4.1.2. Load Balancing Rules
Components:
Load Distribution Modes:
| Mode | Hash | Use Case |
|---|---|---|
| Default (5-tuple) | Source IP, port, dest IP, port, protocol | Stateless apps |
| Source IP (2-tuple) | Source IP, dest IP | Session affinity |
| Source IP + protocol (3-tuple) | Source IP, dest IP, protocol | Same-client affinity |
Health Probes:
| Protocol | Best For |
|---|---|
| TCP | Simple availability check |
| HTTP/HTTPS | Application-level health (checks specific path) |
Probe settings:
- Interval: How often to probe (seconds)
- Unhealthy threshold: Failed probes before marking unhealthy
Inbound NAT Rules:
A load balancing rule spreads one frontend port across the whole backend pool. An inbound NAT rule does the opposite: it forwards a specific frontend port to a single backend instance, which is how you reach one particular VM through a load balancer that has no public IP of its own.
| Load balancing rule | Inbound NAT rule | |
|---|---|---|
| Destination | The whole backend pool | One backend instance |
| Typical use | Serving application traffic | Management access, such as RDP or SSH to one VM |
| Port mapping | Same port on all members | A distinct frontend port per instance |
The classic pattern is frontend port 50001 to VM1:3389 and 50002 to VM2:3389. Inbound NAT rules can also be defined against a backend pool so that port ranges are assigned to instances automatically, which is what scale sets use.
Outbound Rules (SNAT):
Standard Load Balancer provides explicit outbound SNAT configuration:
| Setting | Purpose |
|---|---|
| Frontend IP | Source IP for outbound |
| Backend pool | VMs using this rule |
| Protocol | TCP, UDP, or both |
| Allocated ports | SNAT ports per instance |
| Idle timeout | How long to keep connections |
⚠️ Exam Trap: Without explicit outbound rules or NAT Gateway, Standard LB backends have NO outbound internet access. This is by design (secure by default).
