Edit

Test reachability of Azure Public Load Balancer frontends with ping and traceroute

  • Article

Standard Public Azure Load Balancer frontend IPv4 and IPv6 addresses support testing reachability using ping and traceroute. Testing reachability of a load balancer frontend is useful for troubleshooting inbound connectivity issues to Azure resources. In this article, you learn how to use ping and traceroute for testing a frontend of an existing Standard public load balancer. It can be completed from an Azure Virtual Machine or from a device outside of Azure.

Prerequisites

Note

Testing inbound connectivity to Azure Load Balancer frontends is only supported for public load balancers. Testing inbound connectivity to internal load balancer frontends is not supported.

Testing from a device outside of Azure

This section describes testing reachability of a standard load balancer frontend from a Windows device outside of Azure.

Test the load balancer's frontend

Choose either ping or traceroute to test reachability of a standard load balancer frontend from a device outside of Azure.

Follow these steps to test reachability of a standard public load balancer frontend using ping from a Windows device outside of Azure:

  1. From your Windows device, open the Search taskbar and enter cmd. Select Command Prompt.
  2. In the command prompt, type the following command:
    ping <Input your load balancer public IP address>
  1. Review ping's output.

Testing from an Azure Virtual Machine

This section describes how to test reachability of a standard public load balancer frontend from an Azure Virtual Machine. First, you create an inbound Network Security Group (NSG) rule on the virtual machine to allow ICMP traffic. Then, you test reachability of the frontend of the load balancer from the virtual machine with ping or traceroute.

Configure inbound NSG rule

  1. Sign in to the Azure portal.

  2. In the Search bar at the top of the portal, enter Virtual machines and select Virtual machines.

  3. In Virtual machines, select your virtual machine from the list.

  4. In the virtual machine’s menu, select Networking and then select Add inbound port rule.

    Screenshot of Virtual network page listing port rules and selection of add outbound port rule button.

  5. In Add inbound security rule, enter or select the following information:

    Setting Value
    Source Enter Any
    Source port ranges Enter *
    Destination Enter Any
    Service Ender Custom
    Destination port ranges Enter *
    Protocol Select ICMP
    Action Select Allow
    Priority Enter 100 or a priority of your choosing.
    Name Enter AllowICMP or a name of your choosing
    Description Leave as Blank or enter a description

    Screenshot of Add inbound port rule windows with settings allowing ICMP echo messages.

  6. Select Add.

Connect to the virtual machine

This section describes testing reachability of a standard load balancer frontend from a Windows Virtual Machine on Azure.

  1. Return to Overview in the virtual machine’s menu and select Connect.
  2. Sign in to your virtual machine using RDP, SSH, or Bastion.

Test the load balancer's frontend

Choose either ping or traceroute to test reachability of a standard public load balancer frontend from an Azure Virtual Machine.

Follow these steps to test reachability of a standard public load balancer frontend using ping from a Windows virtual machine:

  1. From your Windows device, open the Search taskbar and enter cmd. Select Command Prompt.
  2. In the command prompt, type the following command:
    ping <Input your load balancer public IP address>
  1. Review ping's output.

Expected replies with ping

Based on the current health probe state of your backend instances, you receive different replies when testing the Load Balancer’s frontend with ping. Review the following scenarios for the expected reply:

Scenario Expected reply
All backend instances are probed DOWN Destination host unreachable 
All backend instances turned OFF Unresponsive: Request timed out
At least 1 backend instance is probed UP Successful echo replies
No backend instances behind Load Balancer/No load balancing rules associated Unresponsive: Request timed out

Usage considerations

  • ICMP pings can't be disabled and are allowed by default on Standard Public Load Balancers.
  • ICMP pings with packet sizes larger than 64 bytes will be dropped, leading to timeouts.
  • Outbound ICMP pings are not supported on a Load Balancer.

Note

ICMP ping requests are not sent to the backend instances; they are handled by the Load Balancer.

Next steps