Network endpoint groups overview

A network endpoint group (NEG) is a configuration object that specifies a group of backend endpoints or services. A common use case for this configuration is deploying services in containers. You can also distribute traffic in a granular fashion to applications running on your backend instances.

You can use NEGs as backends for some load balancers and with Traffic Director.

Types of NEGs

Use the following tables to decide which type of NEG you need for your deployment.

Zonal NEG
Internet NEG
Serverless NEG
Hybrid connectivity NEG
Private Service Connect NEG

Zonal NEG

Features	Details
Purpose	One or more internal IP address endpoints that resolve to either Compute Engine VM instances or GKE Pods.
NetworkEndpointType API name	`GCE_VM_IP` IP only: resolves to the primary internal IP address of a Compute Engine VM's NIC OR `GCE_VM_IP_PORT` IP:Port: resolves to either the primary internal IP address of a Google Cloud VM's NIC or an alias IP address on a NIC; for example, Pod IP addresses in VPC-native clusters.
Number of endpoints	1 or more
Health checks for NEGs attached to backend services	Centralized health checks for NEGs with `GCE_VM_IP_PORT` and `GCE_VM_IP` endpoints.
Scope	Zonal
Routing	VPC network
Google Cloud products that use this NEG	Internal TCP/UDP Load Balancing (`GCE_VM_IP` endpoints): Setting up zonal NEGs for internal TCP/UDP load balancers Internal HTTP(S) Load Balancing (`GCE_VM_IP_PORT` endpoints) External HTTP(S) Load Balancing (`GCE_VM_IP_PORT` endpoints) TCP Proxy Load Balancing (`GCE_VM_IP_PORT` endpoints) SSL Proxy Load Balancing (`GCE_VM_IP_PORT` endpoints) Traffic Director (`GCE_VM_IP_PORT` endpoints) Related documentation: Zonal NEG overview Setting up Zonal NEGs

Internet NEG

Features	Details
Purpose	A single internet-routable endpoint that is hosted outside of Google Cloud.
NetworkEndpointType API name	`INTERNET_IP_PORT` IP:Port, where IP must not be a RFC 1918 address. OR `INTERNET_FQDN_PORT` FQDN:Port
Number of endpoints	1
Health checks for NEGs attached to backend services	Not applicable
Scope	Global
Routing	Internet
Google Cloud products that use this NEG	Cloud CDN (`INTERNET_IP_PORT` or `INTERNET_FQDN_PORT` endpoint): Setting up Cloud CDN with an external backend External HTTP(S) Load Balancing (`INTERNET_IP_PORT` or `INTERNET_FQDN_PORT` endpoint): Internet NEG overview Setting up an external HTTP(S) load balancer with a custom origin Internet NEGs are only supported with the global external HTTP(S) load balancer (classic). Traffic Director (`INTERNET_FQDN_PORT` endpoint): Traffic Director with Internet NEGs overview Setting up Traffic Director with an external backend

Serverless NEG

Features	Details
Purpose	A single endpoint within Google's network that resolves to an App Engine, Cloud Functions, or Cloud Run service.
NetworkEndpointType API name	`SERVERLESS` FQDN belonging to an App Engine, Cloud Functions, or Cloud Run service.
Number of endpoints	1
Health checks for NEGs attached to backend services	Not applicable
Scope	Regional
Routing	To Google APIs and Services
Google Cloud products that use this NEG	External HTTP(S) Load Balancing: Serverless NEG overview Setting up an external HTTP(S) load balancer with an App Engine, Cloud Functions, or Cloud Run backend Serverless NEGs are only supported with global external HTTP(S) load balancers. Regional external HTTP(S) load balancers are not supported.

Hybrid connectivity NEG

Features	Details
Purpose	One or more endpoints that resolve to on-premises services, server applications in another cloud, and other internet-reachable services outside Google Cloud.
NetworkEndpointType API name	`NON_GCP_PRIVATE_IP_PORT` IP:Port belonging to a VM that is not in Compute Engine and that must be routable using hybrid connectivity.
Number of endpoints	1 or more
Health checks for NEGs attached to backend services	Centralized health checks for NEGs used with External HTTP(S) Load Balancing, Internal HTTP(S) Load Balancing, TCP Proxy Load Balancing, and SSL Proxy Load Balancing Envoy distributed health checks for NEGs used with Traffic Director
Scope	Zonal
Routing	Internet
Google Cloud products that use this NEG	External HTTP(S) Load Balancing, Internal HTTP(S) Load Balancing, TCP Proxy Load Balancing, and SSL Proxy Load Balancing: Hybrid load balancing overview Setting up an external HTTP(S) load balancer with hybrid connectivity Setting up an internal HTTP(S) load balancer with hybrid connectivity Hybrid NEGs are only supported with global external HTTP(S) load balancers. Regional external HTTP(S) load balancers are not supported. Traffic Director: Traffic Director with hybrid connectivity network endpoint groups Set up network edge services for multi‑environment deployments

Private Service Connect NEG

Features	Details
Purpose	A single endpoint that resolves to a Google-managed service endpoint.
NetworkEndpointType API name	`PRIVATE_SERVICE_CONNECT`
Number of endpoints	1
Health checks for NEGs attached to backend services	Not applicable
Scope	Regional
Routing	To Google APIs and Services
Google Cloud products that use this NEG	Internal HTTP(S) Load Balancing: Using Private Service Connect to access Google APIs with consumer service controls