DevOps Peach

Azure Basics · Network Traffic – Routing, Private Link, Load Balancer, Application Gateway · Lesson 4 of 5

Backend Pools, Rules, Health Probes and Session Persistence

A rule maps frontend IP:port to backend pool:port; a health probe takes failed VMs out of rotation; session persistence keeps a client on the same VM by IP or IP + protocol.

Practice interactively →

flowchart LR
  FE["fe-web :80"] --> R["rule-http<br/>Tcp 80 → 80"]
  R --> BP["be-web"]
  BP --> V1["web-01 ✓"]
  BP --> V2["web-02 ✓"]
  BP --> V3["web-03 ✗ probe fail"]
  P["hp-tcp-80<br/>Tcp :80"] -. "checks" .-> BP
Part Meaning
Backend pool IPs of the NICs/VMs that receive traffic; Standard: any VM in one VNet (VMs, availability sets, scale sets)
Load-balancing rule Frontend IP + port + protocol → backend pool + port, with a probe
Inbound NAT rule A dedicated frontend port → one specific VM (SSH to each VM, say)
Health probe TCP (a TCP session opens), HTTP/HTTPS (returns 200); failing VMs are taken out of the pool

Session persistence (--load-distribution)

Value Behaviour
Default (None) 5-tuple hash: each flow may land on a different VM
SourceIP (Client IP) Same client IP → same VM
SourceIPProtocol (Client IP and protocol) Same client IP and protocol → same VM

Traps: no probe (or a probe on the wrong port) sends traffic to broken VMs or removes them all; mixing up NAT rules (one VM) and LB rules (the whole pool); confusing "Client IP" with "Client IP and protocol".

Command Meaning
az network lb probe create -g rg-devops-lab --lb-name lb-web -n hp-tcp-80 --protocol Tcp --port 80 Health probe
az network lb rule create ... --protocol Tcp --frontend-port 80 --backend-port 80 LB rule
az network lb rule update ... --load-distribution SourceIP Turn on Client IP affinity

Probe settings

A probe has an interval (how often it checks, default 5 seconds) and uses the configured port and path. An HTTP probe considers only status 200 healthy, so a page that redirects (301 or 302) marks the VM down. Give the application a lightweight /health endpoint that checks its own dependencies, and allow the AzureLoadBalancer service tag in the NSG, because probes come from the platform address 168.63.129.16.

Outbound connections

Backend VMs reach the internet through outbound rules that translate their private IPs to the load balancer's public IP (SNAT). Each frontend IP provides a fixed number of SNAT ports, and busy services that open many connections to the same destination can run out. Remedies are adding frontend IPs, allocating ports manually per instance, reusing connections in the application, or attaching a NAT Gateway to the subnet, which Microsoft recommends for most outbound needs.

Less common options

Option Purpose
HA ports On an internal Standard LB, one rule that balances every TCP and UDP port, used in front of firewall appliances
Floating IP Keeps the frontend IP as the destination on the VM, needed for SQL Server Always On listeners
Idle timeout and TCP reset Controls how long an idle flow stays open (4 to 100 minutes) and sends a reset when it closes
Multiple frontends One load balancer serving several public IPs or services

Watching it work

Load balancer metrics in Azure Monitor include Data Path Availability (can the frontend be reached) and Health Probe Status per backend. A drop in probe status with healthy data path points to the application or its NSG, not to the load balancer itself. Insights on the load balancer resource draws the topology of frontends, rules, and backends.

Practice interactively →