Load Balancing Strategies
🔥 0
⭐ 0
Lesson 4 of 5 18 min +250 XP

L4 vs L7 Load Balancers

"Just add a load balancer" sounds simple until you realize there are different types operating at different network layers. Understanding L4 vs L7 is crucial for making the right choice.

The OSI Model Quick Recap

Layer 7: Application   ← HTTP, HTTPS, WebSocket (L7 LB works here)
Layer 6: Presentation
Layer 5: Session
Layer 4: Transport     ← TCP, UDP (L4 LB works here)
Layer 3: Network       ← IP
Layer 2: Data Link
Layer 1: Physical

L4 LOAD BALANCER

Sees: IP addresses + Ports

"I see a TCP connection from 192.168.1.100:54321 to port 443. I'll forward it to Server B."

L7 LOAD BALANCER

Sees: Full HTTP request

"I see GET /api/users with auth token X. I'll forward it to the API server cluster."

L4 Load Balancer: The Fast Forwarder

L4 load balancers work at the TCP/UDP level. They don't understand HTTP - they just forward packets.

What L4 Can See

TCP Packet:
┌─────────────────────────────────────────┐
│ Source IP: 192.168.1.100               │ ✓ Can see
│ Source Port: 54321                      │ ✓ Can see
│ Dest IP: 10.0.0.1 (LB)                 │ ✓ Can see
│ Dest Port: 443                          │ ✓ Can see
│                                         │
│ [Encrypted HTTP payload - can't read]   │ ✗ Can't see
└─────────────────────────────────────────┘

What L4 Can Do

Routing decisions based on:
- Source IP address
- Destination port
- Protocol (TCP/UDP)

That's it. No URL, no headers, no cookies.

L4 Architecture

Client                 L4 Load Balancer              Backend
   │                        │                           │
   │ ──TCP SYN────────────▶ │                           │
   │                        │ ──TCP SYN───────────────▶ │
   │                        │ ◀─TCP SYN-ACK──────────── │
   │ ◀─TCP SYN-ACK───────── │                           │
   │ ──TCP ACK────────────▶ │ ──TCP ACK───────────────▶ │
   │                        │                           │
   │ ══════════════ Connection established ═══════════  │
   │ ──Data (encrypted)───▶ │ ──Data (encrypted)─────▶  │
   │ ◀─Data (encrypted)──── │ ◀─Data (encrypted)─────── │
Key insight: The L4 LB just passes TCP packets through. If it's HTTPS, the LB never sees the decrypted content.

L7 Load Balancer: The Smart Router

L7 load balancers terminate the connection and inspect HTTP content.

What L7 Can See

HTTP Request (after SSL termination):
┌─────────────────────────────────────────┐
│ GET /api/users HTTP/1.1                 │ ✓ URL path
│ Host: api.example.com                   │ ✓ Host header
│ Authorization: Bearer eyJhbG...         │ ✓ Auth token
│ Cookie: session=abc123                  │ ✓ Cookies
│ X-Request-ID: uuid-here                 │ ✓ Custom headers
│                                         │
│ { "name": "John" }                      │ ✓ Body (if needed)
└─────────────────────────────────────────┘

What L7 Can Do

URL-Based Routing

/api/* → API servers
/static/* → CDN

Header Manipulation

Add X-Forwarded-For
Add trace IDs

SSL Termination

Decrypt at edge
HTTP to backends

Content-Based Routing

Route by cookie
A/B testing

L7 Architecture

Client                 L7 Load Balancer              Backend
   │                        │                           │
   │ ══SSL Handshake══════▶ │                           │
   │ ◀═══════════════════   │                           │
   │                        │                           │
   │ ──GET /api/users─────▶ │ (reads HTTP request)      │
   │                        │                           │
   │                        │ ──GET /api/users────────▶ │
   │                        │ ◀─200 OK + JSON────────── │
   │                        │                           │
   │ ◀─200 OK + JSON─────── │                           │
Key insight: L7 terminates SSL and makes two separate connections (client→LB and LB→backend).

Side-by-Side Comparison

Feature L4 (Transport) L7 (Application)
Speed Very fast (just forwards packets) Slower (parses HTTP)
SSL Termination Passes through (end-to-end) Terminates at LB
URL Routing No Yes
Header Inspection No Yes
Cookie Affinity No (use IP hash) Yes
Protocol Any TCP/UDP HTTP/HTTPS/WebSocket
Connections One (pass-through) Two (client + backend)

When to Use L4

Choose L4 When:
  • You need maximum throughput (millions of connections)
  • You're load balancing non-HTTP protocols (database, gaming, IoT)
  • You want end-to-end encryption (SSL passthrough)
  • You don't need content-based routing
Examples:
  • Database connection pooling
  • Gaming servers
  • IoT message brokers
  • Internal microservice communication (when all go to same pool)

When to Use L7

Choose L7 When:
  • You need URL-based routing (/api/* vs /static/*)
  • You need SSL termination at the edge
  • You need cookie-based session affinity
  • You want to add/modify headers (X-Forwarded-For)
  • You're doing A/B testing or canary deployments
Examples:
  • Web applications with multiple backend services
  • API gateways
  • Microservices with path-based routing
  • CDN edge routing

Real-World Example: E-Commerce Architecture

Internet
    │
    ▼
┌─────────────────┐
│ L7 (Cloudflare) │  ← SSL termination, WAF, DDoS protection
└────────┬────────┘
         │
         ▼
┌─────────────────┐
│ L7 (AWS ALB)    │  ← Path-based routing
└────────┬────────┘
    ┌────┴────┬───────────────┐
    │         │               │
    ▼         ▼               ▼
┌───────┐ ┌───────┐     ┌───────────┐
│ /api/*│ │/static│     │ /admin/*  │
│ API   │ │ CDN   │     │ Admin App │
│Servers│ │       │     │           │
└───┬───┘ └───────┘     └───────────┘
    │
    ▼
┌─────────────────┐
│ L4 (AWS NLB)    │  ← Internal service mesh, max performance
└────────┬────────┘
    ┌────┴────┐
    ▼         ▼
┌───────┐ ┌───────┐
│ DB    │ │ Cache │
│Cluster│ │Cluster│
└───────┘ └───────┘

AWS Load Balancer Options

ALB (Application)
L7, HTTP/HTTPS
Path routing, WAF
NLB (Network)
L4, TCP/UDP
Millions of connections
GWLB (Gateway)
L3, network appliances
Firewalls, IDS/IPS

Key Takeaways

  • L4 = Fast and simple - Forwards TCP/UDP packets without inspection
  • L7 = Smart and flexible - Understands HTTP, enables content-based routing
  • Use L4 for performance - Databases, gaming, internal services
  • Use L7 for web apps - Path routing, SSL termination, microservices

Next up: Assessment Quiz - Test your understanding of load balancing strategies.

🧠 Quick Quiz

Test your understanding of this lesson.

1

At which OSI layer does an L4 load balancer operate?

2

Which type of load balancer can route based on URL path?

3

Why might you choose an L4 load balancer over L7?

Monitoring Backend Health