[Yandex Cloud documentation](../../../index.md) > [Yandex Smart Web Security](../../index.md) > [Tutorials](../index.md) > [Creating an L7 load balancer with a security profile](index.md) > Management console

# Creating an L7 load balancer in Application Load Balancer with a Smart Web Security profile from the management console

To create an [L7 load balancer with a Smart Web Security](index.md) profile from the Yandex Cloud management console:

1. [Get your cloud ready](#before-you-begin).
1. [Set up your infrastructure](#infrastructure-prepare).
1. [Create a security profile](#profile-create).
1. [Associate the security profile with a virtual host](#profile-connect).
1. [Test the security profile](#test).

If you no longer need the resources you created, [delete them](#clear-out).

## Get your cloud ready {#before-you-begin}

Sign up for Yandex Cloud and create a [billing account](../../../billing/concepts/billing-account.md):
1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or create a new account.
1. On the **[Yandex Cloud Billing](https://center.yandex.cloud/billing/accounts)** page, make sure you have a billing account linked and it has the `ACTIVE` or `TRIAL_ACTIVE` [status](../../../billing/concepts/billing-account-statuses.md). If you do not have a billing account, [create one](../../../billing/quickstart/index.md) and [link](../../../billing/operations/pin-cloud.md) a cloud to it.

If you have an active billing account, you can create or select a [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) for your infrastructure on the [cloud page](https://console.yandex.cloud/cloud).

[Learn more about clouds and folders here](../../../resource-manager/concepts/resources-hierarchy.md).

### Required paid resources {#paid-resources}

The infrastructure support costs for an L7 load balancer with a Smart Web Security profile include:
* Fee for continuously running [VMs](../../../compute/concepts/vm.md) (see [Yandex Compute Cloud pricing](../../../compute/pricing.md)).
* Fee for using the [L7 load balancer's](../../../application-load-balancer/concepts/index.md) computing resources (see [Application Load Balancer pricing](../../../application-load-balancer/pricing.md)).
* Fee for requests processed by [security profile](../../concepts/profiles.md) rules (see [Yandex Smart Web Security pricing](../../pricing.md)).


## Set up your infrastructure {#infrastructure-prepare}

[Deploy](../../../application-load-balancer/quickstart.md) an Application Load Balancer infrastructure and a VM with a test web server.

You will create the following resources:
* [VM](../../../compute/concepts/vm.md) named `test-vm1` with a test web server.
* [Target group](../../../application-load-balancer/concepts/target-group.md) named `test-target-group`.
* [Backend group](../../../application-load-balancer/concepts/backend-group.md) named `test-backend-group`.
* [HTTP router](../../../application-load-balancer/concepts/http-router.md) named `test-http-router` with a [virtual host](../../../application-load-balancer/concepts/http-router.md#virtual-host) named `test-virtual-host`.
* [L7 load balancer](../../../application-load-balancer/concepts/application-load-balancer.md) named `test-load-balancer`.

Save the public IP address of the L7 load balancer: you will need it to test your security profile.

{% note tip %}

To ensure availability of your service at high load, set up [autoscaling](../../../application-load-balancer/concepts/application-load-balancer.md#lcu-scaling) for your L7 load balancer.

{% endnote %}

## Create a security profile {#profile-create}

The security profile is the central Smart Web Security component that includes a set of rules, each containing conditions for filtering user requests arriving to the resource being protected.

To create a security profile:

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder where you want to create a profile.
  1. Navigate to **Smart Web Security**.
  1. In the left-hand panel, select ![shield-check](../../../_assets/console-icons/shield-check.svg) **Security profiles**.
  1. Click **Create profile** and select **From a preset template**.

      A preset profile includes:
      
      * [Basic default rule](../../concepts/rules.md#base-rules) enabled for all traffic with the `Allow` [action type](../../concepts/rules.md#rule-action).
      * [Smart Protection rule](../../concepts/rules.md#smart-protection-rules), `sp-rule-1`, enabled for all traffic with the `Full protection` action type.

      {% note tip %}
      
      Creating a pre-configured profile with full Smart Protection is preferable. This will ensure the highest level of security for your resource.
      
      {% endnote %}

  1. Enter a name for the profile, e.g., `test-sp1`.
  1. In the **Action for the default base rule** field, select `Deny`. Therefore, if no other rules are set, all traffic to the protected resource will be denied.
  1. Click ![plus-sign](../../../_assets/console-icons/plus.svg) **Add rule**.
  1. In the rule creation window:
      1. Enter a name for the rule, e.g., `test-rule1`.
      1. Set the rule priority, e.g., `999800`. The rule will have higher priority than the preset ones.

          {% note info %}
          
          The smaller the value, the higher is the rule priority. The priorities for preconfigured rules are as follows:
          * Basic default rule: `1000000`.
          * Smart Protection rule providing full protection: `999900`.
          
          {% endnote %}

      1. Select the `Base` rule type.
      1. Select the `Allow` action.

          The rule will describe conditions under which requests will be routed to the test application backend.
      1. In the **Conditions** field, select IP.
      1. In the **IP conditions** field that appears, select `Matches or belongs to range` and set the public IP address of the device from which you are going to send requests to the L7 load balancer, e.g., `158.160.100.200`.
      1. Click **Add**.
        
          The rule you created will appear under **Security rules** in the table.
  1. Click **Create**.

{% endlist %}

## Associate the security profile with the virtual host {#profile-connect}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) containing the [security profile](../../concepts/profiles.md).
    1. Navigate to **Smart Web Security**.
    1. In the left-hand panel, select ![shield-check](../../../_assets/console-icons/shield-check.svg) **Security profiles**.
    1. Select the security profile you want to connect to the [virtual host](../../../application-load-balancer/concepts/http-router.md#virtual-host) [Yandex Application Load Balancer](../../../application-load-balancer/index.md).
    1. Click ![plug](../../../_assets/console-icons/plug-connection.svg) **Connect to host**.
    1. In the window that opens, click **Add resource** and select **Virtual host**.
    1. Set the [**Load balancer**](../../../application-load-balancer/concepts/application-load-balancer.md), [**HTTP router**](../../../application-load-balancer/concepts/http-router.md), and [**Virtual host**](../../../application-load-balancer/concepts/http-router.md#virtual-host) values one by one. You can associate the security profile with multiple virtual hosts at once.
  
        To associate the profile with another L7 load balancer, click **Add resource** and select **Virtual host**.
      
    1. Click **Connect**. If the selected hosts are already connected to another security profile, confirm the connection.
  
        You will see the connected virtual hosts under ![cubes-3-overlap](../../../_assets/console-icons/cubes-3-overlap.svg) **Connected resources**.

{% endlist %}

## Test the security profile {#test}

1. Open the terminal on the device whose IP address you specified in the allow rule.
1. Send a request to the test application backend:

    ```bash
    curl --verbose <public_IP_address_of_L7_load_balancer>
    ```

    This command should list the contents of the directory with your test web server.

1. Repeat the request from a different IP address. As a result, you should see a message about a failure to establish a connection to the server.

{% note info %}

Smart protection rules are usually not tested. Such tests would add the properties of suspicious requests, e.g., IP addresses, to a blacklist.

{% endnote %}

## How to delete the resources you created {#clear-out}

To stop paying for the resources you created:
1. [Delete](../../operations/profile-delete.md) the security profile.
1. [Delete](../../../application-load-balancer/operations/application-load-balancer-delete.md) the L7 load balancer.
1. [Delete](../../../application-load-balancer/operations/http-router-delete.md) the HTTP router.
1. [Delete](../../../application-load-balancer/operations/backend-group-delete.md) the backend group.
1. [Delete](../../../application-load-balancer/operations/target-group-delete.md) the target group.
1. [Delete](../../../compute/operations/vm-control/vm-delete.md) the VM.

#### Useful links {#see-also}

* [Creating an L7 load balancer in Application Load Balancer with a Smart Web Security profile through Terraform](terraform.md)