Skip to main content

Choosing a Load Balancer

Exam guide§2.3

Once you know all the load balancing products, picking one is a two-step narrowing: first the traffic type, then external vs internal and global vs regional. This page is the decision guide - for the family overview and how a request flows, see Load Balancing.

Start with the traffic type​

DECISIONWhich load balancer for this traffic?
Flexible feature set for HTTP(S) applications→Application Load Balancer
TLS offload, TCP proxy, or backends in multiple regions→Proxy Network Load Balancer
Preserve client source IP, avoid proxy overhead, or non-TCP protocols (UDP, ESP, ICMP)→Passthrough Network Load Balancer
Pick this when: the traffic type is the first cut - everything else narrows from there

Then narrow by two more attributes:

  1. External or internal? Internet-facing, or reachable only inside your VPC.
  2. Global or regional? Backends deployed worldwide, or in a single region.
Application Load Balancer (HTTP / HTTPS)ExternalInternalGlobalRegionalRegionalGlobal externalApplication LoadBalancerGlobal external Application Load BalancerRegional externalApplication LoadBalancerRegional external Application Load BalancerRegional internalApplication LoadBalancerRegional internal Application Load BalancerNetwork Load Balancer (TCP / UDP / Other IP protocols)ProxyPassthroughExternalInternalExternalInternalGlobalRegionalRegionalRegionalRegionalExternal proxyNetwork LoadBalancerExternal proxy Network Load BalancerRegional externalproxy NetworkLoad BalancerRegional external proxy Network Load BalancerRegional internalproxy NetworkLoad BalancerRegional internal proxy Network Load BalancerRegional externalpassthroughNetwork LoadBalancerRegional external passthrough Network Load BalancerRegional internalpassthroughNetwork LoadBalancerRegional internal passthrough Network Load Balancer
Start from the traffic type, then narrow by external vs internal and global vs regional - each leaf is one deployment mode of Cloud Load Balancing.
GotchaOnly the passthrough Network LB preserves the client source IP

Application LBs and proxy Network LBs terminate the connection, so backends see the load balancer's IP (the real client IP moves to X-Forwarded-For). A passthrough Network LB does not proxy - backends see the true client IP, and it can carry UDP, ESP, and ICMP, not just TCP. If the requirement says "expose client IP to the application" or "load balance UDP", it is passthrough.

Summary table​

If you prefer a table to the flow chart, this maps every deployment mode to its traffic type, network service tier, and load-balancing scheme.

Load balancerDeployment modeTraffic typeNetwork Service TierLoad-balancing schemeApplicationLoad BalancersProxy NetworkLoad BalancersPassthrough NetworkLoad BalancersGlobal externalHTTP or HTTPSPremiumEXTERNAL_MANAGEDRegional externalHTTP or HTTPSStandardEXTERNAL_MANAGEDClassicHTTP or HTTPSGlobal in Premium,Regional in StandardEXTERNALInternalAlways regionalHTTP or HTTPSPremiumINTERNAL_MANAGEDGlobal externalTCP with optionalSSL offloadGlobal in Premium,Regional in StandardEXTERNALRegional externalTCPStandard onlyEXTERNAL_MANAGEDInternalAlways regionalTCP without SSL offloadPremium onlyINTERNAL_MANAGEDExternalAlways regionalTCP, UDP, ESP, GRE,ICMP, and ICMPv6Premium or StandardEXTERNALInternalAlways regionalTCP or UDPPremium onlyINTERNAL
The same nine deployment modes as the flow chart, mapped to traffic type, network service tier, and load-balancing scheme.

The load-balancing scheme​

The load-balancing scheme is an attribute on the load balancer's forwarding rule and backend service. It says whether the load balancer serves internal or external traffic, and whether it runs as a managed service.

FactsReading a load-balancing scheme
  • EXTERNAL / INTERNAL - the older, non-managed schemes (classic external Application LB, passthrough Network LBs).
  • EXTERNAL_MANAGED / INTERNAL_MANAGED - the newer managed schemes for the modern Application and proxy Network LBs.
  • MANAGED means the data plane runs on a Google-operated service - either Google Front Ends (GFEs) or the open-source Envoy proxy - and requests are routed through the GFE or Envoy proxy.
GotchaMANAGED = the request rides a Google-run proxy

A *_MANAGED scheme is not just a naming convention - it means the load balancer terminates and routes through a GFE or Envoy proxy fleet Google runs for you. Passthrough Network LBs (EXTERNAL / INTERNAL) are not managed in this sense: they forward packets without a proxy, which is exactly why they preserve the client IP.

0%0 of 147 pages studied