[Yandex Cloud documentation](../../../../index.md) > [Tutorials](../../../index.md) > [Security](../../index.md) > [Migrating services from an NLB to an L7 ALB to enable Smart Web Security protection](../index.md) > [NLB with VMs as targets](index.md) > Management console

# Migrating services from an NLB with VMs as targets to an L7 ALB using the management console

# Migrating services from an NLB with VMs as targets to an L7 ALB using the management console


To migrate a service from a network load balancer to an L7 load balancer using the management console:

1. [See the service migration recommendations](#recommendations).
1. [Create a migration infrastructure](#before-you-begin).
1. [Create a Smart Web Security profile](#create-profile-sws).
1. [Create an L7 load balancer](#create-alb). At this step, you will associate the Smart Web Security profile with a virtual host of the L7 load balancer.
1. [Test the L7 load balancer](#test).
1. [Migrate user traffic from the network load balancer to the L7 load balancer](#migration-nlb-to-alb).

## Service migration recommendations {#recommendations}

1. Optionally, enable L3-L4 DDoS protection (the [OSI model](https://en.wikipedia.org/wiki/OSI_model)). It will enhance the L7 protection provided by [Yandex Smart Web Security](../../../../smartwebsecurity/index.md) after migration.

    To enable L3-L4 protection:

    1. Before the migration, [reserve a public static IP address with DDoS protection](../../../../vpc/operations/enable-ddos-protection.md#enable-on-reservation) and use this address for the L7 load balancer's listener. If you already have a protected public IP address for the load balancer, you can keep this address during migration. Otherwise, you will have to change the IP address to a protected one.

    1. Configure a trigger threshold for the protection mechanisms, consistent with the amount of legitimate traffic to the protected resource. To set up this threshold, contact [support](https://center.yandex.cloud/support).

    1. [Set](../../../../vpc/operations/adjust-mtu-ddos-protection.md) the MTU value to `1450` for the targets downstream of the load balancer. For more information, see [MTU and TCP MSS](../../../../vpc/concepts/mtu-mss.md).

1. Perform migration during the hours when the user load is at its lowest. If you decided to keep your public IP address, your service will be unavailable during the migration while this IP address is moved from the load balancer to the L7 load balancer. This usually takes a few minutes.

1. When using an L7 load balancer, requests to backends come with the source IP address from the range of internal IP addresses of the subnets specified when creating the L7 load balancer. The original IP address of the request source (user) is specified in the `X-Forwarded-For` header. If you want to log public IP addresses of users on the web server, reconfigure it.

1. Before the migration, determine the minimum number of resource units for the [autoscaling](../../../../application-load-balancer/concepts/application-load-balancer.md#lcu-scaling) settings in the L7 load balancer:

    Select the number of resource units based on the analysis of your service load expressed in:

    * Number of requests per second (RPS).
    * Number of concurrent active connections.
    * Number of new connections per second.
    * Traffic processed per second.

## Create your infrastructure {#before-you-begin}

1. [Create subnets](../../../../vpc/operations/subnet-create.md) in three availability zones for the L7 load balancer.

1. Create [security groups](../../../../application-load-balancer/concepts/application-load-balancer.md#security-groups) that allow the L7 load balancer to receive inbound traffic and send it to the targets and allow the targets to receive inbound traffic from the load balancer.

1. When using HTTPS, [add the TLS certificate](../../../../certificate-manager/operations/import/cert-create.md#create-certificate) of your service to [Yandex Certificate Manager](../../../../certificate-manager/index.md).

1. Optionally, [reserve an L3-L4 DDoS-protected static public IP address](../../../../vpc/operations/get-static-ip.md) for the L7 load balancer.

## Create a Smart Web Security profile {#create-profile-sws}

[Create a Smart Web Security profile](../../../../smartwebsecurity/operations/profile-create.md) by selecting **From a preset template**.

Use these settings when creating the profile:

* In the **Action for the default base rule** field, select `Allow`.
* For the **Smart Protection** rule, enable **Only logging (dry run)**.

These settings enable logging of traffic information, but no actions will be applied to the traffic. This will reduce the risk of disconnecting users due to profile configuration issues. Further on, you will have the option to disable **Only logging (dry run)** and configure deny rules for your use case in the security profile.

## Create an L7 load balancer {#create-alb}

1. [Create a target group](../../../../application-load-balancer/operations/target-group-create.md) for the L7 load balancer. Under **Targets**, select the VMs in your network load balancer's target group.

1. [Create a backend group](../../../../application-load-balancer/operations/backend-group-create.md) with the following settings:

    1. Select `HTTP` as the backend group type.
    1. If your service needs one and the same backend resource processing requests within a single user session, enable [session affinity](../../../../application-load-balancer/concepts/backend-group.md#session-affinity) for the backend group.
    1. Under **Backends**, click **Add** and set up the backend:

        * **Type**: `Target group`.
        * **Target groups**: Target group you created earlier.
        * **Port**: TCP port on which your service's VMs accept inbound traffic.
        * Under **Protocol settings**, select `HTTP` or `HTTPS` depending on the protocol used by your service.
        * Under **HTTP health check**, set the check up according to these [recommended practices](../../../../application-load-balancer/concepts/best-practices.md#health-checks-recommendations).
        * Optionally, configure other settings as per [this guide](../../../../application-load-balancer/operations/backend-group-create.md).

1. [Create an HTTP router](../../../../application-load-balancer/operations/http-router-create.md).

    Under **Virtual hosts**, click **Add virtual host** and configure the virtual host:

    * **Authority**: Your service domain name.
    * **Security profile**: Smart Web Security profile you created earlier.

        {% note warning %}

        Smart Web Security cannot be made operational without linking a security profile to the L7 load balancer's virtual host.

        {% endnote %}

    * Click **Add route** and configure the route:

        * **Path**: `Starts with` `/`.
        * **Action**: `Routing`.
        * **Backend group**: Backend group you created earlier.

1. [Create an L7 load balancer](../../../../application-load-balancer/operations/application-load-balancer-create.md) by selecting **Manual**:

    1. Specify the security group you created earlier.
    1. Under **Allocation**, select subnets in three availability zones for the load balancer nodes. Enable traffic in these subnets.
    1. Under **Autoscaling settings**, specify the [minimum number of resource units](../../../../application-load-balancer/concepts/application-load-balancer.md#lcu-scaling-settings) per availability zone based on expected load.
    1. Under **Listeners**, click **Add listener** and set up the listener:

        1. Under **Public IP address**, specify:

            * **Port**: TCP port on which your service's VMs accept inbound traffic.
            * **Type**: `List`. Select a public IP address from the list. If you plan to enable DDoS protection at levels L3-L4, select a static public IP address with DDoS protection installed.

        1. Under **Receiving and processing traffic**, specify:

            * **Listener type**: `HTTP`.
            * **Protocol**: Select `HTTP` or `HTTPS` depending on the protocol your service uses.
            * If you select `HTTPS`, specify the TLS certificate you added to Certificate Manager earlier in the **Certificates** field.
            * **HTTP router**: Select the HTTP router you created earlier.

## Test the L7 load balancer {#test}

1. Wait until the L7 load balancer goes `Active`.

1. Navigate to the new L7 load balancer and select **Health checks** on the left. Make sure you get `HEALTHY` for all checks.

1. Run a test request to the service through the L7 load balancer, for example, using one of these methods:
   
   * Add this record to the `hosts` file on your workstation: `<L7_load_balancer_public_IP_address> <service_domain_name>`. Delete the record after the test.
   * Execute the request using [cURL](https://curl.se/) depending on the protocol type:
   
       ```bash
       curl http://<service_domain_name> \
           --resolve <service_domain_name>:<service_port>:<public_IP_address_of_L7_load_balancer>
       ```
   
       ```bash
       curl https://<service_domain_name> \
           --resolve <service_domain_name>:<service_port>:<public_IP_address_of_L7_load_balancer>
       ```

## Migrate user traffic from the network load balancer to the L7 load balancer {#migration-nlb-to-alb}

Select one of these migration options:

* [Keep the public IP address for your service](#save-public-ip).
* [Do not keep the public IP address for your service](#not-save-public-ip).

### Keep the public IP address for your service {#save-public-ip}

1. If your external network load balancer uses a dynamic public IP address, [convert it to a static one](../../../../vpc/operations/set-static-ip.md).

1. [Delete the listener](../../../../network-load-balancer/operations/listener-remove.md) in the network load balancer to release the static public IP address. This will make your service unavailable through the network load balancer.

1. In the L7 load balancer, assign to the listener the public IP address previously used by the network load balancer:

    {% list tabs group=instructions %}

    * CLI {#cli}

        If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../../cli/quickstart.md#install).

        The folder used by default is the one specified when [creating](../../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

        To change the public IP address, run this command:

        ```bash
        yc application-load-balancer load-balancer update-listener <load_balancer_name> \
           --listener-name <listener_name> \
           --external-ipv4-endpoint address=<service_public_IP_address>,port=<service_port>
        ```

        Where `address` is the public IP address the network load balancer used previously.

    {% endlist %}

1. After the IP address changes, your service will again be available through the L7 load balancer. Monitor the L7 load balancer's user traffic on the [load balancer statistics](../../../../application-load-balancer/operations/application-load-balancer-get-stats.md) charts.

1. Delete the now free static public IP address you selected when creating the L7 load balancer.

1. Optionally, [delete the network load balancer](../../../../network-load-balancer/operations/load-balancer-delete.md) after migrating user traffic to the L7 load balancer.

### Do not keep the public IP address for your service {#not-save-public-ip}

1. To migrate user traffic from a network load balancer to an L7 load balancer, in your domain's public zone DNS service, update the A record for the service domain name to point to the L7 load balancer public IP address. If the public domain zone was created in [Yandex Cloud DNS](../../../../dns/index.md), update the record using [this guide](../../../../dns/operations/resource-record-update.md).

    {% note info %}

    The migration may take a while because the propagation of DNS record's updates depends on its time-to-live (TTL) and the number of links in the DNS request chain.

    {% endnote %}

1. As the DNS record updates propagate, monitor the increase in requests to the L7 load balancer on the [load balancer statistics](../../../../application-load-balancer/operations/application-load-balancer-get-stats.md) charts.

1. Monitor the decrease in traffic on the network load balancer using the `processed_bytes` and `processed_packets` [load balancer metrics](../../../../monitoring/metrics-ref/network-load-balancer-ref.md). You can [create a dashboard](../../../../monitoring/operations/dashboard/create.md) to visualize these metrics. If there is no load on the network load balancer for a long time, the migration to the L7 load balancer is complete.

1. Optionally, [delete the network load balancer](../../../../network-load-balancer/operations/load-balancer-delete.md) after migrating user traffic to the L7 load balancer.