Lab: Internal Load Balancer health diagnosis

Outcome

Create an internal Standard Load Balancer with two disposable backends, prove access from an in-VNet client, then make its health probe fail and diagnose the exact failed gate.

Do

1. Create a VNet, backend subnet, client subnet, two small backend VMs, and a client VM. Configure a simple HTTP response on each backend and permit the data/probe path in the backend NSG.
2. Create a Standard internal Load Balancer: private frontend, backend pool, HTTP probe, and load-balancing rule. Add both backend NICs, then request the frontend from the client repeatedly and record backend responses.
3. In Metrics, inspect Health Probe Status for the frontend/port. Record that the load balancer uses the configured probe result to decide where new flows go.

Verify

Capture frontend private IP, backend pool, probe protocol/port/path, rule, client response, NSG evidence, and health metric. You should now understand: an internal load balancer exposes a private frontend; a healthy backend must answer the configured probe before it receives new flows.

Break and fix

1. Stop the HTTP listener on one backend or change its probe path to return a non-200 result. Confirm that backend becomes unhealthy while the other can serve new requests; restore the listener/path.
2. Block the probe/data port with a temporary NSG rule. Record the failed health state, inspect the effective rule, remove the deny, and retest.
3. Configure a probe on the wrong port in the disposable lab. Diagnose listener, protocol, port, response code, NSG, and backend-pool membership before correcting the probe.

Scenario practice

1. Configure: Choose an internal versus public frontend for a three-tier application and list the probe/rule/backend prerequisites.
2. Diagnose: The frontend is reachable but reports no healthy backends. Inspect Health Probe Status, listener, HTTP response, NSG, ports, and pool membership in that order.
3. Distinguish: Contrast an Azure Load Balancer health probe with an Application Gateway probe and a VM availability check.

Clean up

Remove the rule, probe, frontend, load balancer, test NSG rules, VMs, VNet, and disposable resource group.

Sources and re-audit

• Load Balancer diagnostics, checked 2026-08-22.
• Troubleshoot health event logs, checked 2026-08-22.

Re-audit when Load Balancer health behavior, metrics, or NSG probe requirements change.

Related

load-balancer · health-probe · nsg · effective-nsg-rules · All labs