Azure Load Balancer

What is Azure Load Balancer?

Azure Load Balancer distributes inbound traffic across multiple backend VM instances. When a client connects, the Load Balancer picks one backend VM (based on the distribution algorithm) and forwards all packets for that connection to that VM. The client sees a single IP — the frontend IP of the Load Balancer.

Basic vs Standard SKU

Public vs Internal Load Balancer

Key Components

Frontend IP Configuration

The IP address that clients connect to. For public LB: a public IP. For internal LB: a private IP from a subnet. You can have multiple frontend IPs on one Load Balancer.

Backend Pool

The group of VMs that receive the traffic. You add VMs (via their NICs) to the backend pool. The Load Balancer distributes traffic among healthy VMs in the pool.

Load Balancing Rules

Define how frontend traffic maps to the backend pool. A rule specifies: frontend IP + port → backend pool + port. Example: Frontend port 80 → Backend pool port 80.

Health Probe

Determines which backend VMs are healthy and should receive traffic. If a VM fails the health probe, it's removed from rotation automatically.

Health Probes

Health probes check if backend VMs are responsive. Three types:

Key health probe settings:

• Interval — How often to probe (default: 15 seconds)
• Unhealthy threshold — How many failures before removing from rotation (default: 2)

Distribution Algorithms

Load Balancer uses a 5-tuple hash by default to determine which backend VM receives each connection:

• Source IP
• Source port
• Destination IP
• Destination port
• Protocol

This ensures all packets from the same client connection go to the same backend VM (session persistence). You can also configure:

• 2-tuple (Source IP) — Same source IP always goes to same backend VM (for protocols that need persistent sessions)
• 3-tuple (Source IP + Protocol) — Source IP and protocol determine destination

NAT Rules

Inbound NAT rules allow you to forward traffic from a specific frontend port to a specific backend VM and port. Useful for accessing individual VMs behind the Load Balancer (e.g., SSH to each VM on a different port).

Frontend port 5001 → VM1 port 22 (SSH to VM1)
Frontend port 5002 → VM2 port 22 (SSH to VM2)
Frontend port 5003 → VM3 port 22 (SSH to VM3)

# Connect to VM1: ssh user@public-ip -p 5001
# Connect to VM2: ssh user@public-ip -p 5002

Creating a Load Balancer

# Create public IP for the LB
az network public-ip create \
  --resource-group myRG \
  --name lb-public-ip \
  --sku Standard \
  --allocation-method Static

# Create Load Balancer
az network lb create \
  --resource-group myRG \
  --name myLoadBalancer \
  --sku Standard \
  --frontend-ip-name myFrontend \
  --public-ip-address lb-public-ip \
  --backend-pool-name myBackendPool

# Create health probe
az network lb probe create \
  --resource-group myRG \
  --lb-name myLoadBalancer \
  --name myHealthProbe \
  --protocol Http \
  --port 80 \
  --path /health \
  --interval 15 \
  --threshold 2

# Create load balancing rule (port 80 → port 80)
az network lb rule create \
  --resource-group myRG \
  --lb-name myLoadBalancer \
  --name myHTTPRule \
  --protocol Tcp \
  --frontend-port 80 \
  --backend-port 80 \
  --frontend-ip-name myFrontend \
  --backend-pool-name myBackendPool \
  --probe-name myHealthProbe

Load Balancer vs Application Gateway