1. In the Google Cloud console, go to theVPC networks page.

   Go to VPC networks

2. ClickCreate VPC network.

3. Provide aName for the network.

4. In theSubnets section, set theSubnet creation mode toCustom.

5. Create a subnet for the load balancer's backends. In theNew subnetsection, enter the following information:

   • Provide aName for the subnet.
   • Select aRegion:REGION_A
   • Enter anIP address range:10.1.2.0/24

6. ClickDone.

7. ClickAdd subnet.

8. Create a subnet for the load balancer's backends. In theNewsubnet section, enter the following information:

   • Provide aName for the subnet.
   • Select aRegion:REGION_B
   • Enter anIP address range:10.1.3.0/24

9. ClickDone.

10. ClickCreate.

gcloud

1. Create the custom VPC network with thegcloud computenetworks create command:

   gcloud compute networks createNETWORK \    --subnet-mode=custom

2. Create a subnet in theNETWORK network in theREGION_A region withthegcloud compute networks subnets create command:

   gcloud compute networks subnets createSUBNET_A \    --network=NETWORK \    --range=10.1.2.0/24 \    --region=REGION_A

3. Create a subnet in theNETWORK network in theREGION_B region withthegcloud compute networks subnets create command:

   gcloud compute networks subnets createSUBNET_B \    --network=NETWORK \    --range=10.1.3.0/24 \    --region=REGION_B

Terraform

To create the VPC network, use thegoogle_compute_network resource.

resource "google_compute_network" "default" {  auto_create_subnetworks = false  name                    = "lb-network-crs-reg"  provider                = google-beta}

To create the VPC subnets in thelb-network-crs-reg network,use thegoogle_compute_subnetwork resource.

resource "google_compute_subnetwork" "subnet_a" {  provider      = google-beta  ip_cidr_range = "10.1.2.0/24"  name          = "lbsubnet-uswest1"  network       = google_compute_network.default.id  region        = "us-west1"}

resource "google_compute_subnetwork" "subnet_b" {  provider      = google-beta  ip_cidr_range = "10.1.3.0/24"  name          = "lbsubnet-useast1"  network       = google_compute_network.default.id  region        = "us-east1"}

API

Make aPOST request to thenetworks.insert method.ReplacePROJECT_ID with your project ID.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks{ "routingConfig": {   "routingMode": "regional" }, "name": "NETWORK", "autoCreateSubnetworks": false}

Make aPOST request to thesubnetworks.insert method.ReplacePROJECT_ID with your project ID.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION_A/subnetworks{ "name": "SUBNET_A", "network": "projects/PROJECT_ID/global/networks/lb-network-crs-reg", "ipCidrRange": "10.1.2.0/24", "region": "projects/PROJECT_ID/regions/REGION_A",}

Make aPOST request to thesubnetworks.insert method.ReplacePROJECT_ID with your project ID.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION_B/subnetworks{ "name": "SUBNET_B", "network": "projects/PROJECT_ID/global/networks/NETWORK", "ipCidrRange": "10.1.3.0/24", "region": "projects/PROJECT_ID/regions/REGION_B",}

Console

1. In the Google Cloud console, go to theFirewall policies page.

   Go to Firewall policies

2. ClickCreate firewall rule to create the rule to allow incomingSSH connections:

   • Name:fw-ilb-to-backends
   • Network:NETWORK
   • Direction of traffic:Ingress
   • Action on match:Allow
   • Targets:Specified target tags
   • Target tags:allow-ssh
   • Source filter:IPv4 ranges
   • Source IPv4 ranges:0.0.0.0/0
   • Protocols and ports:
     • ChooseSpecified protocols and ports.
     • Select theTCP checkbox, and then enter22 for the port number.

3. ClickCreate.

4. ClickCreate firewall rule a second time to create the rule to allowGoogle Cloud health checks:

   • Name:fw-healthcheck
   • Network:NETWORK
   • Direction of traffic:Ingress
   • Action on match:Allow
   • Targets:Specified target tags
   • Target tags:load-balanced-backend
   • Source filter:IPv4 ranges
   • Source IPv4 ranges:130.211.0.0/22 and35.191.0.0/16

   • Protocols and ports:

     • ChooseSpecified protocols and ports.
     • Select theTCP checkbox, and then enter80 for the port number.

     As a best practice, limit this rule to just the protocols and portsthat match those used by your health check. If you usetcp:80 forthe protocol and port, Google Cloud can useHTTP on port80 to contact your VMs, but it cannot use HTTPS onport443 to contact them.

5. ClickCreate.

6. ClickCreate firewall rule a third time to create the rule to allowthe load balancer's proxy servers to connect the backends:

   • Name:fw-backends
   • Network:NETWORK
   • Direction of traffic:Ingress
   • Action on match:Allow
   • Targets:Specified target tags
   • Target tags:load-balanced-backend
   • Source filter:IPv4 ranges
   • Source IPv4 ranges:10.129.0.0/23 and10.130.0.0/23
   • Protocols and ports:
     • ChooseSpecified protocols and ports.
     • Select theTCP checkbox, and then enter80, 443, 8080 for theport numbers.

7. ClickCreate.

gcloud

1. Create thefw-ilb-to-backends firewall rule to allow SSH connectivity toVMs with the network tagallow-ssh. When you omitsource-ranges,Google Cloudinterprets the rule to mean anysource.

   gcloud compute firewall-rules create fw-ilb-to-backends \    --network=NETWORK \    --action=allow \    --direction=ingress \    --target-tags=allow-ssh \    --rules=tcp:22

2. Create thefw-healthcheck rule to allow Google Cloudhealth checks. This example allows all TCP traffic from health checkprobers; however, you can configure a narrower set of ports to meet yourneeds.

   gcloud compute firewall-rules create fw-healthcheck \    --network=NETWORK \    --action=allow \    --direction=ingress \    --source-ranges=130.211.0.0/22,35.191.0.0/16 \    --target-tags=load-balanced-backend \    --rules=tcp

3. Create thefw-backends rule to allow the internal Application Load Balancer'sproxies to connect to your backends. Setsource-ranges to theallocated ranges of your proxy-only subnet,for example,10.129.0.0/23 and10.130.0.0/23.

   gcloud compute firewall-rules create fw-backends \    --network=NETWORK \    --action=allow \    --direction=ingress \    --source-ranges=source-range \    --target-tags=load-balanced-backend \    --rules=tcp:80,tcp:443,tcp:8080

Terraform

To create the firewall rules, use thegoogle_compute_firewall resource.

resource "google_compute_firewall" "fw_healthcheck" {  name          = "gl7-ilb-fw-allow-hc"  provider      = google-beta  direction     = "INGRESS"  network       = google_compute_network.default.id  source_ranges = ["130.211.0.0/22", "35.191.0.0/16", "35.235.240.0/20"]  allow {    protocol = "tcp"  }}

resource "google_compute_firewall" "fw_ilb_to_backends" {  name          = "fw-ilb-to-fw"  provider      = google-beta  network       = google_compute_network.default.id  source_ranges = ["0.0.0.0/0"]  allow {    protocol = "tcp"    ports    = ["22", "80", "443", "8080"]  }}

resource "google_compute_firewall" "fw_backends" {  name          = "gl7-ilb-fw-allow-ilb-to-backends"  direction     = "INGRESS"  network       = google_compute_network.default.id  source_ranges = ["10.129.0.0/23", "10.130.0.0/23"]  target_tags   = ["http-server"]  allow {    protocol = "tcp"    ports    = ["80", "443", "8080"]  }}

API

Create thefw-ilb-to-backends firewall rule by making aPOST request tothefirewalls.insert method,replacingPROJECT_ID with your project ID.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls{ "name": "fw-ilb-to-backends", "network": "projects/PROJECT_ID/global/networks/NETWORK", "sourceRanges": [   "0.0.0.0/0" ], "targetTags": [   "allow-ssh" ], "allowed": [  {    "IPProtocol": "tcp",    "ports": [      "22"    ]  } ],"direction": "INGRESS"}

Create thefw-healthcheck firewall rule by making aPOST request tothefirewalls.insert method,replacingPROJECT_ID with your project ID.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls{ "name": "fw-healthcheck", "network": "projects/PROJECT_ID/global/networks/NETWORK", "sourceRanges": [   "130.211.0.0/22",   "35.191.0.0/16" ], "targetTags": [   "load-balanced-backend" ], "allowed": [   {     "IPProtocol": "tcp"   } ], "direction": "INGRESS"}

Create thefw-backends firewall rule to allow TCP traffic within theproxy subnet for thefirewalls.insert method,replacingPROJECT_ID with your project ID.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls{ "name": "fw-backends", "network": "projects/PROJECT_ID/global/networks/NETWORK", "sourceRanges": [   "10.129.0.0/23",   "10.130.0.0/23" ], "targetTags": [   "load-balanced-backend" ], "allowed": [   {     "IPProtocol": "tcp",     "ports": [       "80"     ]   }, {     "IPProtocol": "tcp",     "ports": [       "443"     ]   },   {     "IPProtocol": "tcp",     "ports": [       "8080"     ]   } ], "direction": "INGRESS"}

Console

1. In the Google Cloud console, go totheInstance templates page.

   Go to Instance templates

   1. ClickCreate instance template.
   2. ForName, entergil7-backendeast1-template.
   3. Ensure that theBoot disk is set to a Debian image, such asDebian GNU/Linux 12 (bookworm). These instructions use commands thatare only available on Debian, such asapt-get.
   4. ClickAdvanced options.
   5. ClickNetworking and configure the following fields:
      1. ForNetwork tags, enterallow-ssh andload-balanced-backend.
      2. ForNetwork interfaces, select the following:
         • Network:NETWORK
         • Subnet:SUBNET_B

   6. ClickManagement. Enter the following script into theStartup script field.

      #! /bin/bashapt-get updateapt-get install apache2 -ya2ensite default-ssla2enmod sslvm_hostname="$(curl -H "Metadata-Flavor:Google" \http://169.254.169.254/computeMetadata/v1/instance/name)"echo "Page served from: $vm_hostname" | \tee /var/www/html/index.htmlsystemctl restart apache2

   7. ClickCreate.

   8. ClickCreate instance template.

   9. ForName, entergil7-backendwest1-template.

   10. Ensure that theBoot disk is set to a Debian image, such asDebian GNU/Linux 12 (bookworm). These instructions use commands thatare only available on Debian, such asapt-get.

   11. ClickAdvanced options.

   12. ClickNetworking and configure the following fields:

       1. ForNetwork tags, enterallow-ssh andload-balanced-backend.
       2. ForNetwork interfaces, select the following:
          • Network:NETWORK
          • Subnet:SUBNET_A

   13. ClickManagement. Enter the following script into theStartup script field.

       #! /bin/bashapt-get updateapt-get install apache2 -ya2ensite default-ssla2enmod sslvm_hostname="$(curl -H "Metadata-Flavor:Google" \http://169.254.169.254/computeMetadata/v1/instance/name)"echo "Page served from: $vm_hostname" | \tee /var/www/html/index.htmlsystemctl restart apache2

   14. ClickCreate.

2. In the Google Cloud console, go to theInstance groups page.

   Go to Instance groups

   1. ClickCreate instance group.
   2. SelectNew managed instance group (stateless). For moreinformation, seeStateless or stateful MIGs.
   3. ForName, entergl7-ilb-mig-a.
   4. ForLocation, selectSingle zone.
   5. ForRegion, selectREGION_A.
   6. ForZone, selectZONE_A.
   7. ForInstance template, selectgil7-backendwest1-template.

   8. Specify the number of instances that you want to create in the group.

      For this example, specify the following options underAutoscaling:

      • ForAutoscaling mode, selectOff:do not autoscale.
      • ForMaximum number of instances, enter2.

      Optionally, in theAutoscaling section of the UI, you can configurethe instance group toautomatically add or removeinstances based on instance CPU use.

   9. ClickCreate.

   10. ClickCreate instance group.

   11. SelectNew managed instance group (stateless). For moreinformation, seeStateless or stateful MIGs.

   12. ForName, entergl7-ilb-mig-b.

   13. ForLocation, selectSingle zone.

   14. ForRegion, selectREGION_B.

   15. ForZone, selectZONE_B.

   16. ForInstance template, selectgil7-backendeast1-template.

   17. Specify the number of instances that you want to create in the group.

       For this example, specify the following options underAutoscaling:

       • ForAutoscaling mode, selectOff:do not autoscale.
       • ForMaximum number of instances, enter2.

       Optionally, in theAutoscaling section of the UI, you can configurethe instance group toautomatically add or removeinstances based on instance CPU usage.

   18. ClickCreate.

gcloud

The gcloud CLI instructions in this guide assume that you are usingCloud Shell or another environment with bash installed.

1. Create a VM instance template with HTTP server with thegcloud compute instance-templates create command.

   gcloud compute instance-templates create gil7-backendwest1-template \  --region=REGION_A \  --network=NETWORK \  --subnet=SUBNET_A \  --tags=allow-ssh,load-balanced-backend \  --image-family=debian-12 \  --image-project=debian-cloud \  --metadata=startup-script='#! /bin/bash    apt-get update    apt-get install apache2 -y    a2ensite default-ssl    a2enmod ssl    vm_hostname="$(curl -H "Metadata-Flavor:Google" \    http://169.254.169.254/computeMetadata/v1/instance/name)"    echo "Page served from: $vm_hostname" | \    tee /var/www/html/index.html    systemctl restart apache2'

   gcloud compute instance-templates create gil7-backendeast1-template \    --region=REGION_B \    --network=NETWORK \    --subnet=SUBNET_B \    --tags=allow-ssh,load-balanced-backend \    --image-family=debian-12 \    --image-project=debian-cloud \    --metadata=startup-script='#! /bin/bash      apt-get update      apt-get install apache2 -y      a2ensite default-ssl      a2enmod ssl      vm_hostname="$(curl -H "Metadata-Flavor:Google" \      http://169.254.169.254/computeMetadata/v1/instance/name)"      echo "Page served from: $vm_hostname" | \      tee /var/www/html/index.html      systemctl restart apache2'

2. Create a managed instance group in the zone with thegcloud computeinstance-groups managed create command.

   gcloud compute instance-groups managed create gl7-ilb-mig-a \    --zone=ZONE_A \    --size=2 \    --template=gil7-backendwest1-template

   gcloud compute instance-groups managed create gl7-ilb-mig-b \    --zone=ZONE_B \    --size=2 \    --template=gil7-backendeast1-template

Terraform

To create the instance template, use thegoogle_compute_instance_template resource.

resource "google_compute_instance_template" "instance_template_a" {  name         = "gil7-backendwest1-template"  provider     = google-beta  machine_type = "e2-small"  region       = "us-west1"  tags         = ["http-server"]  network_interface {    network    = google_compute_network.default.id    subnetwork = google_compute_subnetwork.subnet_a.id    access_config {      # add external ip to fetch packages    }  }  disk {    source_image = "debian-cloud/debian-11"    auto_delete  = true    boot         = true  }  # install nginx and serve a simple web page  metadata = {    startup-script = <<-EOF1      #! /bin/bash      set -euo pipefail      export DEBIAN_FRONTEND=noninteractive      apt-get update      apt-get install -y nginx-light jq      NAME=$(curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/hostname")      IP=$(curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip")      METADATA=$(curl -f -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/attributes/?recursive=True" | jq 'del(.["startup-script"])')      cat <<EOF > /var/www/html/index.html      <pre>      Name: $NAME      IP: $IP      Metadata: $METADATA      </pre>      EOF    EOF1  }  lifecycle {    create_before_destroy = true  }}

resource "google_compute_instance_template" "instance_template_b" {  name         = "gil7-backendeast1-template"  provider     = google-beta  machine_type = "e2-small"  region       = "us-east1"  tags         = ["http-server"]  network_interface {    network    = google_compute_network.default.id    subnetwork = google_compute_subnetwork.subnet_b.id    access_config {      # add external ip to fetch packages    }  }  disk {    source_image = "debian-cloud/debian-11"    auto_delete  = true    boot         = true  }  # install nginx and serve a simple web page  metadata = {    startup-script = <<-EOF1      #! /bin/bash      set -euo pipefail      export DEBIAN_FRONTEND=noninteractive      apt-get update      apt-get install -y nginx-light jq      NAME=$(curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/hostname")      IP=$(curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip")      METADATA=$(curl -f -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/attributes/?recursive=True" | jq 'del(.["startup-script"])')      cat <<EOF > /var/www/html/index.html      <pre>      Name: $NAME      IP: $IP      Metadata: $METADATA      </pre>      EOF    EOF1  }  lifecycle {    create_before_destroy = true  }}

To create the managed instance group, use thegoogle_compute_instance_group_manager resource.

resource "google_compute_region_instance_group_manager" "mig_a" {  name     = "gl7-ilb-miga"  provider = google-beta  region   = "us-west1"  version {    instance_template = google_compute_instance_template.instance_template_a.id    name              = "primary"  }  base_instance_name = "vm"  target_size        = 2}

resource "google_compute_region_instance_group_manager" "mig_b" {  name     = "gl7-ilb-migb"  provider = google-beta  region   = "us-east1"  version {    instance_template = google_compute_instance_template.instance_template_b.id    name              = "primary"  }  base_instance_name = "vm"  target_size        = 2}

API

Create the instance template with theinstanceTemplates.insert method,replacingPROJECT_ID with your project ID.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/instanceTemplates{  "name":"gil7-backendwest1-template",  "properties":{     "machineType":"e2-standard-2",     "tags":{       "items":[         "allow-ssh",         "load-balanced-backend"       ]     },     "metadata":{        "kind":"compute#metadata",        "items":[          {            "key":"startup-script",            "value":"#! /bin/bash\napt-get update\napt-get install            apache2 -y\na2ensite default-ssl\na2enmod ssl\n            vm_hostname=\"$(curl -H \"Metadata-Flavor:Google\"            \\\nhttp://169.254.169.254/computeMetadata/v1/instance/name)\"\n            echo \"Page served from: $vm_hostname\" | \\\ntee            /var/www/html/index.html\nsystemctl restart apache2"          }        ]     },     "networkInterfaces":[       {         "network":"projects/PROJECT_ID/global/networks/NETWORK",         "subnetwork":"regions/REGION_A/subnetworks/SUBNET_A",         "accessConfigs":[           {             "type":"ONE_TO_ONE_NAT"           }         ]       }     ],     "disks":[       {         "index":0,         "boot":true,         "initializeParams":{           "sourceImage":"projects/debian-cloud/global/images/family/debian-12"         },         "autoDelete":true       }     ]  }}

Create a managed instance group in each zone with theinstanceGroupManagers.insert method,replacingPROJECT_ID with your project ID.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/{zone}/instanceGroupManagers{  "name": "gl7-ilb-mig-a",  "zone": "projects/PROJECT_ID/zones/ZONE_A",  "instanceTemplate": "projects/PROJECT_ID/global/instanceTemplates/gil7-backendwest1-template",  "baseInstanceName": "gl7-ilb-mig-b",  "targetSize": 2}

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/instanceTemplates{  "name":"gil7-backendeast1-template",  "properties":{     "machineType":"e2-standard-2",     "tags":{       "items":[         "allow-ssh",         "load-balanced-backend"       ]     },     "metadata":{        "kind":"compute#metadata",        "items":[          {            "key":"startup-script",            "value":"#! /bin/bash\napt-get update\napt-get install            apache2 -y\na2ensite default-ssl\na2enmod ssl\n            vm_hostname=\"$(curl -H \"Metadata-Flavor:Google\"            \\\nhttp://169.254.169.254/computeMetadata/v1/instance/name)\"\n            echo \"Page served from: $vm_hostname\" | \\\ntee            /var/www/html/index.html\nsystemctl restart apache2"          }        ]     },     "networkInterfaces":[       {         "network":"projects/PROJECT_ID/global/networks/NETWORK",         "subnetwork":"regions/REGION_B/subnetworks/SUBNET_B",         "accessConfigs":[           {             "type":"ONE_TO_ONE_NAT"           }         ]       }     ],     "disks":[       {         "index":0,         "boot":true,         "initializeParams":{           "sourceImage":"projects/debian-cloud/global/images/family/debian-12"         },         "autoDelete":true       }     ]  }}

Create a managed instance group in each zone with theinstanceGroupManagers.insert method,replacingPROJECT_ID with your project ID.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/{zone}/instanceGroupManagers{  "name": "gl7-ilb-mig-b",  "zone": "projects/PROJECT_ID/zones/ZONE_B",  "instanceTemplate": "projects/PROJECT_ID/global/instanceTemplates/gil7-backendwest1-template",  "baseInstanceName": "gl7-ilb-mig-b",  "targetSize": 2}

Console

Select the load balancer type

1. In the Google Cloud console, go to theLoad balancing page.

   Go to Load balancing

2. ClickCreate load balancer.
3. ForType of load balancer, selectApplication Load Balancer (HTTP/HTTPS) and clickNext.
4. ForPublic facing or internal, selectInternal and clickNext.
5. ForCross-region or single region deployment, selectBest for cross-region workloads and clickNext.
6. ClickConfigure.

Basic configuration

1. Provide aName for the load balancer.
2. ForNetwork, selectNETWORK.

Configure the frontend with two forwarding rules

For HTTP:

1. ClickFrontend configuration.
1. Provide aName for the forwarding rule.
2. In theSubnetwork region list, selectREGION_A.
   

   Reserve a proxy-only subnet

If you already configured theproxy-only subnet, theReserve subnet button isn't displayed.You can continue with the next steps.
3. In theSubnetwork list, selectSUBNET_A.
4. In theIP address list, clickCreate IP address. TheReserve a static internal IP address page opens.
• Provide aName for the static IP address.
• In theStatic IP address list, selectLet me choose.
• In theCustom IP address field, enter10.1.2.99.
• SelectReserve.
2. ClickDone.
3. To add the second forwarding rule, clickAdd frontend IP and port.
1. Provide aName for the forwarding rule.
2. In theSubnetwork region list, selectREGION_B.
   

   Reserve a proxy-only subnet

Because you have already configured theproxy-only subnet, theReserve subnet button isn't displayed.You can continue with the next steps.
3. In theSubnetwork list, selectSUBNET_B.
4. In theIP address list, clickCreate IP address. TheReserve a static internal IP address page opens.
• Provide aName for the static IP address.
• In theStatic IP address list, selectLet me choose.
• In theCustom IP address field, enter10.1.3.99.
• SelectReserve.
4. ClickDone.

For HTTPS:

To assign an SSL certificate to the target HTTPS proxy of the load balancer, you need to use a Certificate Manager certificate.

1. ClickFrontend configuration.
1. Provide aName for the forwarding rule.
2. In theProtocol field, selectHTTPS (includes HTTP/2).
3. Ensure that thePort is set to443.
4. In theSubnetwork region list, selectREGION_A.
   

   Reserve a proxy-only subnet

Because you have already configured theproxy-only subnet,theReserve subnet button isn't displayed.You can continue with the next steps.
5. In theSubnetwork list, selectSUBNET_A.
6. In theIP address list, clickCreate IP address. TheReserve a static internal IP address page opens.
• Provide aName for the static IP address.
• In theStatic IP address list, selectLet me choose.
• In theCustom IP address field, enter10.1.3.99.
• SelectReserve.
7. ClickAdd certificate to select an existing certificate or create a new certificate.

   If you already have an existing Certificate Manager certificate to select, do the following:

   1. ClickAdd Certificate.
   2. ClickSelect an existing certificate and select the certificate from the list of certificates.
   3. ClickSelect.

   After you select the new Certificate Manager certificate, it appears in the list of certificates.

   To create a new Certificate Manager certificate, do the following:

   1. ClickAdd Certificate.
   2. ClickCreate a new certificate.
   3. To create a new certificate, follow the steps starting fromstep 3 as outlined in any one of the following configuration methods in the Certificate Manager documentation:
      • Create a Google-managed certificate referencing the DNS authorization
      • Create a Google-managed certificate issued by your CA Service instance
      • Upload a self-managed certificate to Certificate Manager
8. Select an SSL policy from theSSL policy list. If you have not created any SSL policies, adefault Google Cloud SSL policy is applied.
9. ClickDone.

Add the second frontend configuration:

1. Provide aName for the frontend configuration.
2. In theProtocol field, selectHTTPS (includes HTTP/2).
3. Ensure that thePort is set to443.
4. In theSubnetwork region list, selectREGION_B.
   

   Reserve a proxy-only subnet

Because you have already configured theproxy-only subnet,theReserve subnet button isn't displayed.You can continue with the next steps.
5. In theSubnetwork list, selectSUBNET_B.
6. In theIP address list, clickCreate IP address. TheReserve a static internal IP address page opens.
• Provide aName for the static IP address.
• In theStatic IP address list, selectLet me choose.
• In theCustom IP address field, enter10.1.3.99.
• SelectReserve.
7. ClickAdd certificate and then select an existing certificateor create a new certificate.
8. Select an SSL policy from theSSL policy list. If you have not created any SSL policies, adefault Google Cloud SSL policy is applied.
9. ClickDone.
Configure the backend service
1. ClickBackend configuration.
2. In theCreate or select backend services list, clickCreate a backend service.
3. Provide aName for the backend service.
4. ForProtocol, selectHTTP.
5. ForNamed Port, enterhttp.
6. In theBackend type list, selectInstance group.
7. In theHealth check list, clickCreate a health check, and then enter the following information:
• In theName field, enterglobal-http-health-check.
• In theProtocol list, selectHTTP.
• In thePort field, enter80.
• ClickCreate.
8. In theNew backend section:
1. In theInstance group list, selectgl4-ilb-miga inREGION_A.
2. SetPort numbers to80.
3. For theBalancing mode, selectUtilization.
4. ClickDone.
5. To add another backend, clickAdd backend.
6. In theInstance group list, selectgl4-ilb-migb inREGION_B.
7. SetPort numbers to80.
8. ClickDone.

Configure the routing rules

1. ClickRouting rules.
2. ForMode, selectSimple host and path rule.
3. Ensure that there is only one backend service for any unmatched host and any unmatched path.

Review the configuration

1. ClickReview and finalize.
2. Review your load balancer configuration settings.
3. ClickCreate.

gcloud

1. Define the HTTP health check with thegcloud compute health-checkscreate http command.

   gcloud compute health-checks create http global-http-health-check \   --use-serving-port \   --global

2. Define the backend service with thegcloud compute backend-servicescreate command.

   gcloud compute backend-services createBACKEND_SERVICE_NAME \  --load-balancing-scheme=INTERNAL_MANAGED \  --protocol=HTTP \  --enable-logging \  --logging-sample-rate=1.0 \  --health-checks=global-http-health-check \  --global-health-checks \  --global

3. Add backends to the backend service with thegcloud compute backend-servicesadd-backend command.

   gcloud compute backend-services add-backendBACKEND_SERVICE_NAME \  --balancing-mode=UTILIZATION \  --instance-group=gl7-ilb-mig-a \  --instance-group-zone=ZONE_A \  --global

   gcloud compute backend-services add-backendBACKEND_SERVICE_NAME \  --balancing-mode=UTILIZATION \  --instance-group=gl7-ilb-mig-b \  --instance-group-zone=ZONE_B \  --global

4. Create the URL map with thegcloud compute url-mapscreate command.

   gcloud compute url-maps create gl7-gilb-url-map \  --default-service=BACKEND_SERVICE_NAME \  --global

5. Create the target proxy.

   For HTTP:

   Create the target proxy with thegcloud compute target-http-proxiescreate command.

   gcloud compute target-http-proxies create gil7-http-proxy \  --url-map=gl7-gilb-url-map \  --global

   For HTTPS:

   To create a Google-managed certificate, see the following documentation:

   • Create a Google-managed certificate issued by your Certificate Authority Service instance.
   • Create a Google-managed certificate with DNS authorization.

   After you create the Google-managed certificate,attach the certificate directly to the target proxy.Certificate maps are not supported by cross-region internal Application Load Balancers.

   To create a self-managed certificate, see the following documentation:

   • Create a private key and certificate.

   Assign your file paths to variable names.

   export LB_CERT=PATH_TO_PEM_FORMATTED_FILE

   export LB_PRIVATE_KEY=PATH_TO_LB_PRIVATE_KEY_FILE

   Create an all region SSL certificate using thegcloud beta certificate-managercertificates create command.

   gcloud certificate-manager certificates create gilb-certificate \  --private-key-file=$LB_PRIVATE_KEY \  --certificate-file=$LB_CERT \  --scope=all-regions

   Use the SSL certificate to create a target proxy with thegcloudcompute target-https-proxies create command

   gcloud compute target-https-proxies create gil7-https-proxy \  --url-map=gl7-gilb-url-map \  --certificate-manager-certificates=gilb-certificate \  --global

6. Create two forwarding rules, one with a VIP (10.1.2.99) in theREGION_B region and another one with aVIP (10.1.3.99) in theREGION_A region.For more information, seeReserve a static internal IPv4 address.

   For custom networks, you must reference the subnet in the forwardingrule. Note that this is the VM subnet, not the proxy subnet.

   For HTTP:

   Use thegcloud compute forwarding-rulescreate commandwith the correct flags.

   gcloud compute forwarding-rules createFWRULE_A \  --load-balancing-scheme=INTERNAL_MANAGED \  --network=NETWORK \  --subnet=SUBNET_A \  --subnet-region=REGION_A \  --address=10.1.2.99 \  --ports=80 \  --target-http-proxy=gil7-http-proxy \  --global

   gcloud compute forwarding-rules createFWRULE_B \  --load-balancing-scheme=INTERNAL_MANAGED \  --network=NETWORK \  --subnet=SUBNET_B \  --subnet-region=REGION_B \  --address=10.1.3.99 \  --ports=80 \  --target-http-proxy=gil7-http-proxy \  --global

   For HTTPS:

   Use thegcloud compute forwarding-rulescreate commandwith the correct flags.

   gcloud compute forwarding-rules createFWRULE_A \  --load-balancing-scheme=INTERNAL_MANAGED \  --network=NETWORK \  --subnet=SUBNET_A \  --subnet-region=REGION_A \  --address=10.1.2.99 \  --ports=443 \  --target-https-proxy=gil7-https-proxy \  --global

   gcloud compute forwarding-rules createFWRULE_B \  --load-balancing-scheme=INTERNAL_MANAGED \  --network=NETWORK \  --subnet=SUBNET_B \  --subnet-region=REGION_B \  --address=10.1.3.99 \  --ports=443 \  --target-https-proxy=gil7-https-proxy \  --global

Terraform

To create the health check, use thegoogle_compute_health_check resource.

resource "google_compute_health_check" "default" {  provider = google-beta  name     = "global-http-health-check"  http_health_check {    port_specification = "USE_SERVING_PORT"  }}

To create the backend service, use thegoogle_compute_backend_service resource.

resource "google_compute_backend_service" "default" {  name                  = "gl7-gilb-backend-service"  provider              = google-beta  protocol              = "HTTP"  load_balancing_scheme = "INTERNAL_MANAGED"  timeout_sec           = 10  health_checks         = [google_compute_health_check.default.id]  backend {    group           = google_compute_region_instance_group_manager.mig_a.instance_group    balancing_mode  = "UTILIZATION"    capacity_scaler = 1.0  }  backend {    group           = google_compute_region_instance_group_manager.mig_b.instance_group    balancing_mode  = "UTILIZATION"    capacity_scaler = 1.0  }}

To create the URL map, use thegoogle_compute_url_map resource.

resource "google_compute_url_map" "default" {  name            = "gl7-gilb-url-map"  provider        = google-beta  default_service = google_compute_backend_service.default.id}

To create the target HTTP proxy, use thegoogle_compute_target_http_proxy resource.

resource "google_compute_target_http_proxy" "default" {  name     = "gil7target-http-proxy"  provider = google-beta  url_map  = google_compute_url_map.default.id}

To create the forwarding rules, use thegoogle_compute_forwarding_rule resource.

resource "google_compute_global_forwarding_rule" "fwd_rule_a" {  provider              = google-beta  depends_on            = [google_compute_subnetwork.proxy_subnet_a]  ip_address            = "10.1.2.99"  ip_protocol           = "TCP"  load_balancing_scheme = "INTERNAL_MANAGED"  name                  = "gil7forwarding-rule-a"  network               = google_compute_network.default.id  port_range            = "80"  target                = google_compute_target_http_proxy.default.id  subnetwork            = google_compute_subnetwork.subnet_a.id}

resource "google_compute_global_forwarding_rule" "fwd_rule_b" {  provider              = google-beta  depends_on            = [google_compute_subnetwork.proxy_subnet_b]  ip_address            = "10.1.3.99"  ip_protocol           = "TCP"  load_balancing_scheme = "INTERNAL_MANAGED"  name                  = "gil7forwarding-rule-b"  network               = google_compute_network.default.id  port_range            = "80"  target                = google_compute_target_http_proxy.default.id  subnetwork            = google_compute_subnetwork.subnet_b.id}

To learn how to apply or remove a Terraform configuration, seeBasic Terraform commands.

API

Create the health check by making aPOST request to thehealthChecks.insert method,replacingPROJECT_ID with your project ID.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/healthChecks{"name": "global-http-health-check","type": "HTTP","httpHealthCheck": {  "portSpecification": "USE_SERVING_PORT"}}

Create the global backend service by making aPOST request to thebackendServices.insert method,replacingPROJECT_ID with your project ID.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/backendServices{"name": "BACKEND_SERVICE_NAME","backends": [  {    "group": "projects/PROJECT_ID/zones/ZONE_A/instanceGroups/gl7-ilb-mig-a",    "balancingMode": "UTILIZATION"  },  {    "group": "projects/PROJECT_ID/zones/ZONE_B/instanceGroups/gl7-ilb-mig-b",    "balancingMode": "UTILIZATION"  }],"healthChecks": [  "projects/PROJECT_ID/regions/global/healthChecks/global-http-health-check"],"loadBalancingScheme": "INTERNAL_MANAGED"}

Create the URL map by making aPOST request to theurlMaps.insert method,replacingPROJECT_ID with your project ID.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/urlMaps{"name": "l7-ilb-map","defaultService": "projects/PROJECT_ID/global/backendServices/BACKEND_SERVICE_NAME"}

For HTTP:

Create the target HTTP proxy by making aPOST request to thetargetHttpProxies.insert method,replacingPROJECT_ID with your project ID.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/targetHttpProxy{"name": "l7-ilb-proxy","urlMap": "projects/PROJECT_ID/global/urlMaps/l7-ilb-map"}

Create the forwarding rule by making aPOST request to theforwardingRules.insert method,replacingPROJECT_ID with your project ID.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/forwardingRules{"name": "FWRULE_A","IPAddress": "10.1.2.99","IPProtocol": "TCP","portRange": "80-80","target": "projects/PROJECT_ID/global/targetHttpProxies/l7-ilb-proxy","loadBalancingScheme": "INTERNAL_MANAGED","subnetwork": "projects/PROJECT_ID/regions/REGION_A/subnetworks/SUBNET_A","network": "projects/PROJECT_ID/global/networks/NETWORK","networkTier": "PREMIUM"}

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/forwardingRules{"name": "gil7forwarding-rule-b","IPAddress": "10.1.3.99","IPProtocol": "TCP","portRange": "80-80","target": "projects/PROJECT_ID/global/targetHttpProxies/l7-ilb-proxy","loadBalancingScheme": "INTERNAL_MANAGED","subnetwork": "projects/PROJECT_ID/regions/REGION_B/subnetworks/SUBNET_B","network": "projects/PROJECT_ID/global/networks/NETWORK","networkTier": "PREMIUM"}

For HTTPS:

Read the certificate and private key files, and then create the SSLcertificate. The following example showshow to do this with Python.

frompathlibimportPathfrompprintimportpprintfromtypingimportUnionfromgoogleapiclientimportdiscoverydefcreate_regional_certificate(project_id:str,region:str,certificate_file:Union[str,Path],private_key_file:Union[str,Path],certificate_name:str,description:str="Certificate created from a code sample.",)->dict:"""    Create a regional SSL self-signed certificate within your Google Cloud project.    Args:        project_id: project ID or project number of the Cloud project you want to use.        region: name of the region you want to use.        certificate_file: path to the file with the certificate you want to create in your project.        private_key_file: path to the private key you used to sign the certificate with.        certificate_name: name for the certificate once it's created in your project.        description: description of the certificate.        Returns:        Dictionary with information about the new regional SSL self-signed certificate.    """service=discovery.build("compute","v1")# Read the cert into memorywithopen(certificate_file)asf:_temp_cert=f.read()# Read the private_key into memorywithopen(private_key_file)asf:_temp_key=f.read()# Now that the certificate and private key are in memory, you can create the# certificate resourcessl_certificate_body={"name":certificate_name,"description":description,"certificate":_temp_cert,"privateKey":_temp_key,}request=service.regionSslCertificates().insert(project=project_id,region=region,body=ssl_certificate_body)response=request.execute()pprint(response)returnresponse

Create the target HTTPS proxy by making aPOST request to thetargetHttpsProxies.insert method,replacingPROJECT_ID with your project ID.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/targetHttpsProxy{"name": "l7-ilb-proxy","urlMap": "projects/PROJECT_ID/global/urlMaps/l7-ilb-map","sslCertificates": /projects/PROJECT_ID/global/sslCertificates/SSL_CERT_NAME}

Create the forwarding rule by making aPOST request to theglobalForwardingRules.insert method,replacingPROJECT_ID with your project ID.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/forwardingRules{"name": "FWRULE_A","IPAddress": "10.1.2.99","IPProtocol": "TCP","portRange": "80-80","target": "projects/PROJECT_ID/global/targetHttpsProxies/l7-ilb-proxy","loadBalancingScheme": "INTERNAL_MANAGED","subnetwork": "projects/PROJECT_ID/regions/REGION_A/subnetworks/SUBNET_A","network": "projects/PROJECT_ID/global/networks/NETWORK","networkTier": "PREMIUM"}

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/forwardingRules{"name": "FWRULE_B","IPAddress": "10.1.3.99","IPProtocol": "TCP","portRange": "80-80","target": "projects/PROJECT_ID/global/targetHttpsProxies/l7-ilb-proxy","loadBalancingScheme": "INTERNAL_MANAGED","subnetwork": "projects/PROJECT_ID/regions/REGION_B/subnetworks/SUBNET_B","network": "projects/PROJECT_ID/global/networks/NETWORK","networkTier": "PREMIUM"}

Console

To identify the client VMs,tag thespecific VMsyou want to restrict. These tags are used to associate firewall rules withthe tagged client VMs. Then, add the tag to theTARGET_TAGfield in the following steps.

Use either a single firewall rule or multiple rules to set this up.

Single egress firewall rule

You can configure one firewall egress rule to deny all egresstraffic going from tagged client VMs to a load balancer's VIP.

1. In the Google Cloud console, go to theFirewall rules page.

   Go to Firewall rules

2. ClickCreate firewall rule to create the rule to deny egresstraffic from tagged client VMs to a load balancer's VIP.

   • Name:fr-deny-access
   • Network:lb-network
   • Priority:100
   • Direction of traffic:Egress
   • Action on match:Deny
   • Targets:Specified target tags
   • Target tags:TARGET_TAG
   • Destination filter:IP ranges
   • Destination IP ranges:10.1.2.99
   • Protocols and ports:
     • ChooseSpecified protocols and ports.
     • Select thetcp checkbox, and then enter80 for the port number.

3. ClickCreate.

Multiple egress firewall rules

A more scalable approach involves setting two rules. A default, low-priorityrule that restricts all clients from accessing the load balancer's VIP. Asecond, higher-priority rule that allows a subset of tagged clients toaccess the load balancer's VIP. Only tagged VMs can access theVIP.

1. In the Google Cloud console, go to theFirewall rules page.

   Go to Firewall rules

2. ClickCreate firewall rule to create the lower priority rule to denyaccess by default:

   • Name:fr-deny-all-access-low-priority
   • Network:lb-network
   • Priority:200
   • Direction of traffic:Egress
   • Action on match:Deny
   • Targets:Specified target tags
   • Target tags:TARGET_TAG
   • Destination filter:IP ranges
   • Destination IP ranges:10.1.2.99
   • Protocols and ports:
     • ChooseSpecified protocols and ports.
     • Select theTCP checkbox, and then enter80 for the port number.

3. ClickCreate.

4. ClickCreate firewall rule to create the higher priority rule toallow traffic from certain tagged instances.

   • Name:fr-allow-some-access-high-priority
   • Network:lb-network
   • Priority:100
   • Direction of traffic:Egress
   • Action on match:Allow
   • Targets:Specified target tags
   • Target tags:TARGET_TAG
   • Destination filter:IP ranges
   • Destination IP ranges:10.1.2.99
   • Protocols and ports:
     • ChooseSpecified protocols and ports.
     • Select theTCP checkbox, and then enter80 for the port number.

5. ClickCreate.

gcloud

To identify the client VMs,tag thespecific VMsyou want to restrict. Then add the tag to theTARGET_TAGfield in these steps.

Use either a single firewall rule or multiple rules to set this up.

Single egress firewall rule

You can configure one firewall egress rule to deny all egresstraffic going from tagged client VMs to a load balancer's VIP.

gcloud compute firewall-rules create fr-deny-access \    --network=lb-network \    --action=deny \    --direction=egress \    --rules=tcp \    --priority=100 \    --destination-ranges=10.1.2.99 \    --target-tags=TARGET_TAG

Multiple egress firewall rules

A more scalable approach involves setting two rules: a default, low-priorityrule that restricts all clients from accessing the load balancer's VIP, and asecond, higher-priority rule that allows a subset of tagged clients to accessthe load balancer's VIP. Only tagged VMs can access the VIP.

1. Create the lower-priority rule:

   gcloud compute firewall-rules create fr-deny-all-access-low-priority \    --network=lb-network \    --action=deny \    --direction=egress \    --rules=tcp \    --priority=200 \    --destination-ranges=10.1.2.99

2. Create the higher priority rule:

   gcloud compute firewall-rules create fr-allow-some-access-high-priority \    --network=lb-network \    --action=allow \    --direction=egress \    --rules=tcp \    --priority=100 \    --destination-ranges=10.1.2.99 \    --target-tags=TARGET_TAG

To use service accounts instead of tags to control access, usethe--target-service-accountsoptioninstead of the--target-tags flag when creating firewall rules.

gcloud

1. Create a regional subnet to use to allocate load-balanced IPaddresses for forwarding rules:

   gcloud compute networks subnets create l7-ilb-restricted-subnet \    --network=lb-network \    --region=us-west1 \    --range=10.127.0.0/24

2. Create a forwarding rule that takes an address from thesubnet. The following example uses the address10.127.0.1 from the subnetcreated in the previous step.

   gcloud compute forwarding-rules create l7-ilb-forwarding-rule-restricted \    --load-balancing-scheme=INTERNAL_MANAGED \    --network=lb-network \    --subnet=l7-ilb-restricted-subnet \    --address=10.127.0.1 \    --ports=80 \    --global \    --target-http-proxy=gil7-http-proxy

3. Create a firewall rule to restrict traffic destined for the range IPaddresses in the forwarding rule subnet (l7-ilb-restricted-subnet):

   gcloud compute firewall-rules create restrict-traffic-to-subnet \    --network=lb-network \    --action=deny \    --direction=egress \    --rules=tcp:80 \    --priority=100 \    --destination-ranges=10.127.0.0/24 \    --target-tags=TARGET_TAG

gcloud

gcloud compute addresses createSHARED_IP_ADDRESS_NAME \    --region=REGION \    --subnet=SUBNET_NAME \    --purpose=SHARED_LOADBALANCER_VIP

gcloud

To create a DNS entry with a 30 second TTL, use thegcloud dns record-sets create command.

gcloud dns record-sets createDNS_ENTRY --ttl="30" \  --type="A" --zone="service-zone" \  --routing-policy-type="GEO" \  --routing-policy-data="REGION_A=gil7-forwarding-rule-a@global;REGION_B=gil7-forwarding-rule-b@global" \  --enable-health-checking

Replace the following:

• DNS_ENTRY: DNS or domain name of the record-set

  For example,service.example.com

• REGION_A andREGION_B:the regions where you have configured the load balancer

API

Create the DNS record by making aPOST request to theResourceRecordSets.create method.ReplacePROJECT_ID with your project ID.

POST https://www.googleapis.com/dns/v1/projects/PROJECT_ID/managedZones/SERVICE_ZONE/rrsets{  "name": "DNS_ENTRY",  "type": "A",  "ttl": 30,  "routingPolicy": {    "geo": {      "items": [        {          "location": "REGION_A",          "healthCheckedTargets": {            "internalLoadBalancers": [              {                "loadBalancerType": "globalL7ilb",                "ipAddress": "IP_ADDRESS",                "port": "80",                "ipProtocol": "tcp",                "networkUrl": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/lb-network",                "project": "PROJECT_ID"              }            ]          }        },        {          "location": "REGION_B",          "healthCheckedTargets": {            "internalLoadBalancers": [              {                "loadBalancerType": "globalL7ilb",                "ipAddress": "IP_ADDRESS_B",                "port": "80",                "ipProtocol": "tcp",                "networkUrl": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/lb-network",                "project": "PROJECT_ID"              }            ]          }        }      ]    }  }}

Console

1. In the Google Cloud console, go to theLoad balancing page.

   Go to Load balancing

2. Click the name of the load balancer whose backend service you want toedit.

3. On theLoad balancer details page, clickeditEdit.

4. On theEdit cross-region internal Application Load Balancer page, clickBackend configuration.

5. On theBackend configuration page, clickeditEdit for the backend service thatyou want to modify.

6. Scroll down and expand theAdvanced configurations section.

7. In theOutlier detection section, select theEnable checkbox.

8. ClickeditEdit to configureoutlier detection.

   Verify that the following options are configured with these values:

   Property	Value
   Consecutive errors	5
   Interval	1000
   Base ejection time	30000
   Max ejection percent	50
   Enforcing consecutive errors	100

   In this example, the outlier detection analysis runs every one second. Ifthe number of consecutive HTTP5xx status codesreceived by anEnvoy proxy is five or more, the backend endpoint is ejected from theload-balancing pool of that Envoy proxy for 30 seconds. When theenforcing percentage is set to 100%, the backend service enforces theejection of unhealthy endpoints from the load-balancing pools of thosespecific Envoy proxies every time the outlier detection analysis runs. Ifthe ejection conditions are met, up to 50% of the backend endpoints fromthe load-balancing pool can be ejected.

9. ClickSave.

10. To update the backend service, clickUpdate.

11. To update the load balancer, on theEdit cross-region internal Application Load Balancer page, clickUpdate.

gcloud

1. Export the backend service into a YAML file.

   gcloud compute backend-services exportBACKEND_SERVICE_NAME \  --destination=BACKEND_SERVICE_NAME.yaml --global

   ReplaceBACKEND_SERVICE_NAME with the name of thebackend service.

2. Edit the YAML configuration of the backend service to add the fields foroutlier detection as highlighted in the following YAML configuration,in theoutlierDetection section:

   In this example, the outlier detection analysis runs every one second. Ifthe number of consecutive HTTP5xx status codesreceived by anEnvoy proxy is five or more, the backend endpoint is ejected from theload-balancing pool of that Envoy proxy for 30 seconds. When theenforcing percentage is set to 100%, the backend service enforces theejection of unhealthy endpoints from the load-balancing pools of thosespecific Envoy proxies every time the outlier detection analysis runs. Ifthe ejection conditions are met, up to 50% of the backend endpoints fromthe load-balancing pool can be ejected.

   name:BACKEND_SERVICE_NAMEbackends:- balancingMode: UTILIZATION  capacityScaler: 1.0  group: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION_A/networkEndpointGroups/SERVERLESS_NEG_NAME- balancingMode: UTILIZATION  capacityScaler: 1.0  group: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION_B/networkEndpointGroups/SERVERLESS_NEG_NAME_2outlierDetection:  baseEjectionTime:    nanos: 0    seconds: 30  consecutiveErrors: 5  enforcingConsecutiveErrors: 100  interval:    nanos: 0    seconds: 1  maxEjectionPercent: 50port: 80selfLink: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/backendServices/BACKEND_SERVICE_NAMEsessionAffinity: NONEtimeoutSec: 30...

   Replace the following:

   • BACKEND_SERVICE_NAME: the name of the backendservice
   • PROJECT_ID: the ID of your project
   • REGION_A andREGION_B:the regions where the load balancer has been configured.
   • SERVERLESS_NEG_NAME: the name of the firstserverless NEG
   • SERVERLESS_NEG_NAME_2: the name of the secondserverless NEG

3. Update the backend service by importing the latest configuration.

   gcloud compute backend-services importBACKEND_SERVICE_NAME \  --source=BACKEND_SERVICE_NAME.yaml --global

   Outlier detection is now enabled on the backend service.