Skip to content

Commit 8f99f93

Browse files
committed
docs: fix metadata, style edits
1 parent 6be7cd4 commit 8f99f93

1 file changed

Lines changed: 7 additions & 8 deletions

File tree

articles/firewall/integrate-lb.md

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,11 @@
11
---
22
title: Integrate Azure Firewall with Azure Standard Load Balancer
33
description: You can integrate an Azure Firewall into a virtual network with an Azure Standard Load Balancer (either public or internal).
4-
services: firewall
54
author: varunkalyana
5+
ms.author: duau
66
ms.service: azure-firewall
77
ms.topic: how-to
8-
ms.date: 03/04/2025
9-
ms.author: duau
8+
ms.date: 03/28/2026
109
ms.custom: sfi-image-nochange
1110
# Customer intent: As a network engineer, I want to integrate Azure Firewall with an Azure Standard Load Balancer, so that I can optimize traffic routing and enhance security in my virtual network setup.
1211
---
@@ -15,23 +14,23 @@ ms.custom: sfi-image-nochange
1514

1615
You can integrate an Azure Firewall into a virtual network with either a public or internal Azure Standard Load Balancer.
1716

18-
The preferred design is to use an internal load balancer with your Azure Firewall, as it simplifies the setup. If you already have a public load balancer deployed and wish to continue using it, be aware of potential asymmetric routing issues that could disrupt functionality.
17+
The preferred design is to use an internal load balancer with your Azure Firewall, as it simplifies the setup. If you already have a public load balancer deployed and want to continue using it, be aware of potential asymmetric routing problems that could disrupt functionality.
1918

2019
For more information about Azure Load Balancer, see [What is Azure Load Balancer?](../load-balancer/load-balancer-overview.md)
2120

2221
## Public load balancer
2322

24-
With a public load balancer, the load balancer is deployed with a public frontend IP address.
23+
When you use a public load balancer, you deploy the load balancer with a public frontend IP address.
2524

2625
### Asymmetric routing
2726

28-
Asymmetric routing is where a packet takes one path to the destination and takes another path when returning to the source. This issue occurs when a subnet has a default route going to the firewall's private IP address and you're using a public load balancer. In this case, the incoming load balancer traffic is received via its public IP address, but the return path goes through the firewall's private IP address. Since the firewall is stateful, it drops the returning packet because the firewall isn't aware of such an established session.
27+
Asymmetric routing occurs when a packet takes one path to the destination and takes another path when returning to the source. This problem occurs when a subnet has a default route going to the firewall's private IP address and you're using a public load balancer. In this case, the incoming load balancer traffic comes through its public IP address, but the return path goes through the firewall's private IP address. Since the firewall is stateful, it drops the returning packet because the firewall isn't aware of such an established session.
2928

3029
### Fix the routing issue
3130

3231
#### Scenario 1: Azure Firewall without NAT Gateway
33-
When deploying an Azure Firewall into a subnet, you need to create a default route for the subnet. This route directs packets through the firewall's private IP address located on the AzureFirewallSubnet. For detailed steps, see [Deploy and configure Azure Firewall using the Azure portal](tutorial-firewall-deploy-portal.md#create-a-default-route).
34-
When integrating the firewall into your load balancer scenario, ensure that your Internet traffic enters through the firewall's public IP address. The firewall applies its rules and NAT the packets to the load balancer's public IP address. The issue arises when packets arrive at the firewall's public IP address but return via the private IP address (using the default route).
32+
When you deploy an Azure Firewall into a subnet, you need to create a default route for the subnet. This route directs packets through the firewall's private IP address located on the AzureFirewallSubnet. For detailed steps, see [Deploy and configure Azure Firewall using the Azure portal](tutorial-firewall-deploy-portal.md#create-a-default-route).
33+
When you integrate the firewall into your load balancer scenario, ensure that your Internet traffic enters through the firewall's public IP address. The firewall applies its rules and NATs the packets to the load balancer's public IP address. The problem arises when packets arrive at the firewall's public IP address but return via the private IP address (using the default route).
3534

3635
To prevent asymmetric routing, add a specific route for the firewall's public IP address. Packets intended for the firewall's public IP address are directed through the Internet, bypassing the default route to the firewall's private IP address.
3736

0 commit comments

Comments
 (0)