L4 vs. L7 load balancing

cloudnetworking

Balancing on addresses and ports versus on the application itself: L4 is fast and blind, L7 reads HTTP and routes by path, header, or cookie.

The NLB/ALB split in cloud menus; TLS termination is the toll gate into L7.

Layer 4 load balancing makes its decision from addresses and ports without examining content; layer 7 parses the application protocol and can route on hostname, path, header or cookie. The difference determines what the load balancer can do and how much it costs to do it.

Layer 4 is fast, protocol-agnostic and largely transparent, since it moves packets without terminating the connection. Layer 7 must terminate the connection, decrypt if it is encrypted, parse the request and open a second connection to the server, which is far more work and buys correspondingly more: content-based routing, session persistence by cookie, header manipulation, request-level retry, and the ability to apply a web application firewall at all.

The practical choice follows from what you need to decide. If routing depends only on which pool of identical servers should receive the traffic, layer 4 is the right tool and the cheaper one. The moment routing depends on the content of the request, or you need to inspect it, layer 7 is not optional. Most real deployments run both at different tiers, which is why understanding where a decision is being made is the first step in diagnosing why traffic went somewhere unexpected.

← All glossary entries