICE_PROJECT_B_ID/regions/us-west1/backendServices/BACKEND_SERVICE_NAME \    --region=us-west1 \    --project=SERVICE_PROJECT_A_ID

   Replace the following:

   • URL_MAP_NAME: the name for theURL map.
   • BACKEND_SERVICE_NAME: the name for thebackend service created in service project B.
   • SERVICE_PROJECT_B_ID: the project ID forservice project B, where the load balancer's backends and the backendservice are created.
   • SERVICE_PROJECT_A_ID: the project ID forservice project A, where the load balancer's frontend is being created.

   URL map creation fails if you don't have thecompute.backendServices.usepermission for the backend service inservice project B.

3. Create the target proxy.

   For HTTP:

   gcloud compute target-http-proxies createHTTP_TARGET_PROXY_NAME \  --url-map=URL_MAP_NAME \  --url-map-region=us-west1 \  --region=us-west1 \  --project=SERVICE_PROJECT_A_ID

   Replace the following:

   • HTTP_TARGET_PROXY_NAME: the name for thetarget HTTP proxy.

   For HTTPS:

   Create a regional SSL certificate using thegcloud computessl-certificatescreate command.

   gcloud compute ssl-certificates createSSL_CERTIFICATE_NAME \  --certificate=PATH_TO_CERTIFICATE \  --private-key=PATH_TO_PRIVATE_KEY \  --region=us-west1 \  --project=SERVICE_PROJECT_A_ID

   Replace the following:

   • SSL_CERTIFICATE_NAME: the name for theSSL certificate resource.
   • PATH_TO_CERTIFICATE: the path to the localSSL certificate file in PEM format.
   • PATH_TO_PRIVATE_KEY: the path to the localSSL certificate private key in PEM format.

   Use the regional SSL certificate to create a target proxy with thegcloudcompute target-https-proxiescreatecommand.

   gcloud compute target-https-proxies createHTTPS_TARGET_PROXY_NAME \  --url-map=URL_MAP_NAME \  --region=us-west1 \  --ssl-certificates=SSL_CERTIFICATE_NAME \  --project=SERVICE_PROJECT_A_ID

   Replace the following:

   • HTTPS_TARGET_PROXY_NAME: the name for thetarget HTTPS proxy.

4. Create the forwarding rule. For cross-project service referencing towork, the forwarding rule must use the same network (lb-network) fromthe Shared VPC host project that was used to create the backendservice.

   For HTTP:

   gcloud compute forwarding-rules createHTTP_FORWARDING_RULE_NAME \  --load-balancing-scheme=EXTERNAL_MANAGED \  --network=projects/HOST_PROJECT_ID/global/networks/lb-network \  --address=IP_ADDRESS_CROSS_REF \  --ports=80 \  --region=us-west1 \  --target-http-proxy=HTTP_TARGET_PROXY_NAME \  --target-http-proxy-region=us-west1 \  --network-tier=STANDARD \  --project=SERVICE_PROJECT_A_ID

   Replace the following:

   • HTTP_FORWARDING_RULE_NAME: the name for theforwarding rule that is used to handle HTTP traffic.

   For HTTPS:

   gcloud compute forwarding-rules createHTTPS_FORWARDING_RULE_NAME \  --load-balancing-scheme=EXTERNAL_MANAGED \  --network=projects/HOST_PROJECT_ID/global/networks/lb-network \  --address=IP_ADDRESS_CROSS_REF \  --ports=443 \  --region=us-west1 \  --target-https-proxy=HTTPS_TARGET_PROXY_NAME \  --target-https-proxy-region=us-west1 \  --network-tier=STANDARD \  --project=SERVICE_PROJECT_A_ID

   Replace the following:

   • HTTPS_FORWARDING_RULE_NAME: the name for theforwarding rule that is used to handle HTTPS traffic.

5. To test the load balancer, use the steps described inTest the loadbalancer.

Console

Project-level permissions

Use the following steps to grant permissions to all backend services inyour project.

You require thecompute.regionBackendServices.setIamPolicy and theresourcemanager.projects.setIamPolicy permissions to complete this step.

1. In the Google Cloud console, go to theIAM page.

   Go to IAM

2. Select your project.

3. Clickperson_addGrantaccess.

4. In theNew principals field, enter the principal's email address orother identifier.

5. In theSelect a role list, select theCompute Load BalancerServices User.

6. Optional: Add acondition to the role.

7. ClickSave.

Resource-level permissions for individual backend services

Use the following steps to grant permissions to individual backendservices in your project.

You require thecompute.regionBackendServices.setIamPolicy permission tocomplete this step.

1. In the Google Cloud console, go to theBackends page.

   Go to Backends

2. From the backends list, select the backend service that you want togrant access to and clickperson_addPermissions.

3. Clickperson_addAdd principal.

4. In theNew principals field, enter the principal's email address orother identifier.

5. In theSelect a role list, select theCompute Load BalancerServices User.

6. ClickSave.

gcloud

Project-level permissions

Use the following steps to grant permissions to all backend services inyour project.

You require thecompute.regionBackendServices.setIamPolicy and theresourcemanager.projects.setIamPolicy permissions to complete this step.

gcloud projects add-iam-policy-bindingSERVICE_PROJECT_B_ID \    --member="user:LOAD_BALANCER_ADMIN" \    --role="roles/compute.loadBalancerServiceUser"

Resource-level permissions for individual backend services

At the backend service level, Service Project Admins can useeither of thefollowing commands to grant the Compute Load Balancer Services User role(roles/compute.loadBalancerServiceUser).

You require thecompute.regionBackendServices.setIamPolicy permission tocomplete this step.

gcloud projects add-iam-policy-bindingSERVICE_PROJECT_B_ID \    --member="user:LOAD_BALANCER_ADMIN" \    --role="roles/compute.loadBalancerServiceUser" \    --condition='expression=resource.name=="projects/SERVICE_PROJECT_B_ID/regions/us-west1/backend-services/BACKEND_SERVICE_NAME",title=Shared VPC condition'

or

gcloud compute backend-services add-iam-policy-bindingBACKEND_SERVICE_NAME \    --member="user:LOAD_BALANCER_ADMIN" \    --role="roles/compute.loadBalancerServiceUser" \    --project=SERVICE_PROJECT_B_ID \    --region=us-west1

To use these commands, replaceLOAD_BALANCER_ADMIN with theuser'sprincipal—forexample,test-user@gmail.com.

You can also configure IAM permissions so that they only applyto a subset of regional backend services by using conditions andspecifyingcondition attributes.

gcloud

To see resources referencing aregional Shared VPC backend service, run the following command:

gcloud compute backend-services describeBACKEND_SERVICE_NAME \    --regionREGION

Replace the following:

• BACKEND_SERVICE_NAME: the name of the loadbalancer backend service
• REGION: the region of the load balancer

In the command output, review theusedBy field, which displays theresources referencing the backend service, as shown in the followingexample:

id: '123456789'kind: compute#backendServiceloadBalancingScheme: INTERNAL_MANAGED...usedBy:-   reference: https://www.googleapis.com/compute/v1/projects/my-project/region/us-central1/urlMaps/my-url-map