Load balancer backends marked down

lb-app, at 10.1.1.10, spreads HTTPS from clients across vm-web1 and vm-web2. Clients like vm-client time out. nsg-web allows clients on 443 and denies everything else. Find out what the load balancer thinks of its backends, and fix it.

1. Connect to vm-client.

   ssh vm-clientType it
   What's this?

   Opens a shell on vm-client, so the next commands run on that VM. In this lab it's a shortcut. In real Azure you'd connect through something like Azure Bastion, or SSH to an address you can reach.

2. Try the frontend. Type exit when done.

   nc -zv 10.1.1.10 443Type it
   What's this?

   netcat, a standard Linux tool. Tries to open a TCP connection and reports whether it worked.

   • -z only check whether the port answers. Send no data
   • -v print the result in words
   • 10.1.1.10 where to connect
   • 443 the port to try

3. Look at the probe.

   az network lb probe list -g rg-lab --lb-name lb-app -o tableType it
   What's this?

   Works with a load balancer health probe. It checks each backend on a port, and only backends that pass get new connections.

   • -g the resource group the resources live in

4. Look at what filters the backends.

   az network nic list-effective-nsg -g rg-lab --name vm-web1-nicType it
   What's this?

   Shows every security rule applied to a VM's network interface, from the subnet's NSG and the NIC's NSG, in the order they're checked.

   • -g the resource group the resources live in
   • --name the name of the thing to look at or change

5. Let the probe in, ahead of Deny-All-Inbound.

   az network nsg rule create -g rg-lab --nsg-name nsg-web --name Allow-LB-Probe --priority 300 --direction Inbound --access Allow --protocol Tcp --source-address-prefixes AzureLoadBalancer --destination-port-ranges 443Type it
   What's this?

   Adds or changes one rule in a network security group (NSG). Rules are checked from the lowest priority number up, and the first match decides.

   • -g the resource group the resources live in
   • --nsg-name the network security group the rule is in
   • --name the name of the thing to look at or change
   • --priority where the rule sits in the order. Lower numbers are checked first
   • --direction Inbound for traffic coming in to the VM, Outbound for traffic leaving it
   • --access Allow or Deny
   • --protocol TCP or UDP
   • --source-address-prefixes which source addresses the rule matches
   • --destination-port-ranges which ports the rule matches
   • --source-address-prefixes AzureLoadBalancer the service tag for 168.63.129.16

6. Answer the question below.

   Which IP address do the health probes come from?

   Health probe

   A load balancer's regular check on each backend. Only backends that pass get new connections.

   Check