Traffic distributed. Failures absorbed.

L4 and L7 load balancing with health-checked pools, TLS termination and WAF attachment — the front door that never wobbles.

L4 & L7TLS terminationWAF-ready

Talk to us All Networking

Capabilities

The front door, engineered

Enterprise-grade edge protection and delivery that keeps your applications fast, secure and always on.

Layer 4 and 7

TCP passthrough or full HTTP awareness with routing rules.

TCP to HTTP routing →

Health checks

Unhealthy backends leave rotation automatically, and alert the NOC.

Bad targets pulled fast →

TLS termination

Certificates from the SSL service, renewed without touching apps.

Certs handled centrally →

WAF attachment

Put the managed WAF in front with one configuration change.

Inspection built in →

Zonal HA pairs

Active-standby balancers, cross-zone on the Plus plans.

No single point in front →

Sticky sessions

Cookie and IP affinity when state demands it.

Sessions that hold →

Autoscale friendly

Scaling groups register and drain targets automatically.

Fleet grows, LB follows →

Path & host routing

Route by hostname and path to different backends.

One entry, many services →

Connection draining

Deployments drain gracefully — no dropped mid-flight requests.

Deploys users don’t feel →

Metrics per backend

Latency and errors per target group, streamed to Obersva.

See the slow node →

Resilient by designBuilt to continue, even when hardware fails.

Predictable performanceConsistent I/O for the apps that matter.

Efficient at scaleOne flat fee. Scale without waste.

Backed by humansReal experts. Real support. Every time.

Compare the balancers

Layer 4, Layer 7, or internal

Health-checked pools in all three — the difference is how much the balancer understands about your traffic.

ProductionEdgeComing soon

TIER 01

Layer 4

Fast and protocol-agnostic

TCP and UDP distribution with health checks and connection draining — for databases, custom protocols and raw throughput.

Best for

Custom protocolsDatabase front endsHigh-throughput services

Where it runs

Dubai AZ1Dubai AZ2RiyadhBahrainMumbaiAbu DhabiFrankfurtNairobi

Plans

BalanceTCP/UDP · health checks · 2 poolsSign in →Balance PlusConnection draining · 6 pools · cross-zoneSign in →CustomAny listener and pool countSign in →

TIER 02Most used

Layer 7

HTTP that understands routing

HTTP and HTTPS distribution with path and host rules, TLS termination, sticky sessions and WAF attachment.

Best for

Web & API front endsBlue-green releasesTLS offload

Where it runs

Dubai AZ1Dubai AZ2RiyadhBahrainMumbaiAbu DhabiFrankfurtNairobi

Plans

L7Path & host rules · TLS offloadSign in →L7 PlusSticky sessions · WAF attach · canary weightsSign in →CustomAny rule set, certificate and routing policySign in →

TIER 03

Internal

East-west traffic

Private balancers inside your networks for service-to-service traffic that must never touch a public listener.

Best for

Service-to-serviceInternal APIsRegulated tiers

Where it runs

Dubai AZ1RiyadhBahrainMumbaiDubai AZ2Nairobi

Plans

InternalPrivate listener · health checksSign in →Internal PlusCross-zone · mTLS · per-service poolsSign in →CustomAny private topology and identity modelSign in →

Two ways to run it

Self-service pools, or managed front door

Both are highly available by default. The difference is who tunes the rules.

Self-serviceYou hold the rulesYour team creates listeners, pools and rules through the console or API as services come and go.

API and Terraform-driven configuration

Health-check policies you control

Certificates managed centrally

Best for:Teams deploying frequently

Explore Self-service plans

Managed Front DoorWe hold the pagerNetwork Operations owns listener design, certificate hygiene and failover behaviour, with change review in front of it.

Reviewed rule and certificate changes

Failover behaviour tested, not assumed

24/7 monitoring of pools and endpoints

Best for:Public platforms under load

Explore Managed Front Door plans

Who decides, who runs it

What each group gets from Load Balancer

Four groups shape a cloud decision. Pick the one you belong to — the platform reads differently from each seat.

“Releases stopped being visible to customers”

Traffic shifts between versions and away from failures, so ordinary change stops producing customer-visible incidents.

GovernedSovereignPredictable

FAQs

Is it highly available by default?

Yes — balancers run as active-standby pairs, and Plus plans place them across zones.

Can it terminate TLS?

Yes, with certificates managed centrally through SSL so renewals never become an outage.

Can we attach a WAF?

Yes — Layer 7 balancers attach to managed WAF policies with SOC-maintained rule sets.

Do you support canary releases?

Yes. Weighted pools let you shift a percentage of traffic and roll back instantly.

Can balancers be private only?

Yes — the Internal tier exposes no public listener at all.

How is the flat fee different from public cloud pricing?

Everything inside the plan you opt for is included — no additional charge for the components that make it up. Public clouds meter each component on consumption, so the bill moves with usage. Here the plan is reserved for you and the figure you agreed is the figure you pay.

Can we drive it from Terraform and CI?

Yes. Every operation is exposed through the REST API, CLI and a maintained Terraform provider, with scoped API keys per team. If the console can do it, your pipeline can do it.

How do limits and quotas work?

Quotas are yours to shape — carve capacity per team or project and delegate inside it. Hard ceilings are a conversation, not a wall; the estate re-baselines at thresholds you approve.

Can security services be included in my plan?

Yes. Endpoint security, firewalls and WAF are scoped into the same flat fee when you add them — one figure, no separate security invoice.

Better together