Should I enable diagnostics on an internal Load Balancer or NSG on the subnet to get info on IP Addresses that connect to an internal Load Balancer ?

Accepted answer

ChaitanyaNaykodi-MSFT 26,216 Reputation points Microsoft Employee

2023-07-22T00:52:01.53+00:00

@Shridhar Srinivasan

Thank you for reaching out.

If I understand correctly, you wish get information on the source IP address of the traffic going through your internal load balancer.

I think going the NSG route will be a better option here as you will be able enable NSG Flow logs. Network security groups flow logging is a feature of Azure Network Watcher that allows you to log information about IP traffic flowing through a network security group. You need to know the current state of the network, who's connecting, and where users are connecting from. You also need to know which ports are open to the internet, what network behavior is expected, what network behavior is irregular, and when sudden rises in traffic happen.

Flow logs are the source of truth for all network activity in your cloud environment. Whether you're in a startup that's trying to optimize resources or a large enterprise that's trying to detect intrusion, flow logs can help. You can use them for optimizing network flows, monitoring throughput, verifying compliance, detecting intrusions, and more.

[Addition]:

Using Azure Load Balancer diagnostics, you cannot get the source IP address of the traffic going through an internal load balancer.

Hope this helps! Please let me know if you have any additional questions. Thank you!

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.

1 person found this answer helpful.
Shridhar Srinivasan 220 Reputation points

2023-07-22T12:49:53.5533333+00:00

Thanks very much @ChaitanyaNaykodi-MSFT for the detailed explanation, very helpful.

For my knowledge though, will I get the "source IP address of the traffic going through an internal load balancer" by enabling diagnostics on a Load Balancer ?

Shridhar Srinivasan 220 Reputation points

2023-07-26T10:49:24.0133333+00:00

Can somebody help answering the above please ?

ChaitanyaNaykodi-MSFT 26,216 Reputation points Microsoft Employee

2023-07-28T03:53:07.4066667+00:00

@Srinivasan, Shridhar (Shridhar)

Apologies for missing on your follow-up question above. The documentation for Azure Load Balancer does not clearly states that source ip of the traffic will be logged and what will be the query. I am testing this scenario and will let you know shortly.

Supported metrics for Load Balancers: https://learn.microsoft.com/en-us/azure/azure-monitor/reference/supported-metrics/microsoft-network-loadbalancers-metrics

Shridhar Srinivasan 220 Reputation points

2023-07-29T05:06:09.26+00:00

Thanks @ChaitanyaNaykodi-MSFT

I am looking forward to your test results.

ChaitanyaNaykodi-MSFT 26,216 Reputation points Microsoft Employee

2023-08-01T23:01:11.8733333+00:00

@Srinivasan, Shridhar (Shridhar)

Thank you for your patience here.

I ran my test and to answer your query here

For my knowledge though, will I get the "source IP address of the traffic going through an internal load balancer" by enabling diagnostics on a Load Balancer ?

No, you cannot get the source IP address of the traffic going through an internal load balancer" by enabling diagnostics on a Load Balancer.

Hope this answers your query. Thank you!

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Shridhar Srinivasan 220 Reputation points

2023-08-03T06:47:21.7266667+00:00

Thank you @ChaitanyaNaykodi-MSFT

This is useful. Can I request you to add this above response also to the answer. That will make it a complete response for anyone to refer.

ChaitanyaNaykodi-MSFT 26,216 Reputation points Microsoft Employee

2023-08-04T18:32:46.49+00:00

Sure! I just updated the answer above.

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Should I enable diagnostics on an internal Load Balancer or NSG on the subnet to get info on IP Addresses that connect to an internal Load Balancer ?

0 additional answers

Your answer