---
cuppy_hub: gcp
cuppy_path: reference/networking/cloud-load-balancing.md
cuppy_section: docs
cuppy_doc: E2QX-4BPM
cuppy_doc_uuid: 9841fe08-ce14-4848-8aa5-9c40e0df6557
cuppy_permalink: https://cuppy.io/gcp/d/E2QX-4BPM
cuppy_version: 1
cuppy_updated: 2026-10-23T16:16:52.575Z
cuppy_canonical: https://cuppy.io/gcp/docs/reference/networking/cloud-load-balancing
cuppy_mcp: https://cuppy.io/mcp
cuppy_body_sha256: adac15c5bb1a58c0849b67c6e587e88bda6f08c61db3ed96196b9fe13f7dbbe9
# cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks.
---


# Cloud Load Balancing

## 1. Three families, and the current names

### Application Load Balancers — layer 7, HTTP and HTTPS

| Variant | Scope |
|---|---|
| **global external** | global — "distributes HTTP and HTTPS traffic to backends hosted on a variety of Google Cloud platforms" |
| **regional external** | one region |
| **classic** | **global in Premium Tier, regional in Standard Tier** |
| **regional internal** | one region, inside the VPC |
| **cross-region internal** | internal, across multiple regions |

### Proxy Network Load Balancers — layer 4, TCP

| Variant | Scope and note |
|---|---|
| **global external** | multi-region, TCP with **optional SSL offload** |
| **regional external** | one region, TCP |
| **classic** | global in Premium, regional in Standard; TCP with SSL offload |
| **regional internal** | TCP, **no SSL offload** |
| **cross-region internal** | TCP, **no SSL offload** |

### Passthrough Network Load Balancers — layer 4, many protocols

| Variant | Protocols |
|---|---|
| **global external** (Preview) | TCP, UDP, ESP, GRE, ICMP, ICMPv6 |
| **regional external** | the same range |
| **internal** | TCP, UDP, ICMP, ICMPv6, **SCTP**, ESP, AH, GRE |

## 2. The distinction that decides the design

> Passthrough load balancers use **"direct server return (DSR)"** with the **source IP preserved**. Proxy
> variants **terminate** the connection at the balancer.

Read it as three separate consequences:

1. **Source IP.** If the backend needs the client's real address — for allowlisting, for geo logic, for an
   audit trail — a passthrough balancer gives it natively. Behind a proxy you are reading a forwarded header,
   which is a different trust problem.
2. **Protocols.** Only passthrough carries UDP, ESP, AH, GRE, SCTP and ICMP. A workload that is not
   TCP-or-HTTP has exactly one family available.
3. **Features.** TLS termination, header manipulation, Cloud CDN and Cloud Armor's richer policies live on the
   proxy side, because they need a terminated connection.

## 3. The naming, and why it matters to an agent

These are **current** names. "HTTP(S) Load Balancing", "TCP Proxy", "Network Load Balancing" and
"Internal TCP/UDP Load Balancing" are the previous generation of names and are what a model answers from
memory. Writing IaC or a runbook against an old name produces something that does not match the console, the
API or the `gcloud` surface.

The pattern of the current names is itself the lookup: **scope** (global / regional / cross-region) + **reach**
(external / internal) + **family** (Application / proxy Network / passthrough Network) **Load Balancer**.

## 4. Premium and Standard Tier change the answer

The **classic** Application and proxy Network balancers are **global in Premium Tier and regional in Standard
Tier**. That is the same product being a different shape depending on a network-tier setting, and it is the
subtlest trap on this page: a design validated in one tier can be regional in the other.

## 5. What is not here

No quota, capacity or price values. Backend services, health checks, URL maps, forwarding rules and
certificates are the next layer down and are not in this release —
`changelog/2026-10-21-networking-family.md` records that.

Next: `reference/networking/cloud-armor.md` for what attaches to which of these, and
`guides/parity/networking.md` for the ELB/ALB/NLB and Azure Load Balancer / Application Gateway / Front Door
mapping.


---
<!-- cuppy -->
You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 91 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/gcp/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.
<!-- /cuppy -->