Lecture 178: Classic Load Balancer
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：04:47
- 来源：Udemy Lecture 28555961
- Slide 数量：5
- 画面切换：00:38、01:19、03:20、03:42
扫描说明
逐条读取了 Udemy 页面中的 120 条英文 Transcript cue，并按时间轴扫描全长约 04:47 的视频。依据 CLB 架构与协议、Instance 注册与 Health Check、Listener/Internal Protocol Matrix、Backend Authentication 以及 TCP Pass-through Mutual SSL 划分为 5 个小节。截图均在 Transcript 侧栏关闭、播放器控件隐藏后复核，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. CLB 架构与支持的协议
时间范围：00:00–00:38
总结 / Summary
中文
Classic Load Balancer 可跨多个 Availability Zone 接收客户端连接，并只把请求转发到健康 EC2 Instance。它同时工作在 Layer 4 与 Layer 7，支持 HTTP、HTTPS、TCP 和 SSL/TLS。
English
A Classic Load Balancer can accept client connections across multiple Availability Zones and forwards requests only to healthy EC2 instances. It operates at both Layer 4 and Layer 7 and supports HTTP, HTTPS, TCP, and SSL/TLS.
Transcript
00:00 Okay, so now let's talk about
00:01 the Classic Load Balancer.
00:03 So this is what the architecture does look like
00:05 with a Classic Load Balancer
00:07 where the clients connect to the CLB directly,
00:09 which can be spread across multiple AZs.
00:12 And then we have registered instances
00:13 in each Availability Zones as we want,
00:15 and the idea is that the CLB will forward traffic.
00:19 We'll send traffic to these EC2 instances
00:21 if they're deemed healthy.
00:22 Else, if they're not healthy,
00:23 well obviously the traffic will not be sent to them.
00:26 So the CLB operates at the Layer4 and Layer7,
00:30 and in terms of supportive protocols,
00:32 we have HTTP, HTTPS, TCP,
00:35 and then Security CP, also called SSL/TLS.
2. 直接注册 Instance，没有 Target Group
时间范围：00:38–01:19
总结 / Summary
中文
EC2 Instance 直接注册到 CLB，没有第二代 Load Balancer 引入的 Target Group。Health Check 可使用 HTTP、HTTPS 或 TCP；CLB 也是唯一支持旧式 EC2-Classic Network 的 Load Balancer，但 CLB 与 EC2-Classic 都属于 Legacy Technology。
English
EC2 instances register directly with the CLB, without the target groups introduced by second-generation load balancers. Health checks can use HTTP, HTTPS, or TCP. CLB is also the only load balancer that supports the legacy EC2-Classic network, but both technologies are considered legacy.
Transcript
00:38 The EC2 instances are registered directly
00:42 with the Classic Load Balancers,
00:43 so there is no concept of target groups,
00:45 and that's because target groups
00:46 were a concept that were invented
00:48 with the second generation load balancers,
00:50 such as the ALB or the Network Load Balancer.
00:54 The health checks can be of multiple types
00:56 of HTTP, HTTPS, or TCP.
01:00 And the Classic Load Balancer is the only load balancer
01:03 that supports the EC2-Classic networks as opposed to VPC,
01:07 but this is a deprecated network.
01:09 So it's just something to know,
01:11 but the CLB is also sort of a quote, unquote,
01:13 deprecated load balancer,
01:15 so it goes alongside a deprecated network mode as well.
3. Listener 与 Backend Protocol 组合
时间范围：01:19–03:20
总结 / Summary
中文
客户端到 CLB 的 Listener 与 CLB 到 EC2 的 Internal Connection 是两个独立连接。HTTP Listener 可转发为 HTTP 或 HTTPS；HTTPS Listener 在 CLB 做 SSL Termination，因此证书装在 CLB，但后端仍可使用 HTTP 或 HTTPS。TCP Listener 可转发 TCP 或 SSL，SSL Listener 则在 Layer 4 终止加密后再以 TCP 或 SSL 连接后端；只要 Backend 使用 HTTPS/SSL，EC2 就必须安装相应证书。
English
The client-to-CLB listener and CLB-to-EC2 internal connection are independent. An HTTP listener can forward HTTP or HTTPS. An HTTPS listener terminates SSL on the CLB, so the CLB holds the certificate, while the backend can still use HTTP or HTTPS. A TCP listener can forward TCP or SSL, and an SSL listener terminates Layer 4 encryption before using TCP or SSL to the backend. Whenever the backend uses HTTPS or SSL, EC2 must have the proper certificate.
Transcript
01:19 Okay, so now some very important things to know.
01:21 So the client is connected to the Classic Load Balancer
01:25 through a listener and the Classic Load Balancer
01:28 is connected to your EC2 instance
01:31 through an internal traffic, okay.
01:34 So you have different combinations you can do
01:36 for these things.
01:37 And they are summarized here in a table.
01:39 So we'll read the lines one by one,
01:41 but they should make sense.
01:42 And the reason I'm saying this is that, in the next slide,
01:44 we'll see a very specific use case for it
01:46 that does come up in exam sometimes.
01:48 So the listener can be HTTP.
01:51 That means that the client will connect unsecurely
01:53 to our load balancer.
01:54 But from an internal perspective,
01:56 the CLB can connect to our EC2 instances using HTTP,
02:00 so unsecured traffic, or HTTPS.
02:03 And if we do want to use HTTPS,
02:06 then our EC2 instances
02:07 must have certificates installed on them
02:10 to allow the connection to be encrypted
02:11 between them and the Classic Load Balancer.
02:15 Also, if we set up the listener to be HTTPS,
02:18 then we have SSL Termination happening on the CLB directly,
02:22 in which case we need to install an SSL certificate
02:24 on the CLB.
02:26 And then from an internal communications perspective,
02:27 this iS the same as before,
02:29 the CLB can connect using HTTP or HTTPS
02:33 to the EC2 instances,
02:34 but remember, there are two connections,
02:36 because the first connection
02:37 was terminated directly on the CLB.
02:40 Now, if we go one level lower,
02:43 so if you go to the TCP type of connection,
02:45 so TC clients can connect directly
02:46 using the TCP protocol to your CLB,
02:49 and your CLB can send either TCP traffic
02:52 to your EC2 instance or SSL/TCP secure traffic
02:57 to your EC2 instance, in which case, yet again,
02:59 you must install the proper certificates
03:01 on your EC2 instances.
03:03 And finally, you can also have the SSL termination
03:07 happening directly at the Layer4 on your CLB
03:10 and the internal communication to be TCP or SSL again
03:13 for your EC2 instance.
03:15 So this table should make sense,
03:16 but there are a few considerations to take into account.
4. Backend Authentication
时间范围：03:20–03:42
总结 / Summary
中文
当 CLB 与 EC2 之间启用 HTTPS 或 SSL 时，这称为 Backend Authentication。CLB 使用后端的 Public Certificate 验证服务器身份，而对应 Private Key 保留在 EC2 上，从而保护并认证内部连接。
English
Enabling HTTPS or SSL between the CLB and EC2 is called backend authentication. The CLB uses the backend public certificate to verify the server, while the corresponding private key remains on EC2, protecting and authenticating the internal connection.
Transcript
03:20 So if you enable HTTPS or SSL on your EC2 instances,
03:24 this is what's called backend authentication.
03:27 That means that there is an authentication happening
03:29 between your Classic Load Balancer
03:30 and your backend EC2 instances,
03:32 thanks to these certificates,
03:34 because you have to load the public certificates on your CLB
03:38 and the private keys certificates on your EC2 instances.
5. TCP Pass-through 实现双向 Mutual SSL
时间范围：03:42–04:47
总结 / Summary
中文
CLB 的 TCP-to-TCP 模式不会在 Load Balancer 终止连接，而是把完整流量原样传递给 EC2。SSL Termination 因而发生在 EC2，可让 User 与 EC2 互相验证证书；这是 CLB 实现 Two-way Mutual SSL Authentication 的特殊方式，也是常见考试场景。
English
In CLB TCP-to-TCP mode, the load balancer does not terminate the connection and passes the full traffic stream to EC2. SSL termination therefore occurs on EC2, allowing the user and EC2 to authenticate each other. This is the special CLB method for two-way mutual SSL authentication and is a common exam scenario.
Transcript
03:42 Also, if you have TCP to TCP traffic,
03:46 then this is a very special use case
03:48 for the Classic Load Balancer.
03:50 And in that case, if you do have TCP to TCP,
03:52 then there is no termination of connection happening
03:55 at the CLB level.
03:57 That means that all the traffic will be passed on directly
04:00 to the EC2 instances.
04:02 What this means is that, as you can see here,
04:04 the CLB actually doesn't do any termination.
04:06 It will pass them to traffic from the users
04:09 to the registered EC2 instances.
04:10 And why do I say this?
04:12 Well, because this is the only way
04:13 to do two-way mutual SSL authentication
04:17 in which the users have to authenticate
04:19 to the EC2 instances,
04:21 but also the EC2 instances have to be authenticated
04:24 to the users.
04:26 So in this case,
04:27 we'll have SSL termination happening on the EC2 instances,
04:30 and the traffic is going to go across the whole way,
04:34 and we can enable mutual SSL authentication.
04:37 And this is the exam case
04:38 that can come up in the exam, okay?
04:40 So that's all you need to know
04:41 for the Classic Load Balancer.
04:43 I hope you liked it,
04:44 and I will see you in the next lecture.
整讲总结 / Overall Summary
中文
Classic Load Balancer 是同时支持 L4 与 L7 的旧一代 Load Balancer，Instance 直接注册且没有 Target Group。前端 Listener 与后端连接可分别选择 HTTP/HTTPS/TCP/SSL；前端 HTTPS/SSL 在 CLB 做 Termination，而后端 HTTPS/SSL 形成 Backend Authentication。最重要的考试点是 TCP-to-TCP Pass-through 不在 CLB 终止连接，因此可把 TLS 直接交给 EC2，实现双向 Mutual SSL Authentication。
English
Classic Load Balancer is a legacy load balancer operating at both L4 and L7, with instances registered directly and no target groups. Frontend listeners and backend connections can independently use HTTP, HTTPS, TCP, or SSL. Frontend HTTPS/SSL terminates on the CLB, while backend HTTPS/SSL provides backend authentication. The key exam point is that TCP-to-TCP pass-through does not terminate on the CLB, allowing TLS to reach EC2 for two-way mutual SSL authentication.
返回顶部 ↑