通过在更靠近请求客户端的 Google 全球边缘设置 HTTP(S) 连接，以及使用新型协议（例如 QUIC、HTTP/2、TLS 1.3）协商连接，可以减少往返次数并提高吞吐量，从而利用外部应用负载均衡器提高 Web 性能。此外，通过使用与来源的持久性连接， Google Cloud 会降低每个客户端连接的开销。Google 的边缘位置已连接到其全球专用骨干网，使得 Google Cloud 可以优化路由并减少客户端、Google 边缘和您的后端之间的延迟时间。通过在外部应用负载均衡器中启用 Cloud CDN，您可以进一步提高性能并降低服务费用。
什么是 Cloud CDN？
Cloud CDN（内容分发网络）使用 Google 的全球分布式边缘入网点，在您的用户附近缓存负载均衡内容的副本。
Cloud CDN 如何提高 Web 性能
Cloud CDN 可以通过多种方式来提高性能。
通过减少请求来分流和扩缩后端基础架构
从 Cloud CDN 缓存传送的请求意味着负载均衡器无需向后端基础架构发送静态元素（例如图片、视频、JavaScript 或样式表）请求。这不仅可以减少正常操作期间的负载，而且可以让 Google 边缘基础架构处理高峰请求，而不会增加后端服务基础架构的负载。这样可以确保后端基础架构专注于生成特定于用户的响应（例如用于实现交互式 Web 体验的动态 HTML）。
从边缘传送静态资源
由于 Google 的全球边缘会发送缓存的请求，因此可以缩短客户端请求的响应时间。Web 体验的静态元素（例如图片、视频、JavaScript 和样式表）可以立即传送，而无需将请求转发到后端系统并等待响应和数据传输。
降低数据传输和后端基础架构费用
通过将 Cloud CDN 与外部应用负载均衡器搭配使用，您可以减少后端流量，从而降低后端基础架构费用。此外，您还可以减少传送静态内容的周期数，因为静态内容是从 Google 边缘发送的。Cloud CDN 流量以较低的数据传输费用计费，从而进一步控制费用。
通过在 Google 的全球边缘上设置 HTTP(S) 连接，使用外部应用负载均衡器可以提供 Web 保护措施，从而使您的后端基础架构无需处理此过程。通过在外部应用负载均衡器中启用 Cloud Armor，您可以加强对基础架构和应用攻击的监视和控制。
什么是 Cloud Armor？
Cloud Armor 与外部应用负载均衡器配合使用，可提供 DDoS 攻击和应用层防御。它可以监视攻击，并且允许您部署预先配置的规则和自定义规则，以缓解针对 Web 应用和服务的攻击。与外部应用负载均衡器一样，Cloud Armor 在 Google 的网络边缘运行，有助于在靠近攻击来源的位置防御基础架构和应用攻击。
Cloud Armor 如何加强 Web 保护
Cloud Armor 可以通过多种方式来加强保护。
自动阻止大多数耗尽容量的 DDoS 攻击
Cloud Armor 与外部应用负载均衡器搭配使用，以自动阻止网络协议和耗尽容量的 DDoS 攻击，例如协议洪水（SYN、TCP、HTTP、ICMP）和扩散攻击（NTP、UDP、DNS）。Cloud Armor 所依赖的技术最初是为保护 Google 自己的 Web 服务（例如搜索、Gmail 和地图）而开发的。
已预先配置 WAF 规则，以帮助检测和缓解常见的应用攻击
Cloud Armor 提供了一个预先配置的 Web 应用防火墙 (WAF) 规则库，有助于检测并选择性地缓解常见的 Web 攻击，例如针对 Web 基础架构的 SQL 注入攻击、跨站脚本攻击和命令注入攻击。
按地理位置来源和 IP 地址或 IP 地址范围检测和阻止攻击
Cloud Armor 利用 Google 的地理位置 IP 数据库来识别以您的 Web 基础架构为目标的传入请求的地理地区，并且允许您根据两个字符的国家/地区代码来阻止流量。例如，不向给定国家/地区以外发货的在线商务网站可以阻止来自常见攻击流量来源的请求。此外，Cloud Armor 还可以快速阻止发出恶意请求的特定 IP 地址或 IP 地址范围。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# Faster web performance and improved web protection for load balancing\n\nThis tutorial outlines the value of adding Cloud CDN and Google Cloud Armor\nto an existing external Application Load Balancer deployment. It includes basic instructions for\nenabling both Cloud CDN and Cloud Armor with an\nexternal Application Load Balancer.\n| **Note:** If you are using Cloud Armor with Cloud CDN, security policies are enforced only for requests for dynamic content, cache misses, or other requests that are destined for your origin server. Security policies do *not* apply to cache hits, even if the connecting client would otherwise match a rule in the policy.\n\nImproving web performance with Cloud CDN\n----------------------------------------\n\nUsing the external Application Load Balancer already improves web performance by\nsetting up HTTP(S) connections on Google's global edge closer to the\nrequesting client and by negotiating connections using modern protocols such as\nQUIC, HTTP/2, and [TLS\n1.3](/blog/products/networking/tls-1-3-is-now-on-by-default-for-google-cloud-services)\nto reduce the number of round trips and enhance throughput. Further, by using\npersistent connections to your origin, Google Cloud reduces the overhead\nof each client connection. Google's edge locations are connected to our global\nprivate backbone network, which allows Google Cloud to optimize routing\nand reduce latency between the client, Google's edge, and your backends. You can\nfurther improve performance and reduce your serving costs by enabling\nCloud CDN as part of your external Application Load Balancer deployment.\n\n### What is Cloud CDN?\n\nCloud CDN (Content Delivery Network) uses Google's globally distributed\nedge points of presence to cache copies of load balanced content close to your\nusers.\n\n### How Cloud CDN can improve web performance\n\nThere are multiple ways that Cloud CDN improves performance.\n\n#### Offloads and scales your backend infrastructure by reducing requests\n\nA request served from the Cloud CDN cache means that the load balancer\ndoesn't need to send the request\nto backend infrastructure for a static element such as an image, video,\nJavaScript, or stylesheet. This not only reduces load during normal operation but\nallows Google edge infrastructure to absorb spikes in requests without\nincreasing the load on your backend serving infrastructure. This ensures backend\ninfrastructure is focused on generating user-specific responses such as dynamic\nHTML for interactive web experiences.\n\n#### Serves static assets from the edge\n\nBecause Google's global edge sends cached requests, the\nresponse times to client requests can be reduced. Static elements of your web\nexperience such as images, videos, JavaScript, and stylesheets can be delivered\nright away without needing to forward the request to the backend systems and\nwait for a response and data transfer.\n\n#### Reduces your data transfer and backend infrastructure costs\n\nBy using Cloud CDN with your external Application Load Balancer, you reduce your\nbackend infrastructure costs due to reduced traffic to the backend.\nAdditionally, you can reduce the number of cycles to deliver static content\nbecause it is sent from the Google edge. Cloud CDN traffic is billed at\na [lower data transfer cost](/cdn/pricing), further controlling costs.\n\n### Enabling Cloud CDN for your external Application Load Balancer\n\nYou can enable Cloud CDN for an existing external Application Load Balancer or when\nsetting up a new load balancer.\n\n#### Enabling Cloud CDN during external Application Load Balancer setup\n\nDuring backend configuration, select the **Enable Cloud CDN** checkbox. For\ndetails, see the [Cloud CDN how-to guides](/cdn/docs/how-to).\n\n#### Enabling Cloud CDN for an existing external Application Load Balancer\n\nIn an existing external Application Load Balancer configuration, in the **Load Balancer** details\nscreen, you can click **Edit** edit to\nmodify your load balancer.\n\nThen, in the **Backend Configuration** section, you can select the\n**Enable Cloud CDN** checkbox. For detailed instructions, including\n`gcloud` commands, see the [Cloud CDN how-to\nguides](/cdn/docs/how-to).\n\nImproving web protection with Cloud Armor\n-----------------------------------------\n\nUsing the external Application Load Balancer already provides a measure of web protection by\nsetting up HTTP(S) connections on Google's global edge, offloading your backend\ninfrastructure from needing to handle this process. By enabling\nCloud Armor as part of your external Application Load Balancer you have increased\nvisibility and control against infrastructure and application attacks.\n| **Note:** You can use Cloud Armor with Cloud CDN to protect the CDN origin servers. Cloud Armor ensures that the CDN origin server is protected from application attacks, mitigates OWASP Top 10 risks, and enforces Layer 7 filtering policies. Cloud Armor enforces security policies for backend services with Cloud CDN enabled *only* for cache misses; that is, for requests that miss or bypass the Cloud CDN cache.\n\n### What is Cloud Armor?\n\nCloud Armor provides DDoS and application layer defense working in\nconjunction with external Application Load Balancers. It provides visibility into attacks and\nallows you to deploy pre-configured and custom rules to mitigate attacks against\nyour web applications and services. Like the external Application Load Balancer,\nCloud Armor is delivered at the edge of Google's network, helping to\ndefend against infrastructure and application attacks close to their source.\n\n### How Cloud Armor can improve web protection\n\nThere are multiple ways that Cloud Armor improves protection.\n\n#### Automatically blocks most volumetric DDoS attacks\n\nCloud Armor works with the external Application Load Balancer to automatically block\nnetwork protocol and volumetric DDoS attacks such as protocol floods (SYN, TCP,\nHTTP, and ICMP) and amplification attacks (NTP, UDP, DNS). Cloud Armor\nis based on technologies developed originally to defend Google's own web\nservices such as search, gmail, and maps.\n\n#### Has pre-configured WAF rules to help detect and mitigate common application attacks\n\nCloud Armor provides a library of pre-configured web application\nfirewall (WAF) rules that help detect and optionally help mitigate common web\nattacks such as SQL injection, cross-site scripting, and command injection\nattacks against your web infrastructure.\n\n#### Detects and blocks by geographical source and IP addresses or IP ranges\n\nCloud Armor leverages Google's Geo-IP database to identify the\ngeographical region of incoming requests destined for your web infrastructure\nand allows you to block traffic based on two-character country codes. For\nexample, an online commerce site that does not ship outside of a given country\ncan block requests from common sources of attack traffic. Additionally,\nCloud Armor allows quick blocking of specific IP addresses or ranges of\nIP addresses making malicious requests.\n\n#### Provides visibility to monitor and mitigate application layer HTTP(S) attacks\n\nCloud Armor also provides a custom-rules language that lets you match\ncomplex patterns from incoming requests using a wide variety\nof HTTP(S) semantics. This includes headers, cookies, URLs, query string\nelements, user agent patterns, and HTTP methods.\n\n### Enabling Cloud Armor for your external Application Load Balancer\n\nSecurity policies drive Cloud Armor configuration. These policies\nenable built-in rules and support custom rules for protection. To deploy\nCloud Armor, you must create a security policy, add rules, and then\nattach this policy to one or more external Application Load Balancer backend services.\nEach rule specifies the parameters to detect in traffic, the action to\ntake if the traffic matches these parameters, and a priority value that\ndetermines the position of the rule in the policy hierarchy.\n\n#### Creating a Cloud Armor security policy\n\nAt a high level, these are the steps for configuring Cloud Armor\nsecurity policies to enable rules that allow or deny traffic to\nexternal Application Load Balancer.\n\n1. Create a Cloud Armor security policy in the Network Security - Cloud Armor screen.\n2. Add rules to the policy based on IP lists, custom expressions, or pre-configured WAF rules such as SQL injection or Cross-site scripting.\n3. Attach the Cloud Armor security policy to a backend service of the external Application Load Balancer for which you want to control access.\n4. Update the Cloud Armor security policy as needed.\n\nFor the detailed instructions, see the\n[Cloud Armor how-to guides](/armor/docs/how-to).\n\nNext steps\n----------\n\n- Learn more about Cloud CDN [capabilities](/cdn/docs/features).\n- Understand Cloud Armor's [security policies in\n depth](/armor/docs/configure-security-policies).\n- Set up [Monitoring and\n logging](/load-balancing/docs/https/https-logging-monitoring) for an external Application Load Balancer with Cloud CDN."]]
