使用外部應用程式負載平衡器，在 Google 全球邊緣網路中更靠近要求用戶端的位置設定 HTTP(S) 連線，並使用 QUIC、HTTP/2 和 TLS 1.3 等現代通訊協定交涉連線，即可減少來回處理次數並提高輸送量，進而提升網站效能。此外，使用與來源的持續性連線，可減少每個用戶端連線的作業負擔。 Google Cloud Google 的邊緣位置與全球私人骨幹網路相連，可 Google Cloud 最佳化路由 Google Cloud ，並縮短用戶端、Google 邊緣和後端之間的延遲。啟用 Cloud CDN 做為外部應用程式負載平衡器部署作業的一部分，可進一步提升效能並降低服務費用。
什麼是 Cloud CDN？
Cloud CDN (內容傳遞聯播網) 使用 Google 遍佈全球的邊緣網路連接點，在接近使用者所在位置快取負載平衡內容的副本。
Cloud CDN 如何提升網站效能
Cloud CDN 可透過多種方式提升效能。
減少要求，卸除後端基礎架構的負擔並擴充資源
如果要求是從 Cloud CDN 快取提供服務，表示負載平衡器不需要將要求傳送至後端基礎架構，以取得圖片、影片、JavaScript 或樣式表等靜態元素。這不僅能減少正常運作期間的負載，還能讓 Google 邊緣基礎架構吸收要求暴增的情況，而不會增加後端服務基礎架構的負載。這可確保後端基礎架構專注於產生使用者專屬的回覆，例如互動式網頁體驗的動態 HTML。
從邊緣提供靜態資產
由於 Google 的全球邊緣會傳送已快取的請求，因此可縮短用戶端請求的回應時間。網頁體驗的靜態元素 (例如圖片、影片、JavaScript 和樣式表) 可以立即傳送，不必將要求轉送至後端系統，也不必等待回應和資料傳輸。
降低資料傳輸和後端基礎架構成本
搭配外部應用程式負載平衡器使用 Cloud CDN，可減少後端流量，進而降低後端基礎架構費用。此外，由於靜態內容是從 Google 邊緣傳送，因此您可以減少週期數。Cloud CDN 流量的計費方式為較低的資料傳輸費用，可進一步控管成本。
Cloud Armor 會運用 Google 的地理 IP 資料庫，識別傳入要求要前往的網路基礎架構地理區域，並根據雙字元國家/地區代碼封鎖流量。舉例來說，如果網路商店不提供特定國家/地區以外的運送服務，可以封鎖來自常見攻擊流量來源的要求。此外，Cloud Armor 可快速封鎖發出惡意要求的特定 IP 位址或 IP 位址範圍。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Faster web performance and improved web protection for load balancing\n\nThis tutorial outlines the value of adding Cloud CDN and Google Cloud Armor\nto an existing external Application Load Balancer deployment. It includes basic instructions for\nenabling both Cloud CDN and Cloud Armor with an\nexternal Application Load Balancer.\n| **Note:** If you are using Cloud Armor with Cloud CDN, security policies are enforced only for requests for dynamic content, cache misses, or other requests that are destined for your origin server. Security policies do *not* apply to cache hits, even if the connecting client would otherwise match a rule in the policy.\n\nImproving web performance with Cloud CDN\n----------------------------------------\n\nUsing the external Application Load Balancer already improves web performance by\nsetting up HTTP(S) connections on Google's global edge closer to the\nrequesting client and by negotiating connections using modern protocols such as\nQUIC, HTTP/2, and [TLS\n1.3](/blog/products/networking/tls-1-3-is-now-on-by-default-for-google-cloud-services)\nto reduce the number of round trips and enhance throughput. Further, by using\npersistent connections to your origin, Google Cloud reduces the overhead\nof each client connection. Google's edge locations are connected to our global\nprivate backbone network, which allows Google Cloud to optimize routing\nand reduce latency between the client, Google's edge, and your backends. You can\nfurther improve performance and reduce your serving costs by enabling\nCloud CDN as part of your external Application Load Balancer deployment.\n\n### What is Cloud CDN?\n\nCloud CDN (Content Delivery Network) uses Google's globally distributed\nedge points of presence to cache copies of load balanced content close to your\nusers.\n\n### How Cloud CDN can improve web performance\n\nThere are multiple ways that Cloud CDN improves performance.\n\n#### Offloads and scales your backend infrastructure by reducing requests\n\nA request served from the Cloud CDN cache means that the load balancer\ndoesn't need to send the request\nto backend infrastructure for a static element such as an image, video,\nJavaScript, or stylesheet. This not only reduces load during normal operation but\nallows Google edge infrastructure to absorb spikes in requests without\nincreasing the load on your backend serving infrastructure. This ensures backend\ninfrastructure is focused on generating user-specific responses such as dynamic\nHTML for interactive web experiences.\n\n#### Serves static assets from the edge\n\nBecause Google's global edge sends cached requests, the\nresponse times to client requests can be reduced. Static elements of your web\nexperience such as images, videos, JavaScript, and stylesheets can be delivered\nright away without needing to forward the request to the backend systems and\nwait for a response and data transfer.\n\n#### Reduces your data transfer and backend infrastructure costs\n\nBy using Cloud CDN with your external Application Load Balancer, you reduce your\nbackend infrastructure costs due to reduced traffic to the backend.\nAdditionally, you can reduce the number of cycles to deliver static content\nbecause it is sent from the Google edge. Cloud CDN traffic is billed at\na [lower data transfer cost](/cdn/pricing), further controlling costs.\n\n### Enabling Cloud CDN for your external Application Load Balancer\n\nYou can enable Cloud CDN for an existing external Application Load Balancer or when\nsetting up a new load balancer.\n\n#### Enabling Cloud CDN during external Application Load Balancer setup\n\nDuring backend configuration, select the **Enable Cloud CDN** checkbox. For\ndetails, see the [Cloud CDN how-to guides](/cdn/docs/how-to).\n\n#### Enabling Cloud CDN for an existing external Application Load Balancer\n\nIn an existing external Application Load Balancer configuration, in the **Load Balancer** details\nscreen, you can click **Edit** edit to\nmodify your load balancer.\n\nThen, in the **Backend Configuration** section, you can select the\n**Enable Cloud CDN** checkbox. For detailed instructions, including\n`gcloud` commands, see the [Cloud CDN how-to\nguides](/cdn/docs/how-to).\n\nImproving web protection with Cloud Armor\n-----------------------------------------\n\nUsing the external Application Load Balancer already provides a measure of web protection by\nsetting up HTTP(S) connections on Google's global edge, offloading your backend\ninfrastructure from needing to handle this process. By enabling\nCloud Armor as part of your external Application Load Balancer you have increased\nvisibility and control against infrastructure and application attacks.\n| **Note:** You can use Cloud Armor with Cloud CDN to protect the CDN origin servers. Cloud Armor ensures that the CDN origin server is protected from application attacks, mitigates OWASP Top 10 risks, and enforces Layer 7 filtering policies. Cloud Armor enforces security policies for backend services with Cloud CDN enabled *only* for cache misses; that is, for requests that miss or bypass the Cloud CDN cache.\n\n### What is Cloud Armor?\n\nCloud Armor provides DDoS and application layer defense working in\nconjunction with external Application Load Balancers. It provides visibility into attacks and\nallows you to deploy pre-configured and custom rules to mitigate attacks against\nyour web applications and services. Like the external Application Load Balancer,\nCloud Armor is delivered at the edge of Google's network, helping to\ndefend against infrastructure and application attacks close to their source.\n\n### How Cloud Armor can improve web protection\n\nThere are multiple ways that Cloud Armor improves protection.\n\n#### Automatically blocks most volumetric DDoS attacks\n\nCloud Armor works with the external Application Load Balancer to automatically block\nnetwork protocol and volumetric DDoS attacks such as protocol floods (SYN, TCP,\nHTTP, and ICMP) and amplification attacks (NTP, UDP, DNS). Cloud Armor\nis based on technologies developed originally to defend Google's own web\nservices such as search, gmail, and maps.\n\n#### Has pre-configured WAF rules to help detect and mitigate common application attacks\n\nCloud Armor provides a library of pre-configured web application\nfirewall (WAF) rules that help detect and optionally help mitigate common web\nattacks such as SQL injection, cross-site scripting, and command injection\nattacks against your web infrastructure.\n\n#### Detects and blocks by geographical source and IP addresses or IP ranges\n\nCloud Armor leverages Google's Geo-IP database to identify the\ngeographical region of incoming requests destined for your web infrastructure\nand allows you to block traffic based on two-character country codes. For\nexample, an online commerce site that does not ship outside of a given country\ncan block requests from common sources of attack traffic. Additionally,\nCloud Armor allows quick blocking of specific IP addresses or ranges of\nIP addresses making malicious requests.\n\n#### Provides visibility to monitor and mitigate application layer HTTP(S) attacks\n\nCloud Armor also provides a custom-rules language that lets you match\ncomplex patterns from incoming requests using a wide variety\nof HTTP(S) semantics. This includes headers, cookies, URLs, query string\nelements, user agent patterns, and HTTP methods.\n\n### Enabling Cloud Armor for your external Application Load Balancer\n\nSecurity policies drive Cloud Armor configuration. These policies\nenable built-in rules and support custom rules for protection. To deploy\nCloud Armor, you must create a security policy, add rules, and then\nattach this policy to one or more external Application Load Balancer backend services.\nEach rule specifies the parameters to detect in traffic, the action to\ntake if the traffic matches these parameters, and a priority value that\ndetermines the position of the rule in the policy hierarchy.\n\n#### Creating a Cloud Armor security policy\n\nAt a high level, these are the steps for configuring Cloud Armor\nsecurity policies to enable rules that allow or deny traffic to\nexternal Application Load Balancer.\n\n1. Create a Cloud Armor security policy in the Network Security - Cloud Armor screen.\n2. Add rules to the policy based on IP lists, custom expressions, or pre-configured WAF rules such as SQL injection or Cross-site scripting.\n3. Attach the Cloud Armor security policy to a backend service of the external Application Load Balancer for which you want to control access.\n4. Update the Cloud Armor security policy as needed.\n\nFor the detailed instructions, see the\n[Cloud Armor how-to guides](/armor/docs/how-to).\n\nNext steps\n----------\n\n- Learn more about Cloud CDN [capabilities](/cdn/docs/features).\n- Understand Cloud Armor's [security policies in\n depth](/armor/docs/configure-security-policies).\n- Set up [Monitoring and\n logging](/load-balancing/docs/https/https-logging-monitoring) for an external Application Load Balancer with Cloud CDN."]]
