-
Notifications
You must be signed in to change notification settings - Fork 21.8k
Expand file tree
/
Copy pathload-balancer-faqs.yml
More file actions
162 lines (130 loc) · 13.6 KB
/
load-balancer-faqs.yml
File metadata and controls
162 lines (130 loc) · 13.6 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
### YamlMime:FAQ
metadata:
title: Frequently asked questions - Azure Load Balancer
description: Answers to frequently asked questions about the Azure Load Balancer.
services: load-balancer
author: mbender-ms
ms.service: azure-load-balancer
ms.topic: faq
ms.date: 02/23/2026
ms.author: mbender
ms.custom: engagement-fy23
title: Load Balancer frequently asked questions
summary: |
sections:
- name: Ignored
questions:
- question: |
What types of Azure Load Balancer exist?
answer: |
Internal load balancers, which load balance traffic within a virtual network.
External load balancers, which load balance external traffic to an internet connected endpoint. For more information, see [Azure Load Balancer Types](./load-balancer-overview.md).
For both types, Azure offers a Standard SKU and a Gateway SKU that have different functional, performance, security, and health tracking capabilities. For more information about the different load balancer SKUs, see [SKU Comparison](skus.md).
> [!IMPORTANT]
> Basic Load Balancer was retired on September 30, 2025. If you're still using Basic Load Balancer, upgrade to Standard Load Balancer as soon as possible. For upgrade guidance, see [Upgrade from Basic to Standard](upgrade-basic-standard.md).
- question: |
How can I upgrade from a basic to a standard load balancer?
answer: |
> [!IMPORTANT]
> Basic Load Balancer was retired on September 30, 2025. Upgrade to Standard Load Balancer as soon as possible.
For more information about an automated script and guidance on upgrading a load balancer SKU, see [upgrade from Basic to Standard](upgrade-basic-standard.md).
- question: |
What are the different load-balancing options in Azure?
answer: |
For the available load-balancing services and recommended uses for each, see the [load balancer technology guide](/azure/architecture/guide/technology-choices/load-balancing-overview).
- question: |
Where can I find the load balancer ARM templates?
answer: |
See the [list of Azure Load Balancer quickstart templates](/azure/templates/microsoft.network/loadbalancers#quickstart-templates) for ARM templates of common deployments.
- question: |
How are inbound NAT rules different from load-balancing rules?
answer: |
Inbound NAT rules are used to specify a backend resource to route traffic to. For example, configuring a specific load balancer port to send RDP traffic to a specific VM. Load-balancing rules are used to specify a pool of backend resources to route traffic to, balancing the load across each instance. For example, a load balancer rule can route TCP packets on port 80 of the load balancer across a pool of web servers.
- question: |
What is IP 168.63.129.16?
answer: |
The virtual IP address for the host tagged as the Azure infrastructure load balancer where the Azure health probes originate. Traffic must be allowed from this IP address to successfully respond to health probes when backend instances are configured. This rule doesn't interact with access to your load balancer frontend. If you're not using the Azure Load Balancer, you can override this rule. You can learn more about service tags [here](../virtual-network/service-tags-overview.md#available-service-tags).
- question: |
Can I use global virtual network peering with a basic load balancer?
answer: |
No. Basic Load Balancer doesn't support global virtual network peering. Basic Load Balancer was retired on September 30, 2025. Upgrade to Standard Load Balancer, which supports global virtual network peering. See the [upgrade from Basic to Standard](upgrade-basic-standard.md) article for information about the upgrade.
- question: |
How can I discover the public IP that an Azure VM uses?
answer: |
There are many ways to determine the public source IP address of an outbound connection. OpenDNS provides a service that can show you the public IP address of your VM.
By using the nslookup command, you can send a DNS query for the name myip.opendns.com to the OpenDNS resolver. The service returns the source IP address that was used to send the query. When you run the following query from your VM, the response is the public IP used for that VM:
```nslookup myip.opendns.com resolver1.opendns.com```
- question: |
Can I add a VM from the same availability set to different backend pools of a load balancer?
answer: |
Adding a VM from the same availability set to different backend pools isn't possible if the load balancer is NIC based. However, with IP-based load balancer, this constraint is lifted.
- question: |
Can I ping from a backend VM behind a load balancer to a public IP?
answer: |
No, Azure Load Balancer does not support ICMP pings for outbound connectivity. If you want to ping outbound from a backend VM behind a load balancer, associate an Instance-level Public IP to the backend VM and send pings from that IP.
- question: |
What is the maximum data throughput that can be achieved via an Azure Load Balancer?
answer: |
Azure Load Balancer is a pass-through network load balancer. Throughput limitations are determined by the type of virtual machine in the backend pool. To learn about other network throughput related information, see [Virtual Machine network throughput](../virtual-network/virtual-machine-network-throughput.md).
- question: |
How do connections to Azure Storage in the same region work?
answer: |
Azure's internal network infrastructure keeps traffic between Azure services in the same region stays within the Azure network, by default. This means when Load Balancer and Azure Storage account are in the same region, the traffic between them doesn't traverse the internet by remaining on the internal Azure network backbone. However, the exact behavior can depend on the specific configuration of your Azure services, including network security group rules, routing, and any other network controls you have in place.
- question: |
How do connections to Azure Storage in different regions work?
answer: |
For connectivity to storage in other regions, outbound connectivity is required. The source IP address in the storage diagnostic logs is an internal provider address, and not the public IP address of your VM when connecting to storage from a VM in the same region. To restrict access to your storage account to VMs in one or more virtual network subnets in the same region, use [Virtual Network service endpoints](../virtual-network/virtual-network-service-endpoints-overview.md). Don't use your public IP address when configuring your storage account firewall. When service endpoints are configured, you see your virtual network private IP address in your storage diagnostic logs and not the internal provider address.
- question: |
Does Azure Load Balancer support TLS/SSL termination?
answer: |
No, Azure Load Balancer doesn't currently support termination as it's a pass through network load balancer. [Application Gateway](../application-gateway/ssl-overview.md) could be a potential solution if your application requires termination.
- question: |
How do I configure my load balancer with an Azure Firewall?
answer: |
Follow these [instructions](../firewall/integrate-lb.md) to configure your load balancer with an Azure Firewall.
- question: |
Can I use my custom IP address prefix (BYOIP) with Azure Load Balancer?
answer: |
Yes, this scenario is supported. You need to create a public IP prefix and public IP address from your custom IP address prefix before using it with your load balancer. To learn more, visit [Manage a custom IP address prefix](../virtual-network/ip-services/manage-custom-ip-address-prefix.md).
- question: |
How do I configure my load balancer with an Azure SQL Server Always On availability group?
answer: |
Follow these [Portal](/azure/azure-sql/virtual-machines/windows/availability-group-load-balancer-portal-configure) or [PowerShell](/azure/azure-sql/virtual-machines/windows/availability-group-listener-powershell-configure) instructions to configure your load balancer with an Azure SQL Server Always On availability group.
- question: |
Can I access the frontend of my internal load balancer from the participating backend pool VM?
answer: |
No, Azure Load Balancer doesn't support this scenario. To learn more, visit our [troubleshoot page](load-balancer-troubleshoot-backend-traffic.md#cause-4-access-of-the-internal-load-balancer-frontend-from-the-participating-load-balancer-backend-pool-vm).
- question: |
What are best practices with respect to outbound connectivity?
answer: |
Standard Load Balancer and standard public IP introduce abilities and different behaviors to outbound connectivity. If you want outbound connectivity with Standard SKUs, you must explicitly define it either with standard public IP addresses or a standard public load balancer. Standard internal load balancer must have outbound connectivity defined. It's recommended you always use outbound rules on a standard public load balancer. When an internal standard load balancer is used, you must take steps to create outbound connectivity for the VMs in the backend pool if outbound connectivity is desired. In the context of outbound connectivity, a single standalone VM, all the VMs in an Availability Set, all the instances in a Virtual Machine Scale Set behave as a group. If a single VM in an Availability Set is associated with a Standard SKU, all VM instances within this Availability Set now behave by the same rules as if they're associated with Standard SKU even if an individual instance isn't directly associated with it. This behavior is also observed in a standalone VM with multiple network interface cards attached to a load balancer. If one NIC is added as a standalone, it has the same behavior. Review this entire document to understand the overall concepts, review [Standard Load Balancer](./load-balancer-overview.md) for differences between SKUs, and review [outbound rules](load-balancer-outbound-connections.md#outboundrules).
Using outbound rules allows you fine grained control over all aspects of outbound connectivity.
> [!IMPORTANT]
> [Default outbound access](../virtual-network/ip-services/default-outbound-access.md) is being retired. After March 31, 2026, new virtual networks will default to using private subnets. You must define an explicit outbound connectivity method (NAT gateway, load balancer outbound rules, or instance-level public IP) for VMs to reach the internet.
- question: |
Is it expected for one frontend IP to be used when I have multiple frontend IP addresses or a prefix on my outbound rules?
answer: |
Azure Load Balancer will use IPs as needed based on available ports. It will only use the next frontend IP once the connections cannot be made from the one IP.
- question: |
How can I view the traffic from my configured health probe(s)?
answer: |
To view the traffic sent to each backend instance from the health probe you can use IP stack statistics with a tool such as netstat. The health probe traffic originates from 168.63.129.16.
- question: |
If I enable DDoS Protection for my load balancer frontend, what does that mean for the resources in the backend pool?
answer: |
When enabled on the frontend IP for a load balancer, DDoS Protection applies protection for all backend pool resources that are accessible through that public IP. For more information, see [Azure DDoS Protection Reference](../ddos-protection/ddos-protection-reference-architectures.md).
- question: |
Why are certain ports restricted for HTTP health probes?
answer: |
The following ports are restricted for HTTP health probes: 19, 21, 25, 70, 110, 119, 143, 220, 993. These ports are blocked for security reasons by WinHTTP, meaning that Load Balancer health probes are unable to use these ports. For more information, see [What's New in WinHTTP 5.1](/windows/win32/winhttp/what-s-new-in-winhttp-5-1#changes-to-default-settings).
- question: |
Can I ping my load balancer?
answer: |
Yes, you can ping the frontend of your Standard Public Load Balancer. For more information, see [how to ping the frontend of your load balancer.](load-balancer-test-frontend-reachability.md)
- question: |
Can I include On-premises IPs in the backend pool of Azure Load Balancer?
answer: |
No, Azure Load Balancer does not support the direct addition of On-premises IPs to its backend pool. The load balancer employs a platform-specific IP address (168.63.129.16) for health probes, limited to communication within Azure's virtual network. Consequently, it cannot probe resources located on-premises.
additionalContent: |
## Next steps
If your question is not listed above, please send feedback about this page with your question. This will create a GitHub issue for the product team to ensure all of our valued customer questions are answered.