Dit deel is nog niet vertaald. Je ziet de Engelse tekst.
$ als gewone gebruiker# als root (of met sudo)
Vaardigheden in dit hoofdstuk
- Load balancing instellen en verbindingen controleren
Choose the right load balancer
Pick by layer and by scope.
| Service | Layer | Scope | Use |
|---|---|---|---|
| Azure Load Balancer | 4 (TCP/UDP) | Region | VMs, any TCP/UDP service |
| Application Gateway | 7 (HTTP/S) | Region | Web apps, path routing, TLS end, WAF |
| Front Door | 7 | Global | Global web apps, CDN, WAF |
| Traffic Manager | DNS | Global | Send users to the nearest healthy region |
Build a public load balancer
A Standard load balancer has a frontend IP, a backend pool, a health probe and a rule that joins them.
az network lb create -g rg-web -n lb-web --sku Standard --public-ip-address pip-lb-web --frontend-ip-name fe-web --backend-pool-name be-web
az network lb probe create -g rg-web --lb-name lb-web -n probe-http --protocol Http --port 80 --path /health
az network lb rule create -g rg-web --lb-name lb-web -n rule-http --protocol Tcp --frontend-port 80 --backend-port 80 \
--frontend-ip-name fe-web --backend-pool-name be-web --probe-name probe-http
az network nic ip-config address-pool add -g rg-web --nic-name vm-web1VMNic --ip-config-name ipconfig1 --lb-name lb-web --address-pool be-web
az network lb show -g rg-web -n lb-web --query "frontendIPConfigurations[0].publicIPAddress.id"| Part | Meaning |
|---|---|
| Frontend IP | The address clients use (public or private) |
| Backend pool | The VMs or scale set that do the work |
| Health probe | Checks every VM; a failing VM gets no traffic |
| Load-balancing rule | Frontend port → backend port, with the probe |
| Inbound NAT rule | One frontend port → one VM (for example admin access) |
| Outbound rule | How backend VMs reach the internet |
Onthoud
A Standard load balancer is closed by default. The NSG of the backend must allow the traffic and the probe (service tag AzureLoadBalancer).
Build an internal load balancer
An internal load balancer has a private frontend IP — for the app or database tier.
az network lb create -g rg-web -n lb-app --sku Standard --vnet-name vnet-prod --subnet snet-app \
--private-ip-address 10.20.2.10 --frontend-ip-name fe-app --backend-pool-name be-appTroubleshoot load balancing
Most problems are the probe, the NSG, or the app not listening.
- Is the health probe green? Portal: Load balancer → Insights / Monitoring → Health probe status.
- Does the app answer on the probe port and path on the VM itself?
curl -I http://localhost/health. - Does the NSG allow the client traffic and
AzureLoadBalancer? - Is the VM really in the backend pool (the right NIC and IP configuration)?
Use Network Watcher
Network Watcher has tools that test the path and the rules without guessing.
az network watcher configure -g NetworkWatcherRG -l westeurope --enabled true
az network watcher test-connectivity -g rg-web --source-resource vm-web1 --dest-address 10.20.2.10 --dest-port 5432
az network watcher show-next-hop -g rg-web --vm vm-web1 --source-ip 10.20.1.4 --dest-ip 8.8.8.8
az network watcher test-ip-flow -g rg-web --vm vm-web1 --direction Outbound --protocol TCP --local 10.20.1.4:50000 --remote 10.20.2.5:5432| Tool | Answers |
|---|---|
| IP flow verify | Which NSG rule allows or blocks this packet? |
| Next hop | Where does the route send this packet? |
| Connection troubleshoot | Can A reach B on this port, and where does it fail? |
| Connection monitor | Test a path all the time and alert |
| VNet flow logs | Log all traffic (to storage, analyse with Traffic Analytics) |
| Packet capture | Capture packets on a VM |
Op het werk
Check in this order: DNS → route (next hop) → NSG (IP flow verify) → the service itself.