question

JamesTerHark-7497 avatar image
0 Votes"
JamesTerHark-7497 asked ChaitanyaNaykodiMSFT-9638 commented

Azure Load Balancer

I have a DMZ consisting of two vnets, DMZdev 10.203.145.0 and DMZprd 10.202.81.0. In front of these two dmz vnets I have a pair of Cisco FTDs in a 3rd vnet I want to place a load balancer between the dmz and the two FTDs for HA incase one of the FTDs is down. Is this possible within Azure?

Is it possible to load balance between different vnets? It seems like I can only load balance within a single vnet.

Is it possible to have frontend's in different vnets?
Is it possible to have backends in different vnets?

azure-load-balancer
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

ChaitanyaNaykodiMSFT-9638 avatar image
0 Votes"
ChaitanyaNaykodiMSFT-9638 answered ChaitanyaNaykodiMSFT-9638 commented

Hello @JamesTerHark-7497, Thank you for reaching out. As per the limitation for Azure Load Balancer. A load balancer rule cannot span two virtual networks. All load balancer frontends and their backend instances must be in a single virtual network. The backend resources must be in the same virtual network as the load balancer.
This is the recommended architecture for highly available NVA. To implement this architecture you will have to move the FTDs in your respective VNETS and deploy a Standard Internal Load Balancer per VNET.

Depending on your Architecture, traffic type, and requirements you can go through this Decision tree for load balancing in Azure for choosing your load balancing option in Azure.
Hope this helps. Please let me know if you have any additional questions


· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

If the above scenario will not work, then can I do the following. In the attached drawing I have added UDRs to the DMZdev and DMZprd subnets that send the traffic to 0.0.0.0/0 > 10.202.33.86 The Frontend of the load balancer USAZR3-INT-LB-01. The backend on this load balancer is the internal interfaces on the two FTDs 10.202.33.84 & 10.202.33.85.

Will this configuration load balance the traffic going to the (2) FTDs?145055-usazr3-dmz-udr.pdf


0 Votes 0 ·
usazr3-dmz-udr.pdf (155.7 KiB)

Hello @JamesTerHark-7497, I think it should be possible. You can communicate with the Frontend of Load Balancer (USAZR3-INT-LB-01) over Vnet Peering with DMZdev and DMZprd Vnets using a Standard Internal Load Balancer. You can then load balance this traffic received between your FTD's as long as the Load Balancer and the FTD's are in the same Vnet.

Just to clarify from the architecture I had shared above, below is the section what you are trying to implement here. Where we can assume the Dept1 Vnet to be DMZdev and Dept2 Vnet to be DMZprd and Hub Vnet consists the FTD and Load Balancer.

144988-image.png

Just for awareness, if you are planning to use Global Vnet Peering just be aware of this constraint -> If the two virtual networks in two different regions are peered over Global VNet Peering, you cannot connect to resources that are behind a Basic Load Balancer through the Front End IP of the Load Balancer. This restriction does not exist for a Standard Load Balancer.

Hope this helps. Please let me know if you have any additional questions.


Please "Accept the answer" if the information helped you. This will help us and others in the community as well.


0 Votes 0 ·
image.png (158.6 KiB)