Unable to access IIS behind Basic Load Balancer

Question

I have deployed two VMs with IIS installed and put it behind load balancer by following this tutorial https://learn.microsoft.com/en-us/azure/load-balancer/basic/quickstart-basic-public-load-balancer-portal. I kept the configuration the same with the tutorial, even the naming. However, the website is unreachable and I get "took too long to respond" error.

I tried troubleshooting using this forum https://learn.microsoft.com/en-us/answers/questions/483892/unable-to-access-my-web-site-through-load-balance, and still cant find the problem.

• Check the service is running on your VMSS instances i.e port 80 listening or not using "netstat -ano" in command prompt, if it is not listening then you see it fails <br> Status is listening on both VM.
• If it is Linux VM then check listening along with that check if any block on IP tables which blocks port 80 <br> Not applicable. My VMs are Windows.
• LB will not forward traffic to the backend when health probe fails, check if there is NSG on NIC level or Subnet level of the VMSS instances, verify if you have block for Azure Loadbalancer Tag or not, if you have any deny rule then add a rule on NSG to allow source as Azure loadbalancer Tag as incoming.<br> No rule blocking LB.
• Check if any route table associated with the subnet of VMSS instances, if it is taking custom route apart from default route to internet , check the next hope defined if any block on your Virtual appliance/Firewall <br> No RT are assigned on Subnet

Answer 1

Hello @Yasmin, Fitri ,

Apologies for the delay in the response.

I understand that you deployed two VMs with IIS installed and put it behind load balancer by following this tutorial https://learn.microsoft.com/en-us/azure/load-balancer/basic/quickstart-basic-public-load-balancer-portal but you the website is unreachable, and you get "took too long to respond" error.

I followed the portal tutorial and deployed the basic load balancer with 2 VMs with IIS installed keeping the naming convention and configuration exactly the same and it worked for me just fine except one small glitch which is in the enable BastionHost section during the Virtual Network creation as the tutorial asks to use the BastionSubnet with an address space of 10.1.1.0/27, which results in an error saying "the prefix must be smaller than or equal to 26".

As per Bastion FAQ,

Can I have an Azure Bastion subnet of size /27 or smaller (/28, /29, etc.)? For Azure Bastion resources deployed on or after November 2, 2021, the minimum AzureBastionSubnet size is /26 or larger (/25, /24, etc.). All Azure Bastion resources deployed in subnets of size /27 prior to this date are unaffected by this change and will continue to work. However, we highly recommend increasing the size of any existing AzureBastionSubnet to /26 in case you choose to take advantage of host scaling in the future.

So, the address space mentioned for Bastion Host in the tutorial needs to be updated to 10.1.1.0/26. I'll submit a PR for this change.

Apart from this, rest all configuration worked just fine and I was able to browse the load balancer IP and get the IIS site loaded as below:

In the portal tutorial, you need to keep an eye on the NSG configuration of the Virtual machines.

https://learn.microsoft.com/en-us/azure/load-balancer/basic/quickstart-basic-public-load-balancer-portal#create-virtual-machines

You need to select Advanced and create NSG with inbound rule allowing HTTP port 80 in VM1 and then while creating VM2, select Advanced and select the already created NSG.

Hope this helps!

Kindly let us know if the above helps or you need further assistance on this issue.

---

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.