Network endpoint groups overview

A network endpoint group (NEG) is a configuration object that specifies a group of backend endpoints or services. A common use case for this configuration is deploying services in containers. You can also distribute traffic in a granular fashion to applications running on your backend instances.

You can use NEGs as backends for some load balancers and with Traffic Director. Use the following tables to decide which type of NEG you need for your deployment.

• Zonal NEG
• Internet NEG
• Serverless NEG
• Hybrid connectivity NEG
• Private Service Connect NEG

Zonal NEG

Features	Details
Purpose	One or more internal IP address endpoints that resolve to either Compute Engine VM instances or GKE Pods. For detailed information about this NEG and its use cases, see Zonal NEGs overview.
NetworkEndpointType API name	GCE_VM_IP IP only: resolves to the primary internal IP address of a Compute Engine VM's NIC OR GCE_VM_IP_PORT IP:Port: resolves to either the primary internal IP address of a Google Cloud VM's NIC or an alias IP address on a NIC; for example, Pod IP addresses in VPC-native clusters.
Number of endpoints	1 or more
Health checks for NEGs attached to backend services	Centralized health checks for NEGs with GCE_VM_IP_PORT and GCE_VM_IP endpoints.
Scope	Zonal
Routing	VPC network
Google Cloud products that use this NEG	Internal TCP/UDP load balancer (GCE_VM_IP endpoints): Set up zonal NEGs for internal TCP/UDP load balancers Internal regional TCP proxy load balancer (GCE_VM_IP_PORT endpoints) Set up zonal NEGs for internal regional TCP proxy load balancers External regional TCP proxy load balancer (GCE_VM_IP_PORT endpoints) Set up zonal NEGs for external regional TCP proxy load balancers Internal HTTP(S) load balancer (GCE_VM_IP_PORT endpoints) Global external HTTP(S) load balancer (GCE_VM_IP_PORT endpoints) Global external HTTP(S) load balancer (classic) (GCE_VM_IP_PORT endpoints) Regional external HTTP(S) load balancer (GCE_VM_IP_PORT endpoints) External TCP proxy load balancer (GCE_VM_IP_PORT endpoints) External SSL proxy load balancer (GCE_VM_IP_PORT endpoints) Traffic Director (GCE_VM_IP_PORT endpoints) Related documentation: Set up Zonal NEGs

Internet NEG

Features	Details
Purpose	A single internet-routable endpoint that is hosted outside of Google Cloud. For detailed information about this NEG and its use cases, see Internet NEGs overview.
NetworkEndpointType API name	INTERNET_IP_PORT IP:Port, where IP must not be a RFC 1918 address. OR INTERNET_FQDN_PORT FQDN:Port
Number of endpoints	1
Health checks for NEGs attached to backend services	Not applicable
Scope	Global
Routing	Internet
Google Cloud products that use this NEG	Cloud CDN (INTERNET_IP_PORT or INTERNET_FQDN_PORT endpoint): Set up Cloud CDN with an external backend Global external HTTP(S) load balancer (INTERNET_IP_PORT or INTERNET_FQDN_PORT endpoint): Set up a global external HTTP(S) load balancer with a custom origin Set up a global external HTTP(S) load balancer (classic) with a custom origin Internet NEGs are not supported with the regional external HTTP(S) load balancer. Traffic Director (INTERNET_FQDN_PORT endpoint): Traffic Director with internet NEGs overview Set up Traffic Director with an external backend

Serverless NEG

Features	Details
Purpose	A single endpoint within Google's network that resolves to an App Engine, Cloud Functions, API Gateway, or Cloud Run service. For detailed information about this NEG and its use cases, see Serverless NEGs overview.
NetworkEndpointType API name	SERVERLESS FQDN belonging to an App Engine, Cloud Functions, API Gateway, or Cloud Run service.
Number of endpoints	1
Health checks for NEGs attached to backend services	Not applicable
Scope	Regional
Routing	To Google APIs and Services
Google Cloud products that use this NEG	External HTTP(S) load balancer: Set up a global external HTTP(S) load balancer with an App Engine, Cloud Functions, or Cloud Run backend Set up a global external HTTP(S) load balancer (classic) with an App Engine, Cloud Functions, or Cloud Run backend Set up a regional external HTTP(S) load balancer with a Cloud Run backend Get started with an external HTTP(S) load balancer for API Gateway Internal HTTP(S) load balancer (Cloud Run only): Set up an internal HTTP(S) load balancer with a Cloud Run backend

Hybrid connectivity NEG

Features	Details
Purpose	One or more endpoints that resolve to on-premises services, server applications in another cloud, and other internet-reachable services outside Google Cloud.
NetworkEndpointType API name	NON_GCP_PRIVATE_IP_PORT IP:Port belonging to a VM that is not in Compute Engine and that must be routable using hybrid connectivity.
Number of endpoints	1 or more
Health checks for NEGs attached to backend services	Centralized health checks when you use this NEG with a supported load balancing product. Distributed Envoy health checks for NEGs used with Traffic Director Currently, health check probes for hybrid NEGs originate from Google's centralized health checking mechanism. If you cannot allow traffic that originates from the Google health check ranges to reach your hybrid endpoints and would prefer to have the health check probes originate from private IP addresses instead, speak to your Google account representative to get your project allowlisted for distributed Envoy health checks.
Scope	Zonal
Routing	To an on-premises network or another Cloud provider network by way of Cloud Interconnect VLAN attachment, Cloud VPN tunnel, or Router appliance VM in a VPC network
Google Cloud products that use this NEG	External HTTP(S) load balancer Set up a global external HTTP(S) load balancer with hybrid connectivity Set up a global external HTTP(S) load balancer (classic) with hybrid connectivity Set up a regional external HTTP(S) load balancer with hybrid connectivity Internal HTTP(S) load balancer Set up an internal HTTP(S) load balancer with hybrid connectivity External TCP proxy load balancer External SSL proxy load balancer Internal regional TCP proxy load balancer Set up an internal regional TCP proxy load balancer with hybrid connectivity External regional TCP proxy load balancer Set up an external regional TCP proxy load balancer with hybrid connectivity Traffic Director: Traffic Director with hybrid connectivity network endpoint groups Set up network edge services for multi‑environment deployments

Private Service Connect NEG

Features	Details
Purpose	A single endpoint that resolves to one of the following: A Google-managed regional API endpoint A managed service published using Private Service Connect
NetworkEndpointType API name	PRIVATE_SERVICE_CONNECT
Number of endpoints	1
Health checks for NEGs attached to backend services	Not applicable
Scope	Regional
Routing	Internal HTTP(S) load balancer: VPC network To Google APIs and services External HTTP(S) load balancer: VPC network To Google APIs and services Internal regional TCP proxy load balancer: VPC network External regional TCP proxy load balancer: VPC network
Google Cloud products that use this NEG	Internal HTTP(S) load balancer Global external HTTP(S) load balancer Private Service Connect NEGs are not supported by the global external HTTP(S) load balancer (classic). Regional external HTTP(S) load balancer Internal regional TCP proxy load balancer External regional TCP proxy load balancer For more information about Private Service Connect NEGs, see About Private Service Connect backends.