Cross-region load balancing using Microsoft IIS backends

This tutorial describes how to use the Compute Engine HTTP(S) load balancer service to distribute traffic to Microsoft Internet Information Services (IIS) web servers across different Compute Engine regions.

Scenario

You need to load balance traffic for the site www.example.com. You want to make sure that incoming requests are routed to the closest region, and you also want to make sure that, in the event of a failure or of instances in a region reaching capacity, the requests can fail over to a healthy instance in the next closest region.

The configuration for this scenario uses an external HTTP(S) load balancer that takes requests through a single global IP address. This IP address can route each incoming request by connection type—that is, HTTP or HTTPS. For HTTPS requests, the load balancer implements SSL/TLS encryption between the client sending the request and the load balancer.

The following diagram shows the load balancer architecture:

Cross-region load balancing.

Note that the load balancer includes several components for maximum configurability. For a description of what each component does, see the HTTP(S) Load Balancing overview.

Before you begin

This tutorial assumes the following:

Set up your backend instances

In this section, you create two backend services in different regions. Each backend service includes two backend instances, each running a Microsoft IIS web server on Windows Server 2012. To avoid laborious manual configuration of each server, you create a disk image from one server instance, and then use this image to create your other server instances.

Create your source image instance

To create the instance to use as a source image:

  1. On your local Windows machine, open PowerShell.
  2. Create a new Windows Server 2012 instance in the us-central1 region and add rdp-tag and www-tag tags to the instance. Later, you'll enable external access to your instance by creating firewall rules that target these tags.

    gcloud compute instances create src-img \
        --zone us-central1-f --image windows-2012-r2 \
        --tags rdp-tag,www-tag

After you create your source image instance, set up firewall rules to allow external access to the instance:

  1. Create a firewall rule to permit external access to port 3389 on all instances tagged rdp-tag. This rule makes your source image instance, and any subsequent instances that use the rdp-tag tag, accessible by using RDP:

    gcloud compute firewall-rules create rdp-rule \
        --allow tcp:3389 --source-ranges 0.0.0.0/0 \
        --target-tags rdp-tag
  2. Create another firewall rule to permit external access to port 80 on all instances tagged www-tag. This rule makes your source image instance, and any subsequent instances that use the www-tag tag, to send and receive HTTP traffic:

    gcloud compute firewall-rules create www-rule \
       --allow tcp:80 --source-ranges 0.0.0.0/0 \
       --target-tags www-tag

Configure your source image instance

To configure your new source image instance, create a new Windows user on the source image instance and establish an RDP connection:

  1. In the Google Cloud Console, go to the VM instances page.

    Go to VM instances

  2. Click the name of your source image instance (src-img).

  3. Click the Set Windows password button.

  4. In the Set new Windows password dialog, add your username and click Set to create the user account on your instance.

  5. Copy the provided password and close the dialog.

  6. On the instance's console page, click RDP.

    • If you installed the Chrome RDP extension, the extension window opens. Confirm that you want to connect to the instance, enter your username and password, and then click OK to connect to your instance.
    • If you chose not to install the Chrome RDP extension, you are given the option to download the RDP file for your instance. Use this file to connect to the instance using Windows Remote Desktop Connection or your preferred third-party client.

After you establish an RDP connection with your source image instance, install IIS and add a default home page:

  1. On your source image instance, open PowerShell as an administrator.
  2. In PowerShell, paste the following to install your IIS services and dependencies:

    Dism /Online /Enable-Feature /FeatureName:IIS-WebServerRole /FeatureName:IIS-WebServer /FeatureName:IIS-StaticContent /FeatureName:IIS-DefaultDocument /FeatureName:IIS-DirectoryBrowsing /FeatureName:IIS-HttpErrors /FeatureName:IIS-HealthAndDiagnostics /FeatureName:IIS-HttpLogging /FeatureName:IIS-LoggingLibraries /FeatureName:IIS-RequestMonitor /FeatureName:IIS-Security /FeatureName:IIS-RequestFiltering /FeatureName:IIS-HttpCompressionStatic /FeatureName:IIS-WebServerManagementTools /FeatureName:IIS-ManagementConsole /FeatureName:WAS-WindowsActivationService /FeatureName:WAS-ProcessModel /FeatureName:WAS-NetFxEnvironment /FeatureName:WAS-ConfigurationAPI /All
  3. After your services are installed, create a new home page in C:\inetpub\wwwroot, IIS's default web directory:

    Echo '<!doctype html><html><body><h1>Hello World!</h1></body></html>' > C:\inetpub\wwwroot\index.html

Verify that your source image instance is able to serve content

In the Cloud Console, go to the VM instances page.

Go to VM instances

Click the external IP of your instance to verify that it is serving the home page you created earlier.

Create a reusable Windows Server 2012 image from your source image instance

After verifying that your source image instance is properly configured and able to serve content, create a reusable disk image from the instance's root persistent disk:

  1. On your source image instance, open PowerShell as an administrator.
  2. Run the following command to prepare your system for cloning:

    GCESysprep

    When the GCESysprep operation completes, you are automatically disconnected from your RDP session.

  3. On your local machine, run the following command to delete your source instance while retaining its root persistent disk:

    gcloud compute instances delete src-img --keep-disks boot
  4. After the instance is deleted, create a new image from the root persistent disk you retained:

    gcloud compute images create win-be-img \
       --source-disk src-img \
       --source-disk-zone us-central1-f

Create an instance template using your source image

Use the disk image from your configured Windows server as the source image for an instance template. Later, you'll configure two managed instance groups to use this template for new instances.

On your local machine, run the following command to create an instance template that uses win-be-img as the source image and rdp-tag and www-tag as instance tags:

gcloud compute instance-templates create win-be-tmpl \
    --tags rdp-tag,www-tag \
    --image win-be-img

Create a managed instance group for each region

In each region, create managed instance groups. After you create each instance group, the group automatically populates with two identical instances based on the instance template you defined earlier. Later, you'll configure your load balancer to treat these instance groups as backend targets.

To create your managed instance groups:

  1. On your local machine, run the following command to create a new managed instance group in the zone us-central1-f and automatically populate it with two identical instances:

    gcloud compute instance-groups managed create us-be-group \
       --base-instance-name us \
       --size 2 \
       --zone us-central1-f \
       --template win-be-tmpl
  2. Do the same in the zone europe-west1-d:

    gcloud compute instance-groups managed create eu-be-group \
       --base-instance-name eu \
       --size 2 \
       --zone europe-west1-d \
       --template win-be-tmpl

Verify that your backend instances are running

  1. In the Cloud Console, go to the VM instances page.

    Go to VM instances

  2. Click the external IP of each backend to verify that the backend is serving the home page you created earlier.

Create and configure your load balancing service

The Compute Engine load balancing service includes several components. In this section, you'll create these components and connect them together.

  1. On your local machine, run the following command to create a new health check. Your load balancer uses this health check to check the health of your backend instances:

    gcloud compute http-health-checks create basic-check
  2. Create a backend service:

    gcloud compute backend-services create be-srv \
       --protocol HTTP \
       --http-health-check basic-check
  3. Add your instance groups as backend targets for your backend service:

    gcloud beta compute backend-services add-backend be-srv \
       --instance-group us-be-group \
       --zone us-central1-f
    
    gcloud beta compute backend-services add-backend be-srv \
       --instance-group eu-be-group \
       --zone europe-west1-d
  4. Create a default URL map that directs all incoming requests to all of your instances:

    gcloud compute url-maps create lb-map --default-service be-srv
  5. Create an SSL certificate resource. Your load balancer uses this resource to encrypt and decrypt traffic.

    If you already have a private key and an SSL certificate from a certificate authority, you can use them to create a new SSLCertificate resource by running the following command. Otherwise, you can create and use a self-signed certificate for testing. For more information, see SSL certificates.

    Run the following command to create your SSL certificate resource:

    gcloud beta compute ssl-certificates create www-cert \
       --certificate CRT_FILE_PATH \
       --private-key KEY_FILE_PATH

    Replace the following:

    • CRT_FILE_PATH: your certificate's local file path
    • KEY_FILE_PATH: your private key's file path
  6. Create target HTTP and HTTPS proxies to route requests to your URL map. The proxy is the portion of the load balancer that holds the SSL certificate for HTTPS load balancing, so you also load your certificate in this step:

    gcloud compute target-http-proxies create http-lb-proxy \
       --url-map lb-map
    
    gcloud beta compute target-https-proxies create https-lb-proxy \
       --url-map lb-map \
       --ssl-certificate www-cert
  7. For your load balancer to reliably receive traffic, you need to assign a global static IP address to the load balancer's global forwarding rule.

    To create a global static IP resource, run the following command:

    gcloud compute addresses create lb-ip --global

    Take note of the IP address.

  8. Create two global forwarding rules to handle incoming HTTP and HTTPS requests. Each forwarding rule sends traffic to one of the target proxies you created depending on the IP address, IP protocol, and port specified.

    gcloud compute forwarding-rules create http-fwd-rule \
       --address LB_IP_ADDR \
       --global \
       --target-http-proxy http-lb-proxy \
       --port-range 80
    
    gcloud beta compute forwarding-rules create https-fwd-rule \
       --address LB_IP_ADDR \
       --global \
       --target-https-proxy https-lb-proxy \
       --port-range 443

    Replace LB_IP_ADDR with the static IP address you created in the previous step.

After you create the global forwarding rules, it can take several minutes for your configuration to propagate. To check the progress of the propagation, you can either monitor your configuration in the Google Cloud Console or run the following command on your local machine:

gcloud compute backend-services get-health be-srv

Send traffic to your backends

Now that you've configured your load balancing service, you can start sending traffic to the forwarding rule and watch the traffic be dispersed to different instances.

Send traffic to your backends as follows:

  1. In the Cloud Console, go to the Load balancing page.

    Go to Load balancing

  2. To see your default home page, click the IP addresses in the Incoming traffic column.

Restrict access to your backends

After you have verified that everything is working as intended, modify your firewall rules so that HTTP or HTTPS traffic can only come from your load balancing service:

  1. On your local machine, run the following command to update your www-rule firewall rule. Restrict its allowed source IPs to the range 130.211.0.0/22, which is the HTTPS load balancing health check IP range:

    gcloud compute firewall-rules update www-rule \
       --source-ranges 130.211.0.0/22 \
       --target-tags www-tag
  2. In the Cloud Console, go to the VM instances page.

    Go to VM instances

  3. Click each instance to verify that the instance is now inaccessible.

Simulate an outage

To see how a load is balanced among the healthy instances, you can simulate an outage for one or more instances in a region.

To stop an instance from receiving additional requests:

  1. Establish an RDP connection to the instance.
  2. On the instance, open PowerShell as an administrator.
  3. Run the following command to create a new firewall rule on the instance. This command blocks the health check traffic from the health checker and prevents all new HTTP connections from the load balancer to the instance:

    netsh advfirewall firewall add rule name="Outage Test" protocol=tcp dir=in localport=80 action=block remoteip=130.211.0.0/22
  4. On your local machine, run the following command to verify that the instance now reports an UNHEALTHY status:

    gcloud compute backend-services get-health be-srv
  5. After the instance starts reporting an UNHEALTHY status, send a request to your load balancer. Only the healthy instances should respond.

  6. After you've finished simulating an outage, you can restore your instance's connectivity by deleting the firewall rule. After opening PowerShell as an administrator on the unhealthy instance, run the following command to delete the rule:

    netsh advfirewall firewall delete rule name="Outage Test"

Clean up

After you've finished the Microsoft IIS tutorial, you can clean up the resources that you created on Google Cloud so they won't take up quota and you won't be billed for them in the future. The following sections describe how to delete or turn off these resources.

Delete your Cloud project project

The easiest way to eliminate billing is to delete the project that you created for the tutorial.

To delete the project:

  1. In the Cloud Console, go to the Manage resources page.

    Go to Manage resources

  2. In the project list, select the project that you want to delete, and then click Delete.
  3. In the dialog, type the project ID, and then click Shut down to delete the project.

Delete your instances

To delete a Compute Engine instance:

  1. In the Cloud Console, go to the VM instances page.

    Go to VM instances

  2. Select the checkbox for the instance that you want to delete.
  3. To delete the instance, click More actions, click Delete, and then follow the instructions.

Delete your persistent disks

To delete a Compute Engine disk:

  1. In the Cloud Console, go to the Disks page.

    Go to Disks

  2. Select the checkbox for the disk that you want to delete.
  3. To delete the disk, click Delete.

Next steps

Read more about using Windows on Compute Engine

Review the documentation for Windows instances on Compute Engine.

Try other tutorials

Explore reference architectures, diagrams, tutorials, and best practices about Google Cloud. Take a look at our Cloud Architecture Center.