Before you begin
- Labs create a Google Cloud project and resources for a fixed time
- Labs have a time limit and no pause feature. If you restart it, you'll have to start from the beginning.
- On the top left of your screen, click Start lab to begin
Configure HTTP and health check firewall rules
/ 25
Configure instance templates and instance group
/ 25
Configure the HTTP Load Balancer
/ 25
Blacklist the siege-vm
/ 25
Google Cloud Application Load Balancing is implemented at the edge of Google's network in Google's points of presence (POP) around the world. User traffic directed to an Application Load Balancer enters the POP closest to the user and is then load balanced over Google's global network to the closest backend that has sufficient capacity available.
Cloud Armor IP allowlist/denylist enable you to restrict or allow access to your Application Load Balancer at the edge of the Google Cloud, as close as possible to the user and to malicious traffic. This prevents malicious users or traffic from consuming resources or entering your Virtual Private Cloud (VPC) networks.
In this lab, you configure an Application Load Balancer with global backends, as shown in the diagram below. Then, you stress test the Load Balancer and denylist the stress test IP with Cloud Armor.
In this lab, you learn how to perform the following tasks:
Read these instructions. Labs are timed and you cannot pause them. The timer, which starts when you click Start Lab, shows how long Google Cloud resources are made available to you.
This hands-on lab lets you do the lab activities in a real cloud environment, not in a simulation or demo environment. It does so by giving you new, temporary credentials you use to sign in and access Google Cloud for the duration of the lab.
To complete this lab, you need:
Click the Start Lab button. If you need to pay for the lab, a dialog opens for you to select your payment method. On the left is the Lab Details pane with the following:
Click Open Google Cloud console (or right-click and select Open Link in Incognito Window if you are running the Chrome browser).
The lab spins up resources, and then opens another tab that shows the Sign in page.
Tip: Arrange the tabs in separate windows, side-by-side.
If necessary, copy the Username below and paste it into the Sign in dialog.
You can also find the Username in the Lab Details pane.
Click Next.
Copy the Password below and paste it into the Welcome dialog.
You can also find the Password in the Lab Details pane.
Click Next.
Click through the subsequent pages:
After a few moments, the Google Cloud console opens in this tab.
Configure firewall rules to allow HTTP traffic to the backends and TCP traffic from the Google Cloud health checker.
Create a firewall rule to allow HTTP traffic to the backends.
In the Cloud console, navigate to Navigation menu () > VPC network > Firewall.
Notice the existing ICMP, internal, RDP, and SSH firewall rules.
Each Google Cloud project starts with the default network and these firewall rules.
Click Create Firewall Rule.
Set the following values, leave all other values at their defaults:
Property | Value (type value or select option as specified) |
---|---|
Name | default-allow-http |
Network | default |
Targets | Specified target tags |
Target tags | http-server |
Source filter | IPv4 Ranges |
Source IPv4 ranges | 0.0.0.0/0 |
Protocols and ports | Specified protocols and ports, and then check TCP, type: 80 |
Make sure to include the /0 in the Source IPv4 ranges to specify all networks.
Health checks determine which instances of a load balancer can receive new connections. For Application Load Balancing, the health check probes to your load balanced instances come from addresses in the ranges 130.211.0.0/22
and 35.191.0.0/16
. Your firewall rules must allow these connections.
Still in the Firewall policies page, click Create Firewall Rule.
Set the following values, leave all other values at their defaults:
Property | Value (type value or select option as specified) |
---|---|
Name | default-allow-health-check |
Network | default |
Targets | Specified target tags |
Target tags | http-server |
Source filter | IPv4 Ranges |
Source IPv4 ranges |
130.211.0.0/22 , 35.191.0.0/16
|
Protocols and ports | Specified protocols and ports, and then check TCP |
Click Create.
Click Check my progress to verify the objective.
A managed instance group uses an instance template to create a group of identical instances. Use these to create the backends of the Application Load Balancer.
An instance template is an API resource that you use to create VM instances and managed instance groups. Instance templates define the machine type, boot disk image, subnet, labels, and other instance properties.
Create one instance template for
In the Cloud console, go to Navigation menu () > Compute Engine > Instance templates, and then click Create instance template.
For Name, type
For Location, Select Global.
For Series, select E2.
For Machine Type, select e2-micro.
Click Advanced Options.
Click Networking. Set the following value and leave all other values at their defaults:
Property | Value (type value or select option as specified) |
---|---|
Network tags | http-server |
Click default under Network interfaces. Set the following values and leave all other values at their defaults:
Property | Value (type value or select option as specified) |
---|---|
Network | default |
Subnetwork | default |
Click Done.
The network tag http-server ensures that the HTTP and Health Check firewall rules apply to these instances.
Click the Management tab.
Under Metadata, click + ADD ITEM and specify the following:
Key | Value |
---|---|
startup-script-url | gs://cloud-training/gcpnet/httplb/startup.sh |
The startup-script-url
specifies a script that executes when instances are started. This script installs Apache and changes the welcome page to include the client IP and the name, region, and zone of the VM instance. Feel free to explore this script.
Now create another instance template for subnet-b by copying
Create a managed instance group in
Still in Compute Engine, click Instance groups in the left menu.
Click Create instance group.
Set the following values, leave all other values at their defaults:
Property | Value (type value or select option as specified) |
---|---|
Name |
|
Instance template |
|
Location | Multiple zones |
Region | |
Minimum number of instances | 1 |
Maximum number of instances | 2 |
Autoscaling signals > Click dropdown > Signal type | CPU utilization |
Target CPU utilization | 80, click Done. |
Initialization period | 45 |
Managed instance groups offer autoscaling capabilities that allow you to automatically add or remove instances from a managed instance group based on increases or decreases in load. Autoscaling helps your applications gracefully handle increases in traffic and reduces cost when the need for resources is lower. You just define the autoscaling policy and the autoscaler performs automatic scaling based on the measured load.
Now repeat the same procedure to create a second instance group for
Click Create Instance group.
Set the following values, leave all other values at their defaults:
Property | Value (type value or select option as specified) |
---|---|
Name |
|
Instance template |
|
Location | Multiple zones |
Region | |
Minimum number of instances | 1 |
Maximum number of instances | 2 |
Autoscaling signals > Click dropdown > Signal type | CPU utilization |
Target CPU utilization | 80, click Done. |
Initialization period | 45 |
Click Create.
Click Check my progress to verify the objective.
Verify that VM instances are being created in both regions and access their HTTP sites.
Still in Compute Engine, click VM instances in the left menu.
Notice the instances that start with
These instances are part of the managed instance groups.
Click on the External IP of an instance of
You should see the Client IP (your IP address), the Hostname (starts with
Click on the External IP of an instance of
You should see the Client IP (your IP address), the Hostname (starts with
Configure the Application Load Balancer to balance traffic between the two backends (
In the Cloud console, click Navigation menu () > click VIEW ALL PRODUCTS > Networking > Network Services > Load balancing.
click Create load balancer.
Under Application Load Balancer HTTP(S), click Next.
For Public facing or internal, select Public facing (external) and click Next.
For Global or single region deployment, select Best for global workloads and click Next.
For Create load balancer, click Configure.
Set Load Balancer Name to http-lb
.
The host and path rules determine how your traffic will be directed. For example, you could direct video traffic to one backend and static traffic to another backend. However, you are not configuring the Host and path rules in this lab.
Click on Frontend configuration.
Specify the following, leaving all other values at their defaults:
Property | Value (type value or select option as specified) |
---|---|
Protocol | HTTP |
IP version | IPv4 |
IP address | Ephemeral |
Port | 80 |
Click Done.
Click Add Frontend IP and port.
Specify the following, leaving all other values at their defaults:
Property | Value (type value or select option as specified) |
---|---|
Protocol | HTTP |
IP version | IPv6 |
IP address | Auto-allocate |
Port | 80 |
Click Done.
Application Load Balancing supports both IPv4 and IPv6 addresses for client traffic. Client IPv6 requests are terminated at the global load balancing layer, then proxied over IPv4 to your backends.
Backend services direct incoming traffic to one or more attached backends. Each backend is composed of an instance group and additional serving capacity metadata.
Click on Backend configuration.
For Backend services & backend buckets, click Create a backend service.
Set the following values, leave all other values at their defaults:
Property | Value (select option as specified) |
---|---|
Name | http-backend |
Instance group |
|
Port numbers | 80 |
Balancing mode | Rate |
Maximum RPS | 50 |
Capacity | 100 |
This configuration means that the load balancer attempts to keep each instance of
Click Done.
Click Add a backend.
Set the following values, leave all other values at their defaults:
Property | Value (select option as specified) |
---|---|
Instance group |
|
Port numbers | 80 |
Balancing mode | Utilization |
Maximum backend utilization | 80 |
Capacity | 100 |
This configuration means that the load balancer attempts to keep each instance of
Click Done.
For Health Check, select Create a health check.
Set the following values, leave all other values at their defaults:
Property | Value (select option as specified) |
---|---|
Name | http-health-check |
Protocol | TCP |
Port | 80 |
Health checks determine which instances receive new connections. This HTTP health check polls instances every 5 seconds, waits up to 5 seconds for a response and treats 2 successful or 2 failed attempts as healthy or unhealthy, respectively.
1
.[LB_IP_v4]
and [LB_IP_v6]
, respectively.Click Check my progress to verify the objective.
Now that you created the Application Load Balancer for your backends, verify that traffic is forwarded to the backend service.
To test IPv4 access to the Application Load Balancer, open a new tab in your browser and navigate to http://[LB_IP_v4]
. Make sure to replace [LB_IP_v4]
with the IPv4 address of the load balancer.
If you have a local IPv6 address, try the IPv6 address of the Application Load Balancer by navigating to http://[LB_IP_v6]
. Make sure to replace [LB_IP_v6]
with the IPv6 address of the load balancer.
Create a new VM to simulate a load on the Application Load Balancer using siege
. Then, determine if traffic is balanced across both backends when the load is high.
In the console, navigate to Navigation menu () > Compute Engine > VM instances.
Click Create instance.
In the Machine configuration:
Select the following values:
Property | Value (type value or select option as specified) |
---|---|
Name | siege-vm |
Region | |
Zone | |
Series | E2 |
Given that
[LB_IP_v4]
with the IPv4 address:In the Cloud console, click Navigation menu () > click VIEW ALL PRODUCTS > Networking > Network Services > Load balancing.
Click Backends.
Click http-backend.
Navigate to http-lb.
Click on the Monitoring tab.
Monitor the Frontend Location (Total inbound traffic) between North America and the two backends for 2 to 3 minutes.
At first, traffic should just be directed to
This demonstrates that by default traffic is forwarded to the closest backend but if the load is very high, traffic can be distributed across the backends.
The output should look like this:
Use Cloud Armor to denylist the siege-vm from accessing the Application Load Balancer.
Create a Cloud Armor security policy with a denylist rule for the siege-vm.
[SIEGE_IP]
.In the Cloud console, click Navigation menu () > click VIEW ALL PRODUCTS > Networking > Network Security > Cloud Armor policies.
Click Create policy.
Set the following values, leave all other values at their defaults:
Property | Value (type value or select option as specified) |
---|---|
Name | denylist-siege |
Default rule action | Allow |
Click Next step.
Click Add a rule.
Set the following values, leave all other values at their defaults:
Property | Value (type value or select option as specified) |
---|---|
Condition > Match | Enter the SIEGE_IP |
Action | Deny |
Response code | 403 (Forbidden) |
Priority | 1000 |
Click Save Change to Rule.
Click Next step.
Click Add Target.
For Type, select Backend service (external application load balancer).
For Target, select http-backend and if prompted confirm Replace.
Click Create policy.
Click Check my progress to verify the objective.
Verify that the siege-vm cannot access the Application Load Balancer.
The output should look like this:
http://[LB_IP_v4]
. Make sure to replace [LB_IP_v4]
with the IPv4 address of the load balancer.The command will not generate any output.
Explore the security policy logs to determine if this traffic is also blocked.
The request should be from the siege-vm IP address. If not, expand another log entry.
DENY
with the name denylist-siege
.Cloud Armor security policies create logs that can be explored to determine when traffic is denied and when it is allowed, along with the source of the traffic.
You configured an Application Load Balancer with backends in
For information on the basic concepts of Cloud Armor, see Cloud Armor documentation.
For more information on Load Balancing, see Load Balancing documentation.
...helps you make the most of Google Cloud technologies. Our classes include technical skills and best practices to help you get up to speed quickly and continue your learning journey. We offer fundamental to advanced level training, with on-demand, live, and virtual options to suit your busy schedule. Certifications help you validate and prove your skill and expertise in Google Cloud technologies.
Manual Last Updated December 11, 2024
Lab Last Tested December 05, 2024
Copyright 2025 Google LLC All rights reserved. Google and the Google logo are trademarks of Google LLC. All other company and product names may be trademarks of the respective companies with which they are associated.