Azure Load BalancerAuthorCloudBrum editorial teamLast reviewed30 Oct 2026Reading time~12 minLevelBeginner to advanced

# Placeholders: replace the names and the region with your own.
RG=rg-lb-demo
LOC=centralindia

az group create --name $RG --location $LOC

# 1. A network, and a security group that lets web traffic in. A Standard load balancer is closed to inbound traffic until a
#    security group allows it (the retired Basic SKU was open by default).
az network vnet create --resource-group $RG --name vnet-web --address-prefixes 10.20.0.0/16 --subnet-name web --subnet-prefixes 10.20.1.0/24
az network nsg create --resource-group $RG --name nsg-web
az network nsg rule create --resource-group $RG --nsg-name nsg-web --name allow-http --priority 100 --direction Inbound --access Allow \
  --protocol Tcp --source-address-prefixes Internet --destination-port-ranges 80 8080

# 2. A zone-redundant Standard public IP and the load balancer with one front end and one backend pool.
az network public-ip create --resource-group $RG --name lb-ip --sku Standard --allocation-method Static --zone 1 2 3
az network lb create --resource-group $RG --name lb-web --sku Standard --public-ip-address lb-ip \
  --frontend-ip-name front --backend-pool-name pool

# 3. A health probe that calls /health every 15 seconds, and a rule that sends port 80 to port 8080.
#    A server leaves the rotation after two failed probes. TCP reset on idle tells both ends when a connection was dropped,
#    and outbound SNAT is switched off on the rule because outbound traffic goes through a NAT gateway (step 4).
az network lb probe create --resource-group $RG --lb-name lb-web --name health --protocol Http --port 8080 --path /health \
  --interval 15 --probe-threshold 2
az network lb rule create --resource-group $RG --lb-name lb-web --name web --protocol Tcp --frontend-port 80 --backend-port 8080 \
  --frontend-ip-name front --backend-pool-name pool --probe-name health --idle-timeout 4 --enable-tcp-reset true --disable-outbound-snat true

# 4. Outbound traffic: a NAT gateway on the subnet gives the servers a fixed outbound address and plenty of ports.
az network public-ip create --resource-group $RG --name nat-ip --sku Standard --allocation-method Static
az network nat gateway create --resource-group $RG --name natgw --public-ip-addresses nat-ip --idle-timeout 10
az network vnet subnet update --resource-group $RG --vnet-name vnet-web --name web --nat-gateway natgw --network-security-group nsg-web

# 5. Two network interfaces that join the backend pool as they are created, and a server on each.
for N in 1 2; do
  az network nic create --resource-group $RG --name web-$N-nic --vnet-name vnet-web --subnet web \
    --lb-name lb-web --lb-address-pools pool
  az vm create --resource-group $RG --name web-$N --image Ubuntu2204 --size Standard_B2s --admin-username azureuser \
    --generate-ssh-keys --nics web-$N-nic --no-wait
done

# 6. Is each server answering its probe, and is the data path up? Both are metrics on the load balancer, split by backend address.
LB_ID=$(az network lb show --resource-group $RG --name lb-web --query id --output tsv)
az monitor metrics list --resource $LB_ID --metric DipAvailability --dimension BackendIPAddress --aggregation Average --interval PT5M --offset 1h
az monitor metrics list --resource $LB_ID --metric VipAvailability --aggregation Average --interval PT5M --offset 1h

# Placeholders: pass in your own location. The names below are examples.
variable "location" {
  type    = string
  default = "centralindia"
}

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "lb" {
  name     = "rg-lb-demo"
  location = var.location
}

resource "azurerm_virtual_network" "web" {
  name                = "vnet-web"
  address_space       = ["10.20.0.0/16"]
  location            = azurerm_resource_group.lb.location
  resource_group_name = azurerm_resource_group.lb.name
}

resource "azurerm_subnet" "web" {
  name                 = "web"
  resource_group_name  = azurerm_resource_group.lb.name
  virtual_network_name = azurerm_virtual_network.web.name
  address_prefixes     = ["10.20.1.0/24"]
}

# A Standard load balancer is closed to inbound traffic until a security group allows it.
resource "azurerm_network_security_group" "web" {
  name                = "nsg-web"
  location            = azurerm_resource_group.lb.location
  resource_group_name = azurerm_resource_group.lb.name

  security_rule {
    name                       = "allow-http"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_ranges    = ["80", "8080"]
    source_address_prefix      = "Internet"
    destination_address_prefix = "*"
  }
}

resource "azurerm_subnet_network_security_group_association" "web" {
  subnet_id                 = azurerm_subnet.web.id
  network_security_group_id = azurerm_network_security_group.web.id
}

resource "azurerm_public_ip" "lb" {
  name                = "lb-ip"
  location            = azurerm_resource_group.lb.location
  resource_group_name = azurerm_resource_group.lb.name
  sku                 = "Standard"
  allocation_method   = "Static"
  zones               = ["1", "2", "3"]
}

resource "azurerm_lb" "web" {
  name                = "lb-web"
  location            = azurerm_resource_group.lb.location
  resource_group_name = azurerm_resource_group.lb.name
  sku                 = "Standard"

  frontend_ip_configuration {
    name                 = "front"
    public_ip_address_id = azurerm_public_ip.lb.id
  }
}

resource "azurerm_lb_backend_address_pool" "pool" {
  loadbalancer_id = azurerm_lb.web.id
  name            = "pool"
}

resource "azurerm_lb_probe" "health" {
  loadbalancer_id     = azurerm_lb.web.id
  name                = "health"
  protocol            = "Http"
  port                = 8080
  request_path        = "/health"
  interval_in_seconds = 15
  probe_threshold     = 2
}

resource "azurerm_lb_rule" "web" {
  loadbalancer_id                = azurerm_lb.web.id
  name                           = "web"
  protocol                       = "Tcp"
  frontend_port                  = 80
  backend_port                   = 8080
  frontend_ip_configuration_name = "front"
  backend_address_pool_ids       = [azurerm_lb_backend_address_pool.pool.id]
  probe_id                       = azurerm_lb_probe.health.id
  idle_timeout_in_minutes        = 4
  enable_tcp_reset               = true
  disable_outbound_snat          = true # outbound traffic goes through the NAT gateway below
}

# Outbound traffic: a NAT gateway gives the servers a fixed outbound address and plenty of ports.
resource "azurerm_public_ip" "nat" {
  name                = "nat-ip"
  location            = azurerm_resource_group.lb.location
  resource_group_name = azurerm_resource_group.lb.name
  sku                 = "Standard"
  allocation_method   = "Static"
}

resource "azurerm_nat_gateway" "web" {
  name                    = "natgw"
  location                = azurerm_resource_group.lb.location
  resource_group_name     = azurerm_resource_group.lb.name
  sku_name                = "Standard"
  idle_timeout_in_minutes = 10
}

resource "azurerm_nat_gateway_public_ip_association" "web" {
  nat_gateway_id       = azurerm_nat_gateway.web.id
  public_ip_address_id = azurerm_public_ip.nat.id
}

resource "azurerm_subnet_nat_gateway_association" "web" {
  subnet_id      = azurerm_subnet.web.id
  nat_gateway_id = azurerm_nat_gateway.web.id
}

# Two network interfaces that join the backend pool. Attach a virtual machine to each, or point a scale set at the pool.
resource "azurerm_network_interface" "web" {
  count               = 2
  name                = "web-${count.index + 1}-nic"
  location            = azurerm_resource_group.lb.location
  resource_group_name = azurerm_resource_group.lb.name

  ip_configuration {
    name                          = "primary"
    subnet_id                     = azurerm_subnet.web.id
    private_ip_address_allocation = "Dynamic"
  }
}

resource "azurerm_network_interface_backend_address_pool_association" "web" {
  count                   = 2
  network_interface_id    = azurerm_network_interface.web[count.index].id
  ip_configuration_name   = "primary"
  backend_address_pool_id = azurerm_lb_backend_address_pool.pool.id
}

output "public_ip_address" {
  value = azurerm_public_ip.lb.ip_address
}

# pip install azure-monitor-querymetrics azure-identity
# Reads the load balancer's health probe results per server, and checks whether outbound SNAT ports are running out.
import datetime as dt

from azure.identity import DefaultAzureCredential
from azure.monitor.querymetrics import MetricAggregationType, MetricsClient

# Metrics are read from a regional endpoint, so use the region of the load balancer.
metrics = MetricsClient("https://centralindia.metrics.monitor.azure.com", DefaultAzureCredential())
NAMESPACE = "Microsoft.Network/loadBalancers"


def backend_health(lb_resource_id, hours=1):
    """Average health probe status per backend address over the last hours: 100 means every probe was answered and 0 means none were.
    The load balancer stops sending new connections to a server whose probes fail, so anything below 100 deserves a look."""
    result = metrics.query_resources(
        resource_ids=[lb_resource_id], metric_namespace=NAMESPACE, metric_names=["DipAvailability"],
        timespan=dt.timedelta(hours=hours), granularity=dt.timedelta(minutes=5),
        aggregations=[MetricAggregationType.AVERAGE], filter="BackendIPAddress eq '*'")[0]
    health = {}
    for metric in result.metrics:
        for series in metric.timeseries:
            values = [point.average for point in series.data if point.average is not None]
            if values:
                backend = next(iter(series.metadata_values.values()), "unknown")
                health[backend] = sum(values) / len(values)
    return health


def snat_pressure(lb_resource_id, hours=1):
    """Highest share of the allocated SNAT ports that was in use. Above about 0.8, outbound connections start to fail, so add
    a NAT gateway or more outbound addresses."""
    result = metrics.query_resources(
        resource_ids=[lb_resource_id], metric_namespace=NAMESPACE, metric_names=["UsedSnatPorts", "AllocatedSnatPorts"],
        timespan=dt.timedelta(hours=hours), granularity=dt.timedelta(minutes=5),
        aggregations=[MetricAggregationType.MAXIMUM])[0]
    peak = {}
    for metric in result.metrics:
        values = [point.maximum for series in metric.timeseries for point in series.data if point.maximum is not None]
        peak[metric.name] = max(values) if values else 0
    return peak["UsedSnatPorts"] / peak["AllocatedSnatPorts"] if peak.get("AllocatedSnatPorts") else 0.0


if __name__ == "__main__":
    lb_id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-lb-demo/providers/Microsoft.Network/loadBalancers/lb-web"
    for backend, percent in sorted(backend_health(lb_id).items()):
        print("%s: %.0f%% of probes answered" % (backend, percent))
    print("SNAT ports in use: %.0f%%" % (snat_pressure(lb_id) * 100))

// dotnet add package Azure.ResourceManager.Network
// dotnet add package Azure.Identity
// Audits every load balancer in the subscription: the retired Basic SKU, rules that rely on default outbound SNAT,
// TCP-only probes, and rules without TCP reset.
using Azure.Identity;
using Azure.ResourceManager;
using Azure.ResourceManager.Network;
using Azure.ResourceManager.Network.Models;
using Azure.ResourceManager.Resources;

var arm = new ArmClient(new DefaultAzureCredential());
SubscriptionResource subscription = await arm.GetDefaultSubscriptionAsync();
int problems = 0;

await foreach (LoadBalancerResource lb in subscription.GetLoadBalancersAsync())
{
    LoadBalancerData data = lb.Data;
    string name = data.Name;

    if (data.Sku?.Name == LoadBalancerSkuName.Basic)
    {
        Console.WriteLine($"{name}: Basic SKU, which Microsoft retired on 30 September 2025, so upgrade to Standard");
        problems++;
    }

    foreach (ProbeData probe in data.Probes)
    {
        if (probe.Protocol == ProbeProtocol.Tcp)
        {
            Console.WriteLine($"{name}/{probe.Name}: TCP probe only proves the port is open, so use an HTTP probe for web servers");
            problems++;
        }
    }

    bool hasOutboundRules = data.OutboundRules.Count > 0;
    foreach (LoadBalancingRuleData rule in data.LoadBalancingRules)
    {
        if (rule.DisableOutboundSnat != true && !hasOutboundRules)
        {
            Console.WriteLine($"{name}/{rule.Name}: outbound SNAT is left on with no outbound rule, which can run out of ports (use a NAT gateway)");
            problems++;
        }
        if (rule.EnableTcpReset != true)
        {
            Console.WriteLine($"{name}/{rule.Name}: TCP reset is off, so clients learn about idle timeouts late");
            problems++;
        }
    }
}

Console.WriteLine(problems == 0 ? "No problems found." : $"{problems} problem(s) found.");
return problems == 0 ? 0 : 1;