Does Azure Load balancer supports the FTPS (All TCP ports) traffic?

Question

Azure load balancer has any limitations for FTPS traffic?

Answer 1

Hello @Prasuna Tanneru ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you would like to know if Azure Load balancer supports the FTPS (All TCP ports) traffic.

You can use Azure load balancer to load balance FTP/FTPS traffic, but you need to consider the below points:

• Active FTP is not supported.
• There is no way to add a port range in load balancing rules. You need to create rules for each of the ports in Load balancer individually. For example, if you configure port 65520 to 65530 in Passive mode, then you need to create rules for those ports in Load balancer so that it forwards the traffic to the backend server.
• The maximum number of load balancing rules that you can add in an Azure load balancer including inbound NAT rules is 1500.

Refer: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits#load-balancer

Azure Load Balancer operates on layer 4 which supports any TCP/UDP application scenario and doesn't close or originate flows. Protocol handshakes always occur directly between the client and the back-end pool instance. Because the load balancer doesn't interact with the TCP payload nor does it provide TLS offload, you can build comprehensive encrypted scenarios.

An Azure Load Balancer health probe is a feature that detects the health status of your application instances. It sends a request to the instances to check if they are available and responding to requests. The health probe can be configured to use different protocols such as TCP, HTTP, or HTTPS.

Refer: https://learn.microsoft.com/en-us/azure/load-balancer/concepts

https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-custom-probe-overview

You can create an FTP server using IIS and forward FTP traffic in Azure through a load balancer.

Refer: https://learn.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/site/ftpserver/security/ssl

More references for you:

https://learn.microsoft.com/en-us/answers/questions/103061/passive-ftp-need-port-range-in-load-balancer-rule

https://learn.microsoft.com/en-us/answers/questions/1191324/i-have-created-a-standard-(external)-load-balancer

Alternatively, you can consider Azure Firewall which supports both Active and Passive FTP scenarios.

Refer: https://learn.microsoft.com/en-us/azure/firewall/ftp-support

Kindly let us know if the above helps or you need further assistance on this issue.

---

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

If you are planning to use Internal load balancer, then you can configure HA where you create a rule with 0-0 which means all ports are allowed. That can support FTPs