4.3AZ-104Intermediate
Est: ~15 mins•Verified: 2026-08

Azure Load Balancer, Application Gateway & Private DNS Zones

Design high-availability network traffic routing using Layer 4 Azure Load Balancer, Layer 7 Azure Application Gateway with SSL termination & URL routing, and configure internal name resolution via Azure Private DNS Zones.

Tags:#Azure#Networking#Load Balancer#Application Gateway#Private DNS#Layer 7#AZ-104
01

Overview

Azure provides dedicated load-balancing services catering to different layers of the OSI model:

  1. Azure Load Balancer (Layer 4 - Transport):
  • High-throughput, ultra-low latency routing for TCP and UDP traffic.
  • Evaluates a 5-tuple hash: Source IP, Source Port, Destination IP, Destination Port, and Protocol.
  • Supports Public (internet-facing) and Internal (private IP) configurations on Standard SKU.
  1. Azure Application Gateway (Layer 7 - Application):
  • Web-traffic load balancer capable of routing decisions based on HTTP/HTTPS attributes (e.g., URL path /images/ vs /api/, host headers).
  • Features: SSL/TLS termination, Cookie-based session affinity, Web Application Firewall (WAF v2), and URL redirection.
  1. Azure Private DNS Zones:
  • Provides internal name resolution within and between VNets without needing custom DNS VMs (privatelink and custom split-brain domains).
  • Supports Auto-registration of VMs deployed within linked VNets.

---

02

When to Use: Load Balancer vs Application Gateway

FeatureAzure Load Balancer (L4)Azure Application Gateway (L7)
OSI LayerLayer 4 (TCP / UDP).Layer 7 (HTTP / HTTPS / HTTP/2).
Routing DecisionsIP address and port (5-tuple / 2-tuple).URL path, host header, cookie session affinity.
SSL/TLS TerminationNo (passes encrypted packets directly to backend).Yes (decrypts SSL at gateway; re-encrypts or routes plain HTTP).
Web Application FirewallNot supported (requires Azure Firewall or NVA).Integrated WAF v2 (OWASP Core Rule Set 3.2+).
Public & Private IPsSupported on Standard SKU.Supported on v2 SKU (frontend can have both public and private IP).

---

03

Prerequisites

Administrator Permissions:

  • Network Contributor on the target resource group and virtual network.
  • Dedicated empty subnet with at least /27 address space for Azure Application Gateway v2 (cannot be shared with VMs).

---

04

Portal Path

TEXT
Azure Portal (https://portal.azure.com)
├── Load balancers > [Your Load Balancer]
│   ├── Frontend IP configuration (Public / Private IP)
│   ├── Backend pools (Add NICs or VMSS instances)
│   ├── Health probes (TCP / HTTP probe on port 80/443)
│   └── Load balancing rules (Bind Frontend + Backend + Probe)
├── Application gateways > [Your App Gateway]
│   ├── Listeners (HTTP 80 / HTTPS 443 with SSL Certificate)
│   ├── Backend pools (VMs, App Services, or FQDNs)
│   └── Routing rules (Path-based routing / images/* to Pool A)
└── Private DNS zones > [e.g. contoso.internal]
    ├── Virtual network links (Link to VNet with Auto-registration enabled)
    └── Recordsets (Add A, CNAME, TXT records)

---

05

Step-by-Step Implementation

Step 1: Deploy a Standard Azure Load Balancer

  1. Navigate to Load balancers > click + Create.
  2. Type: Public or Internal.
  3. SKU: Standard (Zone-redundant).
  4. Configure Frontend IP: Allocate a Standard Public IP address.
  5. In Backend pools: Add the NICs of your web servers.
  6. In Health probes: Name hp-http-80, Protocol TCP, Port 80, Interval 5s, Unhealthy threshold 2.
  7. In Load balancing rules: Name lb-rule-http, Frontend IP, Backend pool, Health probe, Port 80 to Port 80, Session persistence: None or Client IP.

Step 2: Deploy Azure Application Gateway with Path-Based Routing

  1. Create a dedicated subnet: snet-appgw (e.g., 10.0.10.0/24) in your VNet.
  2. Navigate to Application gateways > click + Create.
  3. SKU: Standard v2 or WAF v2.
  4. Configure Frontends: Assign Standard Public IP.
  5. Define Backend pools:
  • pool-default: Main web servers.
  • pool-images: Image storage or media VMs.
  1. Configure Routing Rules:
  • Rule type: Path-based.
  • Path /images/* -> routes to pool-images.
  • Default path /* -> routes to pool-default.

Step 3: Configure Azure Private DNS Zone

  1. Search Private DNS zones > click + Create.
  2. Name: corp.internal
  3. Under Virtual network links, click + Add:
  • Link name: link-vnet-prod
  • Virtual network: Select vnet-production
  • Check Enable auto registration (automatically creates A records for VMs).

---

06

Azure PowerShell & Azure CLI

PowerShell: Deploy Azure Standard Internal Load Balancer

PowerShell
# Connect and set subscription
Connect-AzAccount
Set-AzContext -SubscriptionId "<YOUR-SUBSCRIPTION-ID>"

$rgName = "rg-network-core"
$location = "westeurope"
$vnetName = "vnet-prod"
$subnetName = "snet-backend"

# 1. Retrieve VNet and Subnet
$vnet = Get-AzVirtualNetwork -Name $vnetName -ResourceGroupName $rgName
$subnet = Get-AzVirtualNetworkSubnetConfig -Name $subnetName -VirtualNetwork $vnet

# 2. Configure Frontend IP, Backend Pool, and Health Probe
$frontendIP = New-AzLoadBalancerFrontendIpConfig `
    -Name "ilb-frontend" `
    -PrivateIpAddress "10.0.2.50" `
    -SubnetId $subnet.Id

$backendPool = New-AzLoadBalancerBackendAddressPoolConfig -Name "ilb-backend-pool"
$probe = New-AzLoadBalancerProbeConfig -Name "ilb-tcp-probe" -Protocol "Tcp" -Port 80 -IntervalInSeconds 5 -ProbeCount 2

# 3. Create Load Balancing Rule
$lbRule = New-AzLoadBalancerRuleConfig `
    -Name "ilb-rule-80" `
    -FrontendIpConfiguration $frontendIP `
    -BackendAddressPool $backendPool `
    -Probe $probe `
    -Protocol "Tcp" `
    -FrontendPort 80 `
    -BackendPort 80 `
    -IdleTimeoutInMinutes 15

# 4. Deploy Load Balancer
$ilb = New-AzLoadBalancer `
    -ResourceGroupName $rgName `
    -Name "ilb-internal-app" `
    -Location $location `
    -Sku "Standard" `
    -FrontendIpConfiguration $frontendIP `
    -BackendAddressPool $backendPool `
    -Probe $probe `
    -LoadBalancingRule $lbRule

Write-Host "Internal Load Balancer deployed: $($ilb.Name)" -ForegroundColor Green

---

07

Verification Checklist

VERIFICATION CHECKLIST
0/5 (0%)
Azure Load Balancer distributes requests evenly across backend VMs.
Shutting down one backend VM triggers health probe failure within 10 seconds and stops traffic forwarding.
Application Gateway path /images/logo.png routes exclusively to pool-images.
Private DNS zone automatically creates A records for newly provisioned virtual machines.
NSG on backend subnet allows incoming traffic from Azure Load Balancer health probe service tag (AzureLoadBalancer).
08

Common Pitfalls & Troubleshooting Matrix

IssueRoot CauseResolution
All backend VMs show unhealthy in Load BalancerNSG is blocking the Azure Load Balancer health probe.Allow inbound traffic from Service Tag AzureLoadBalancer on probe port (e.g. 80).
Application Gateway subnet deployment errorSubnet contains existing NICs or has a subnet size smaller than /27.Application Gateway requires a dedicated, empty subnet of minimum /27 CIDR.
Private DNS name not resolving from peered VNetThe Private DNS Zone is only linked to the primary VNet.Add a Virtual Network Link for each peered VNet needing name resolution.
Session drops during shopping cart checkoutLoad Balancer default distribution is 5-tuple (no affinity).Change session persistence to Client IP (2-tuple) or use Application Gateway cookie affinity.

---

09

Real-World Architecture / Flow

Interactive Topology & Workflow
Internet Client (HTTPS 443)client
Stage 1
Flow & Verification Handshake
Backend Pool Acompute

App VMs ] [ Backend Pool B - Storage / Blob

Stage 2

---

10

Audit & Monitoring

  • Enable Application Gateway Access Logs (ApplicationGatewayAccessLog) and Performance Logs.
  • Monitor Load Balancer Health Probe Status:
  • Metric: DipAvailability (Data Path Availability) - alert when < 100%.

---

11

Rollback & Emergency Recovery

  • Bypass Failed Backend Instance:
  • Remove the unhealthy NIC from the Load Balancer backend pool to isolate the server for forensics.
  • Failover DNS Resolution:
  • Update Azure Private DNS Zone A record pointing to secondary disaster recovery IP endpoint.

---

12

Official Documentation Reference

---

13

Exam Blueprint & Pro Tips (AZ-104)

Exam Blueprint & High-Yield Traps

AZ-104 High-Yield Rules:

  1. Dedicated Subnet: Azure Application Gateway requires a dedicated subnet with no other resources. Minimum subnet size is /27 (/26 or /24 recommended).
  2. AzureLoadBalancer Service Tag: Health probes originate from virtual IP 168.63.129.16. Never block this IP or the AzureLoadBalancer service tag in NSGs.
  3. L4 vs L7 Decision: If question mentions "SSL termination", "URL path routing", or "cookie affinity", the answer is Application Gateway. If it mentions "UDP", "high-throughput port forwarding", or "non-HTTP protocols", the answer is Azure Load Balancer.
  4. Private DNS Auto-Registration: A Private DNS zone supports auto-registration on up to 100 linked VNets, but an individual VNet can only be linked for auto-registration to one private zone.
PREVIOUS TOPIC4.2 Network Security Groups (NSG) & Application Security Groups (ASG)NEXT TOPIC5.1 Azure Monitor: Log Analytics & KQL Queries