External backends specified by using internet NEGs

Use external backends (also called custom origins) for Cloud CDN (Content Delivery Network) when content is hosted on-premises or in another cloud, and you want to deliver the content over Google's high performance, distributed edge caching infrastructure.


The following terms are sometimes used interchangeably because they have the same or similar meanings:

  • external backend: A backend that resides outside of Google Cloud and is reachable across the internet. The endpoint in an internet NEG.
  • custom origin: Same as an external backend. In CDN, origin is the industry-standard term for a backend instance that serves web content.
  • internet network endpoint group (NEG): The Google Cloud API resource that you use to specify an external backend.
  • external endpoint: Same as an external backend.

To maintain consistency with the load balancing documentation, this document uses the term external backend except when referring to the internet NEG API resource.

Supported backend types for Cloud CDN

Cloud CDN works with an external Application Load Balancer to deliver content to your users. The external Application Load Balancer provides the frontend IP addresses and ports that receive requests. Cloud CDN content can be sourced from various types of backends:

External backends can be hosted within an on-premises infrastructure or origins provided by third-party providers. The following sections discuss external backends in more detail.

Hybrid and multi-cloud architectures

As you move your services to Google Cloud, you might need to do so in phases. Sometimes certain content can't immediately be moved to a cloud environment and might need to stay on-premises. In other cases, the content might be hosted in another cloud. Cloud CDN support for external backends enables you to use Google's globally distributed edge caching infrastructure for such content.

Hybrid and multi-cloud architecture
Hybrid and multi-cloud architecture

In the diagram, images content resides in Google Cloud, while video resides in a Tokyo data center, which could be on-premises or in another cloud. With external backends, origins in the Tokyo data center can be the backend source of the video content with Cloud CDN and the external Application Load Balancer delivering the content to users.

Using URL maps, this deployment can direct origin pull requests for video traffic to the external backend in Tokyo. This mapping is determined based on request URL: /video.

For images (determined based on request URL: /images), content is sourced from Google Cloud and is delivered by the Cloud CDN edge infrastructure.

Specifying an external backend

Similar to configuring Cloud CDN with your endpoints deployed in Google Cloud, you can use the network endpoint groups (NEGs) API to add your server as the external backend for Cloud CDN.

To specify the external backend, use an internet NEG. An internet NEG has one of the endpoint types shown in the following table.

Endpoint address Type Definition When to use
Hostname and an optional port INTERNET_FQDN_PORT A publicly resolvable fully qualified domain name (FQDN), and an optional port, for example backend.example.com:443 (default ports: 80 for HTTP and 443 for HTTPS) Use this endpoint when your external backend can be resolved by using an FQDN with public DNS.
IP address and an optional port INTERNET_IP_PORT A publicly accessible IP address and an optional port, for example or (default ports: 80 for HTTP and 443 for HTTPS) Use this endpoint to specify a publicly accessible IP address and a port to connect to.

The best practice is to create the internet NEG with the INTERNET_FQDN_PORT endpoint type and an FQDN value as an origin hostname value. This insulates the Cloud CDN configuration from IP address changes in the origin infrastructure. Network endpoints that are defined by using FQDNs are resolved through public DNS. Make sure that the configured FQDN is resolvable through Google Public DNS.

After you create the internet NEG, the type cannot be changed between INTERNET_FQDN_PORT and INTERNET_IP_PORT. You need to create a new internet NEG and change your backend service to use the new internet NEG.

When using an external backend that expects a particular value for the HTTP request's Host header, you must configure the backend service to set the Host header to that expected value. If you don't configure a user-defined request header, a backend service preserves the Host header that the client used to connect to the Google Cloud external Application Load Balancer. For general information about custom headers, see Create custom headers in backend services. For a specific example, see Setting up Cloud CDN with an external backend.

Using external backends and Google Cloud-based origins

The following figure shows an internet NEG used to deploy an external backend with an external Application Load Balancer and Cloud CDN.

Cloud CDN with external backends
Cloud CDN with external backends

What's next