AzureLoadBalancer allow all traffic to vnet

Question

I see many nsg allowing a rule for azure LB
AzureLoadBalancer->Any destination->Any port

Does azure LB use a specific service port for probe or is it mandatory to allow all ports to all destinations. I am more interested allowing only icmp and service port for backend severs only.

Another standard default rule which i find annoying is
VirtualNetwork Any icmp

Why to allow icmp within a vnet?

Answer 1

Hi,

Health probes support multiple protocols. The availability of a specific health probe protocol varies by Load Balancer SKU. Additionally, the behavior of the service varies by Load Balancer SKU and by default, every network security group includes the service tag AzureLoadBalancer to permit health probe traffic.

Check some of the FAQs here and ALB Health probe config.

Hope this helps.
JS

==
Please Accept the answer if the information helped you. This will help us and others in the community as well.