Skip to content
IT Atlas

Networking · Edge & Perimeter

Load Balancing

Distributing client requests across multiple backend servers to provide scale, resilience and maintainability.

IntermediateUpdated 2026-09-01

Overview

Layer 4 load balancing forwards TCP or UDP connections based on address and port. Layer 7 load balancing terminates the connection, reads HTTP metadata, and can route by hostname, path, header or cookie, enabling canary releases, blue/green cutovers and per path backends.

A load balancer is also a resilience and security control point: it performs health checking, TLS termination, rate limiting and, with a WAF module, request inspection.

How it works

  1. 01Health probes remove unhealthy members from rotation; probe design matters more than algorithm choice.
  2. 02Selection algorithms include round robin, least connections, weighted variants and consistent hashing for cache affinity.
  3. 03Session persistence pins a client to a backend by cookie or source address, which trades scalability for compatibility with stateful applications.
  4. 04Global server load balancing uses DNS or anycast to steer users to the closest or healthiest region.

Security considerations

  • Terminate TLS with modern ciphers and automate certificate renewal; expired certificates are a leading avoidable outage.
  • Preserve client IP via X-Forwarded-For or proxy protocol so downstream logging and detection remain useful.
  • Apply rate limiting and WAF rules at the edge rather than in every application.

Common misconfigurations

  • Health checks that test only TCP port reachability while the application returns errors.
  • Sticky sessions applied globally, concentrating load on one node after a failover.
  • Backends reachable directly, bypassing the load balancer's controls.