AWS ELB – ALB vs NLB vs GWLB

• AWS Elastic Load Balancing (ELB) automatically distributes incoming application traffic across multiple targets.
• AWS offers four types of load balancers: Application Load Balancer (ALB), Network Load Balancer (NLB), Gateway Load Balancer (GWLB), and Classic Load Balancer (CLB – deprecated).
• Choosing the right load balancer depends on the use case – Layer 7 routing, ultra-low latency, or third-party appliance integration.

ALB vs NLB vs GWLB Comparison

Application Load Balancer – ALB

• Operates at Layer 7 (HTTP/HTTPS) and is best suited for web applications.
• Supports content-based routing – routes requests based on URL path, host header, HTTP headers, query strings, HTTP method, and source IP.
• Supports multiple target groups per listener with weighted routing for blue/green and canary deployments.
• Native integration with AWS WAF for web application security.
• Supports authentication – integrates with Amazon Cognito and OIDC-compliant identity providers.
• Supports Lambda functions as targets for serverless architectures.
• Provides detailed access logs and integration with CloudWatch metrics.
• Supports HTTP/2 and gRPC protocols.
• Supports mutual TLS (mTLS) for client certificate authentication.
• Supports fixed response actions and redirect actions at the listener level.

Network Load Balancer – NLB

• Operates at Layer 4 (TCP/UDP/TLS) and handles millions of requests per second with ultra-low latency.
• Provides a static IP address per Availability Zone and supports Elastic IP assignment.
• Preserves source IP natively – no X-Forwarded-For header needed for TCP traffic.
• Supports AWS PrivateLink – expose services to other VPCs or AWS accounts privately.
• Can target ALB as a target – combines NLB’s static IP with ALB’s Layer 7 routing.
• Supports TLS termination and centralized certificate management via ACM.
• Handles volatile workloads and sudden traffic spikes without pre-warming.
• Supports long-lived TCP connections – ideal for IoT, gaming, and real-time applications.
• Supports UDP for DNS, SIP, and IoT protocols.
• Cross-zone load balancing disabled by default – enable for even distribution across AZs.

Gateway Load Balancer – GWLB

• Operates at Layer 3 (IP packets) using GENEVE protocol for transparent network traffic inspection.
• Designed for deploying third-party virtual appliances – firewalls, IDS/IPS, deep packet inspection.
• Creates a single entry/exit point for all traffic using Gateway Load Balancer Endpoints (GWLBe).
• Traffic is transparently routed through appliances – source and destination IPs preserved.
• Uses 5-tuple flow stickiness (source IP, dest IP, protocol, source port, dest port) by default.
• Scales horizontally – automatically distributes traffic across multiple appliance instances.
• Supports cross-VPC inspection via AWS PrivateLink (GWLBe in service consumer VPC).
• Integrates with AWS Marketplace appliances from vendors like Palo Alto, Fortinet, Check Point.

When to Choose Which

• Choose ALB – Web applications, microservices needing URL-based routing, gRPC, Lambda targets, OIDC authentication, WAF integration.
• Choose NLB – TCP/UDP applications requiring ultra-low latency, static IPs, PrivateLink exposure, gaming/IoT, volatile traffic patterns.
• Choose GWLB – Network traffic inspection via third-party appliances, centralized firewall deployments, compliance-driven packet inspection.
• Combine NLB + ALB – When you need both static IPs (NLB) and content-based routing (ALB), use NLB with ALB as a target.

AWS Certification Exam Practice Questions

1. A company needs to expose a microservices application that routes traffic based on URL paths and requires integration with AWS WAF. Which load balancer should they use?
   1. Network Load Balancer
   2. Application Load Balancer
   3. Gateway Load Balancer
   4. Classic Load Balancer
2. An application requires a static IP address for whitelisting by partner organizations while maintaining ultra-low latency for TCP traffic. Which load balancer is most appropriate?
   1. Application Load Balancer with Global Accelerator
   2. Network Load Balancer
   3. Gateway Load Balancer
   4. Classic Load Balancer
3. A security team needs to route all VPC traffic through a centralized fleet of third-party firewall appliances for deep packet inspection. Which AWS service should they use?
   1. Network Load Balancer
   2. AWS Network Firewall
   3. Gateway Load Balancer
   4. Application Load Balancer with AWS WAF
4. A company needs to provide a service to multiple AWS accounts privately, with clients connecting using a static IP. Which combination is required?
   1. ALB + VPC Peering
   2. NLB + AWS PrivateLink
   3. GWLB + Transit Gateway
   4. ALB + Global Accelerator
5. An architect needs to implement a blue/green deployment strategy with weighted routing between two versions of an application. Which load balancer feature supports this?
   1. NLB with multiple target groups
   2. ALB with weighted target groups
   3. GWLB with flow stickiness
   4. NLB with cross-zone load balancing

Related Posts

• AWS Elastic Load Balancer – ELB
• AWS Application Load Balancer – ALB
• AWS Network Load Balancer – NLB
• AWS Virtual Private Cloud – VPC
• AWS Networking & Content Delivery Services Cheat Sheet

📖 Related: AWS Auto Scaling with ELB – Integration Guide

References

AWS Elastic Load Balancing User Guide

AWS ELB Features Comparison