Service Selection
| Service | Layer | Use when |
|---|---|---|
| Azure Load Balancer | Layer 4 | You need TCP/UDP balancing for VMs or private services. |
| Traffic Manager | DNS | You need DNS-based global distribution across endpoints. |
| Gateway Load Balancer | Layer 3/4 insertion | You need transparent NVA insertion in the data path. |
Azure Load Balancer
- Standard Load Balancer is the normal production choice.
- Public Load Balancer exposes services to the internet.
- Internal Load Balancer exposes private services inside a VNet.
- Regional Load Balancer handles traffic in one region.
- Cross-region Load Balancer distributes traffic across regional load balancers.
Configuration Objects
- Frontend IP configuration: public or private address where clients connect.
- Backend pool: targets that receive traffic.
- Health probe: determines backend availability.
- Load-balancing rule: maps frontend traffic to backend pool and probe.
- Inbound NAT rule: maps a frontend port to a backend VM port.
- Outbound rule: controls outbound SNAT for backend instances.
Traffic Manager
Traffic Manager returns DNS answers based on routing method and endpoint health. It does not proxy traffic. Clients connect directly to the returned endpoint.
| Routing method | Use case |
|---|---|
| Priority | Active-passive failover. |
| Weighted | Controlled traffic distribution. |
| Performance | Route users to lowest-latency endpoint. |
| Geographic | Route by user geography or compliance boundary. |
| Subnet | Route specific client IP ranges to specific endpoints. |
| Multivalue | Return multiple healthy endpoints. |
Gateway Load Balancer
Gateway Load Balancer enables transparent chaining to NVAs. It is used when inspection appliances must be inserted without changing consumer routing too much. Know tunnel interfaces, backend pool NVAs, and chaining with Standard Load Balancer or public IP resources.
Troubleshooting
- If traffic fails, check health probe first.
- Check NSGs on backend NICs and subnets.
- Check backend service listening port.
- Check SNAT exhaustion for outbound-heavy workloads.
- For Traffic Manager, remember DNS caching and TTL.
Feature Deep Dive
Health Probes
Health probes decide whether a backend receives traffic. A backend can be perfectly healthy from an operating system point of view and still be removed from rotation if the probe path, port, protocol, or response does not match. For load balancer questions, probe behavior is often the clue.
Outbound SNAT
Azure Load Balancer can provide outbound connectivity through outbound rules, but NAT Gateway is usually the cleaner subnet-level outbound design. If a question focuses on stable outbound IPs and high-scale outbound connections, think NAT Gateway. If the outbound behavior is tied to a load balancer backend pool, outbound rules may be part of the design.
Traffic Manager Is DNS
Traffic Manager does not sit in the data path. It answers DNS queries with the endpoint it selects. That means client DNS caching and TTL affect failover speed. If the question needs edge acceleration, TLS termination, WAF, or HTTP proxying, Traffic Manager is not enough.
Gateway Load Balancer
Gateway Load Balancer solves appliance insertion. It keeps consumers simple while traffic is tunneled to NVA instances. This is especially useful when third-party firewalls, IDS/IPS, or packet inspection tools must inspect traffic without each workload owning complex routing.
Exam Clues
| Wording | Likely answer |
|---|---|
| TCP or UDP backend pool | Azure Load Balancer |
| DNS-based failover between regions | Traffic Manager |
| Insert virtual appliance transparently | Gateway Load Balancer |
| Stable outbound IP for subnet | NAT Gateway |
Scenario Workshop: Healthy VM, Unhealthy Probe
Scenario: A backend VM is running, but the load balancer marks it unhealthy. The exam wants you to separate compute health from probe health. Load balancers do not care that the VM is powered on. They care whether the configured probe receives the expected response.
| Probe failure cause | Example | Fix |
|---|---|---|
| Wrong port | Probe checks 80 but app listens on 8080. | Change probe or app listener. |
| NSG blocks probe | Subnet NSG denies AzureLoadBalancer source. | Allow required probe traffic. |
| App returns wrong status | HTTP probe expects 200 but app redirects or errors. | Use correct path and expected response behavior. |
| Guest firewall blocks | Windows/Linux firewall denies probe port. | Open local firewall. |
Load Balancer Design Checklist
- Choose public or internal frontend.
- Choose regional or cross-region design.
- Use Standard SKU for production and zone-aware designs.
- Define backend pool membership and health probe.
- Configure load-balancing rules for service traffic.
- Configure inbound NAT only for management scenarios that cannot use Bastion or safer patterns.
- Configure outbound rules only when Load Balancer owns the outbound design; otherwise consider NAT Gateway.
Previous | Next: Part 7 - Application Gateway and Front Door