Google Cloud Load Balancing Types – Comparison & Decision Guide [2025]

Google Cloud Load Balancer Summary

Application Load Balancer — Internal (Regional)

Previously known as: Internal HTTP(S) Load Balancing

• is a proxy-based, regional Layer 7 load balancer that enables running and scaling services behind an internal IP address.
• distributes HTTP and HTTPS traffic to backends hosted on Compute Engine, GKE, and Cloud Run
• is accessible only in the chosen region of the Virtual Private Cloud (VPC) network on an internal IP address.
• can be made globally accessible by enabling global access on the forwarding rule, allowing clients from any region to access the load balancer.
• enables rich traffic control capabilities based on HTTP(S) parameters.
• is a managed service based on the open source Envoy proxy.
• needs one proxy-only subnet in each region of a VPC network where the internal Application Load Balancer is used. All load balancers in a region and VPC network share the same proxy-only subnet.
• supports path-based and host-based routing
• supports advanced traffic management including traffic mirroring, weight-based traffic splitting, and header transformations
• preserves the Host header of the original client request and also appends two IP addresses (Client and LB) to the X-Forwarded-For header
• supports backend services distributing requests to healthy backends (instance groups, zonal NEGs, serverless NEGs for Cloud Run, or hybrid NEGs for on-premises backends).
• supports health checks that periodically monitor the readiness of the backends.
• if a backend becomes unhealthy, traffic is automatically redirected to healthy backends within the same region.
• has native support for the WebSocket protocol
• supports TLS 1.0, 1.1, 1.2, and 1.3 when terminating client SSL requests.
• supports mutual TLS (mTLS) for client certificate-based authentication (added 2023)
• supports IPv6 termination (Preview, expanded May 2026)
• supports access from connected networks via VPC Network Peering, Cloud VPN, or Cloud Interconnect
• isn’t compatible with the following features:
  • Cloud CDN
  • Cloud Storage buckets — now supported (GA April 2026)

Application Load Balancer — Internal (Cross-Region)

New deployment mode added in 2023

• is a proxy-based Layer 7 load balancer that distributes HTTP/HTTPS traffic to backends across multiple regions.
• provides an internal IP address accessible from any region (global access built-in).
• enables high availability and cross-region failover — if backends in one region go down, traffic fails over to another region gracefully.
• uses the open source Envoy proxy and supports advanced traffic management.
• supports backends hosted on Compute Engine, GKE, Cloud Run (serverless NEGs), Cloud Storage (backend buckets), and hybrid NEGs for on-premises backends.
• supports mutual TLS (mTLS) for frontend and backend authentication.
• supports IPv6 termination (Preview).
• ideal for multi-region internal services requiring automatic failover.

Application Load Balancer — External

Previously known as: External HTTP(S) Load Balancing

Available in three deployment modes:

• Global external — Premium Tier only, uses Envoy proxy, supports advanced traffic management
• Regional external — Premium or Standard Tier, uses Envoy proxy, provides jurisdictional compliance
• Classic — Legacy mode using Google Front Ends (GFEs), global in Premium Tier, regional in Standard Tier

Note: Google recommends migrating from Classic to Global external Application Load Balancer for access to new features.

Key Features

• is a global (or regional), proxy-based Layer 7 load balancer that enables running and scaling services worldwide behind a single external IP address.
• distributes HTTP and HTTPS traffic to backends hosted on Compute Engine, GKE, Cloud Run, Cloud Storage, and external backends.
• Global external mode uses Envoy proxy and supports advanced traffic management (traffic mirroring, weight-based splitting, header transformations).
• Classic mode is implemented on Google Front Ends (GFEs) distributed globally.
  • In Premium Tier, GFEs offer global load balancing
  • With Standard Tier, the load balancing is handled regionally.
• provides cross-regional or location-based load balancing, directing traffic to the closest healthy backend.
• supports content-based load balancing using URL maps to select a backend service based on host name, request path, headers, or query parameters.
• supports the following backend types:
  • Instance groups (managed and unmanaged)
  • Zonal network endpoint groups (NEGs)
  • Serverless NEGs: Cloud Run, App Engine, or Cloud Run functions services
  • Internet NEGs, for endpoints outside of Google Cloud
  • Hybrid NEGs, for on-premises or other cloud backends via Cloud VPN/Interconnect
  • Buckets in Cloud Storage
• preserves the Host header of the original client request and appends to the X-Forwarded-For header
• integrates with Cloud CDN for caching responses at edge locations
• integrates with Google Cloud Armor for DDoS protection and WAF capabilities
• supports Cloud Load Balancing Autoscaler for backend instance groups
• supports connection draining on backend services
• supports Session affinity:
  • NONE — no session affinity
  • Client IP affinity
  • Generated cookie affinity
  • Header field affinity (global external and regional external only)
  • HTTP cookie affinity (global external and regional external only)
• if a backend becomes unhealthy, traffic is automatically redirected to healthy backends.
• has native support for the WebSocket protocol and HTTP/2, gRPC
• supports TLS 1.0, 1.1, 1.2, and 1.3
• supports mutual TLS (mTLS) for client certificate-based authentication
• supports SSL policies to control TLS cipher suites and versions
• supports IPv6 termination
• supports QUIC protocol (global external and classic modes)
• supports Service Extensions to inject custom logic into the load balancing path
• supports Authorization Policies for fine-grained access control

Passthrough Network Load Balancer — Internal

Previously known as: Internal TCP/UDP Load Balancing

• is a managed, internal, pass-through, regional Layer 4 load balancer that enables running and scaling services behind an internal IP address.
• distributes traffic among VM instances in the same region in a VPC network by using an internal IP address.
• supports TCP, UDP, ICMP, ICMPv6, SCTP, ESP, AH, and GRE protocols.
• routes original connections directly from clients to the healthy backends, without any interruption.
• Responses from the healthy backend VMs go directly to the clients, not back through the load balancer. TCP responses use direct server return.
• does not terminate SSL traffic; SSL traffic can be terminated by the backends.
• Unlike proxy load balancers, it doesn’t terminate connections from clients and then open new connections to backends.
• provides access through VPC Network Peering, Cloud VPN, or Cloud Interconnect
• supports global access — when enabled, clients from any region can access the load balancer.
• supports zonal NEGs with GCE_VM_IP endpoints as backends
• supports zonal affinity to prefer routing new connections to backends in the same zone as the client (GA May 2026)
• can be used as next hops for routes, enabling third-party appliance integration
• supports Session affinity:
  • None: default, effectively same as Client IP, protocol, and port.
  • Client IP: based on client IP and destination IP.
  • Client IP and protocol: based on client IP, destination IP, and protocol.
  • Client IP, protocol, and port: 5-tuple hash (source IP, source port, destination IP, destination port, protocol).
• UDP protocol doesn’t support sessions; session affinity doesn’t affect UDP traffic.
• supports health checks (HTTP, HTTPS, HTTP2, TCP, SSL protocols); does not offer UDP health checks but can use TCP-based health checks.
• supports failover backends that are only used when healthy VMs in primary backends fall below a configurable threshold.
• supports multiple forwarding rules sharing a common IP address

Passthrough Network Load Balancer — External

Previously known as: External TCP/UDP Network Load Balancing

• is a managed, external, pass-through, regional Layer 4 load balancer that distributes TCP or UDP traffic from the internet to VM instances in the same region.
• supports TCP, UDP, ESP, GRE, ICMP, and ICMPv6 protocols.
• is not a proxy — packets are pass-through:
  • Load-balanced packets are received by backend VMs with their source IP unchanged.
  • Load-balanced connections are terminated by the backend VMs.
  • Responses from the backend VMs go directly to the clients, not back through the load balancer.
  • TCP responses use direct server return.
• scope is regional, not global. Within a single region, the load balancer services all zones.
• supports two architectures:
  • Backend service-based (recommended) — uses instance groups or zonal NEGs with GCE_VM_IP endpoints
  • Target pool-based (legacy) — simpler but fewer features
• supports zonal NEGs with GCE_VM_IP endpoints, enabling forwarding to any network interface (not just nic0)
• supports weighted load balancing for gradual traffic migration
• supports regional health checks (HTTP, HTTPS, HTTP2, TCP, SSL); does not offer UDP health checks.
• supports connection tracking table and configurable consistent hashing algorithm for traffic distribution.
• supports Session affinity:
  • None: default, effectively same as Client IP, protocol, and port.
  • Client IP: based on client IP and destination IP.
  • Client IP and protocol: based on client IP, destination IP, and protocol.
  • Client IP, protocol, and port: 5-tuple hash.
• UDP protocol doesn’t support sessions; session affinity doesn’t affect UDP traffic.
• supports connection draining for established TCP connections.
• supports failover configuration for high availability.
• available in Premium or Standard Network Service Tier.

Proxy Network Load Balancer — External (SSL/TCP Proxy)

Previously known as: External SSL Proxy Load Balancing and External TCP Proxy Load Balancing

Available in three deployment modes:

• Global external — Premium Tier only, supports SSL offload
• Regional external — Premium or Standard Tier, TCP only (no SSL offload)
• Classic — Legacy mode, global in Premium Tier, regional in Standard Tier

Key Features

• is a reverse proxy, Layer 4 load balancer that distributes SSL/TCP traffic from the internet to VM instances.
• with SSL traffic, supports SSL offload where SSL (TLS) connections are terminated at the load balancing layer, then proxied to backends using SSL or TCP.
• is intended for non-HTTP(S) traffic. For HTTP(S) traffic, use Application Load Balancer.
• Global mode uses a single IP address for all users worldwide and automatically routes traffic to the closest backends.
• supports proxy protocol header to preserve original source IP addresses.
• supports two types of balancing mode:
  • CONNECTION: load spread based on concurrent connections the backend can handle.
  • UTILIZATION: load spread based on instance utilization.
• supports Session Affinity with client IP affinity.
• does not support mutual TLS (mTLS) authentication.
• supports SSL policies to control minimum TLS versions and cipher suites.

Proxy Network Load Balancer — Internal

New deployment mode added in 2023

Available in two deployment modes:

• Regional internal — for TCP traffic within a region
• Cross-region internal — for TCP traffic across multiple regions

Key Features

• is a proxy-based, internal, Layer 4 load balancer for TCP traffic.
• uses Envoy proxy infrastructure.
• does not support SSL offload (unlike the external proxy Network Load Balancer).
• supports backends in instance groups, zonal NEGs, and hybrid NEGs.
• provides access from connected networks via VPC Network Peering, Cloud VPN, or Cloud Interconnect.
• cross-region mode enables backends distributed globally with automatic failover.

Choosing a Load Balancer

• Choose an Application Load Balancer for HTTP(S) traffic with flexible Layer 7 features.
• Choose a Proxy Network Load Balancer for TCP proxy load balancing with SSL offload to backends in one or more regions.
• Choose a Passthrough Network Load Balancer to preserve client source IP addresses, avoid proxy overhead, and support additional protocols (UDP, ESP, ICMP, GRE).

Global vs. Regional

• Global/Cross-region — distributed across multiple regions, resilient to both zonal and regional outages. Use when backends are in multiple regions or you need automatic cross-region failover.
• Regional — distributed across zones within one region. Required for jurisdictional compliance where traffic must stay in a specific region.

Proxy vs. Passthrough

• Proxy load balancers terminate client connections at the load balancer and open new connections to backends. Client IP is not preserved by default.
• Passthrough load balancers don’t terminate client connections. Backend VMs receive packets with original source IP unchanged. Use when you need to preserve client IP.

Security Features (2023-2026 Updates)

• Mutual TLS (mTLS) — Application Load Balancers now support frontend mTLS (client authenticates to LB) and backend mTLS (LB authenticates to backend). Supported on global external, regional external, regional internal, and cross-region internal Application Load Balancers. Backend mTLS is GA for all Application Load Balancer modes (2025-2026).
• Authorization Policies — Fine-grained access control policies that can be applied to Application Load Balancers to allow or deny requests based on attributes. GA since October 2025. New policy profiles (Preview 2026) support REQUEST_AUTHZ for header-based decisions and CONTENT_AUTHZ for deep payload inspection (blocking prompt injection attacks, preventing data leaks).
• SSL Policies — Control minimum TLS version and cipher suites. New FIPS_202205 profile (GA January 2026) restricts to FIPS 140-2/140-3 validated cryptographic modules. TLS 1.3 minimum enforcement is now supported.
• Google Cloud Armor — DDoS protection and WAF for external Application Load Balancers (global, regional, and classic modes) and external proxy Network Load Balancers.
• Post-Quantum TLS — Support for post-quantum key exchange (X25519MLKEM768) to protect against future quantum computing threats (GA June 2026). Three-phase rollout: opt-in now, default by October 2026, mandatory after October 2027.
• Service Extensions — Inject custom processing logic into the load balancing data path. Plugins (Preview October 2024, enhanced 2026) let you run WebAssembly (Wasm) code in a fully managed serverless environment directly in the data path.
• TLS 1.3 Early Data (0-RTT) — Supported on global external and classic Application Load Balancers (GA February 2025). Can improve performance for resumed connections by 30-50%.
• Large TLS Key Support — RSA-3072, RSA-4096, and ECDSA P-384 keys now supported (GA July 2025) in addition to RSA-2048 and ECDSA P-256.
• JA4 Fingerprint — Global external Application Load Balancers support JA4 TLS fingerprinting via custom request headers (GA July 2025) for advanced bot detection and traffic analysis.

Advanced Features (2025-2026 Updates)

• SNI-based Routing (TLS Routes) — Proxy Network Load Balancers support routing TLS traffic based on Server Name Indication (SNI) hostnames without terminating TLS (Preview March 2026). Enables end-to-end mTLS and reduces IPv4 address exhaustion via single PSC endpoints.
• Custom Metrics — Application Load Balancers support custom metrics-based traffic distribution instead of standard utilization/rate-based metrics (GA June 2025).
• Traffic Duration & In-Flight Balancing — Configure backends with SHORT or LONG traffic duration settings. In-flight balancing mode distributes traffic when requests take more than a second (GA May 2026).
• Traffic Isolation — Global/cross-region load balancers can restrict traffic to the nearest region only, with optional STRICT mode preventing overflow entirely (Preview May 2025).
• Failover for External ALBs — Global, classic, and regional external Application Load Balancers support failover to regional external ALBs in other regions (GA November 2024).
• Stateful Cookie-Based Session Affinity — All Application Load Balancers (except classic) support persistent cookie-based stickiness (GA October 2024).
• Cross-VPC Backends — All Application and Proxy Network Load Balancers support backends in different VPC networks without Shared VPC (April 2025).
• Cloud Storage Backend Buckets — Now available for regional external and regional internal Application Load Balancers (GA April 2026), completing support across the entire ALB portfolio.
• Classic to Global Migration — Migrate classic Application Load Balancer resources to global external ALB infrastructure with 90-day rollback option (GA May 2025).

GCP Cloud Load Balancing Decision Tree

GCP Certification Exam Practice Questions

• Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
• GCP services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
• GCP exam questions are not updated to keep up the pace with GCP updates, so even if the underlying feature has changed the question might not be updated
• Open to further feedback, discussion and correction.

1. Your development team has asked you to set up an external TCP load balancer with SSL offload. Which load balancer should you use?
   1. External proxy Network Load Balancer (SSL proxy)
   2. Application Load Balancer (HTTP)
   3. External proxy Network Load Balancer (TCP proxy)
   4. Application Load Balancer (HTTPS)
2. You have an instance group that you want to load balance. You want the load balancer to terminate the client SSL session. The instance group is used to serve a public web application over HTTPS. You want to follow Google-recommended practices. What should you do?
   1. Configure an external Application Load Balancer.
   2. Configure an internal passthrough Network Load Balancer.
   3. Configure an external proxy Network Load Balancer (SSL proxy).
   4. Configure an external proxy Network Load Balancer (TCP proxy).
3. Your development team has asked you to set up load balancer with SSL termination. The website would be using HTTPS protocol. Which load balancer should you use?
   1. External proxy Network Load Balancer (SSL proxy)
   2. Application Load Balancer (HTTP)
   3. External proxy Network Load Balancer (TCP proxy)
   4. External Application Load Balancer (HTTPS)
4. You have an application that receives SSL-encrypted TCP traffic on port 443. Clients for this application are located all over the world. You want to minimize latency for the clients. Which load balancing option should you use?
   1. External Application Load Balancer (HTTPS)
   2. External passthrough Network Load Balancer
   3. External proxy Network Load Balancer (SSL Proxy)
   4. Internal passthrough Network Load Balancer. Add a firewall rule allowing ingress traffic from 0.0.0.0/0 on the target instances.
5. You need to deploy an internal load balancer for HTTP traffic that can automatically failover to backends in another region if the primary region goes down. Which load balancer should you choose?
   1. Regional internal Application Load Balancer
   2. Cross-region internal Application Load Balancer
   3. Internal passthrough Network Load Balancer
   4. Internal proxy Network Load Balancer
6. Your organization requires that TLS be terminated only within a specific region for compliance. You need an external load balancer for HTTPS traffic. Which deployment mode should you use?
   1. Global external Application Load Balancer
   2. Classic Application Load Balancer (Premium Tier)
   3. Regional external Application Load Balancer
   4. External proxy Network Load Balancer (SSL proxy)
7. You want to load balance UDP traffic to backend VMs while preserving the client source IP address. Which load balancer type should you use?
   1. External Application Load Balancer
   2. External proxy Network Load Balancer
   3. External passthrough Network Load Balancer
   4. Internal Application Load Balancer
8. You need to set up mutual TLS (mTLS) authentication where the load balancer verifies client certificates. Which load balancer supports this? (Choose two)
   1. Global external Application Load Balancer
   2. External passthrough Network Load Balancer
   3. Regional internal Application Load Balancer
   4. External proxy Network Load Balancer (SSL proxy)

References

• Choose a load balancer
• Application Load Balancer overview
• Proxy Network Load Balancer overview
• Passthrough Network Load Balancer overview
• Load balancer feature comparison
• External Application Load Balancer architecture
• Internal Application Load Balancer architecture