Quickstart: Create a public load balancer to load balance VMs using Azure CLI

Get started with Azure Load Balancer by using Azure CLI to create a public load balancer and three virtual machines.

Prerequisites

Use Azure Cloud Shell

Azure hosts Azure Cloud Shell, an interactive shell environment that you can use through your browser. You can use either Bash or PowerShell with Cloud Shell to work with Azure services. You can use the Cloud Shell preinstalled commands to run the code in this article without having to install anything on your local environment.

To start Azure Cloud Shell:

Option Example/Link
Select Try It in the upper-right corner of a code block. Selecting Try It doesn't automatically copy the code to Cloud Shell. Example of Try It for Azure Cloud Shell
Go to https://shell.azure.com, or select the Launch Cloud Shell button to open Cloud Shell in your browser. Launch Cloud Shell in a new window
Select the Cloud Shell button on the menu bar at the upper right in the Azure portal. Cloud Shell button in the Azure portal

To run the code in this article in Azure Cloud Shell:

  1. Start Cloud Shell.

  2. Select the Copy button on a code block to copy the code.

  3. Paste the code into the Cloud Shell session by selecting Ctrl+Shift+V on Windows and Linux or by selecting Cmd+Shift+V on macOS.

  4. Select Enter to run the code.

If you choose to install and use the CLI locally, this quickstart requires Azure CLI version 2.0.28 or later. To find the version, run az --version. If you need to install or upgrade, see Install the Azure CLI.

Create a resource group

An Azure resource group is a logical container into which Azure resources are deployed and managed.

Create a resource group with az group create:

  • Named myResourceGroupLB.
  • In the eastus location.
  az group create \
    --name myResourceGroupLB \
    --location eastus

Note

Standard SKU load balancer is recommended for production workloads. For more information about skus, see Azure Load Balancer SKUs.

Configure virtual network

Before you deploy VMs and test your load balancer, create the supporting virtual network resources.

Create a virtual network

Create a virtual network using az network vnet create:

  • Named myVNet.
  • Address prefix of 10.1.0.0/16.
  • Subnet named myBackendSubnet.
  • Subnet prefix of 10.1.0.0/24.
  • In the myResourceGroupLB resource group.
  • Location of eastus.
  az network vnet create \
    --resource-group myResourceGroupLB \
    --location eastus \
    --name myVNet \
    --address-prefixes 10.1.0.0/16 \
    --subnet-name myBackendSubnet \
    --subnet-prefixes 10.1.0.0/24

Create a network security group

For a standard load balancer, the VMs in the backend address for are required to have network interfaces that belong to a network security group.

Create a network security group using az network nsg create:

  • Named myNSG.
  • In resource group myResourceGroupLB.
  az network nsg create \
    --resource-group myResourceGroupLB \
    --name myNSG

Create a network security group rule

Create a network security group rule using az network nsg rule create:

  • Named myNSGRuleHTTP.
  • In the network security group you created in the previous step, myNSG.
  • In resource group myResourceGroupLB.
  • Protocol (*).
  • Direction Inbound.
  • Source (*).
  • Destination (*).
  • Destination port Port 80.
  • Access Allow.
  • Priority 200.
  az network nsg rule create \
    --resource-group myResourceGroupLB \
    --nsg-name myNSG \
    --name myNSGRuleHTTP \
    --protocol '*' \
    --direction inbound \
    --source-address-prefix '*' \
    --source-port-range '*' \
    --destination-address-prefix '*' \
    --destination-port-range 80 \
    --access allow \
    --priority 200

Create network interfaces for the virtual machines

Create three network interfaces with az network nic create:

VM1

  • Named myNicVM1.
  • In resource group myResourceGroupLB.
  • In virtual network myVNet.
  • In subnet myBackendSubnet.
  • In network security group myNSG.

  az network nic create \
    --resource-group myResourceGroupLB \
    --name myNicVM1 \
    --vnet-name myVNet \
    --subnet myBackEndSubnet \
    --network-security-group myNSG

VM2

  • Named myNicVM2.
  • In resource group myResourceGroupLB.
  • In virtual network myVNet.
  • In subnet myBackendSubnet.
  az network nic create \
    --resource-group myResourceGroupLB \
    --name myNicVM2 \
    --vnet-name myVnet \
    --subnet myBackEndSubnet \
    --network-security-group myNSG

VM3

  • Named myNicVM3.
  • In resource group myResourceGroupLB.
  • In virtual network myVNet.
  • In subnet myBackendSubnet.
  • In network security group myNSG.
  az network nic create \
    --resource-group myResourceGroupLB \
    --name myNicVM3 \
    --vnet-name myVnet \
    --subnet myBackEndSubnet \
    --network-security-group myNSG

Create backend servers

In this section, you create:

  • A cloud configuration file named cloud-init.txt for the server configuration.
  • Three virtual machines to be used as backend servers for the load balancer.

Create cloud-init configuration file

Use a cloud-init configuration file to install NGINX and run a 'Hello World' Node.js app on a Linux virtual machine.

In your current shell, create a file named cloud-init.txt. Copy and paste the following configuration into the shell. Ensure that you copy the whole cloud-init file correctly, especially the first line:

#cloud-config
package_upgrade: true
packages:
  - nginx
  - nodejs
  - npm
write_files:
  - owner: www-data:www-data
  - path: /etc/nginx/sites-available/default
    content: |
      server {
        listen 80;
        location / {
          proxy_pass http://localhost:3000;
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection keep-alive;
          proxy_set_header Host $host;
          proxy_cache_bypass $http_upgrade;
        }
      }
  - owner: azureuser:azureuser
  - path: /home/azureuser/myapp/index.js
    content: |
      var express = require('express')
      var app = express()
      var os = require('os');
      app.get('/', function (req, res) {
        res.send('Hello World from host ' + os.hostname() + '!')
      })
      app.listen(3000, function () {
        console.log('Hello world app listening on port 3000!')
      })
runcmd:
  - service nginx restart
  - cd "/home/azureuser/myapp"
  - npm init
  - npm install express -y
  - nodejs index.js

Create virtual machines

Create the virtual machines with az vm create:

VM1

  • Named myVM1.
  • In resource group myResourceGroupLB.
  • Attached to network interface myNicVM1.
  • Virtual machine image UbuntuLTS.
  • Configuration file cloud-init.txt you created in step above.
  • In Zone 1.
  az vm create \
    --resource-group myResourceGroupLB \
    --name myVM1 \
    --nics myNicVM1 \
    --image UbuntuLTS \
    --generate-ssh-keys \
    --custom-data cloud-init.txt \
    --zone 1 \
    --no-wait
    

VM2

  • Named myVM2.
  • In resource group myResourceGroupLB.
  • Attached to network interface myNicVM2.
  • Virtual machine image UbuntuLTS.
  • Configuration file cloud-init.txt you created in step above.
  • In Zone 2.
  az vm create \
    --resource-group myResourceGroupLB \
    --name myVM2 \
    --nics myNicVM2 \
    --image UbuntuLTS \
    --generate-ssh-keys \
    --custom-data cloud-init.txt \
    --zone 2 \
    --no-wait

VM3

  • Named myVM3.
  • In resource group myResourceGroupLB.
  • Attached to network interface myNicVM3.
  • Virtual machine image UbuntuLTS.
  • Configuration file cloud-init.txt you created in step above.
  • In Zone 3.
   az vm create \
    --resource-group myResourceGroupLB \
    --name myVM3 \
    --nics myNicVM3 \
    --image UbuntuLTS \
    --generate-ssh-keys \
    --custom-data cloud-init.txt \
    --zone 3 \
    --no-wait

It may take a few minutes for the VMs to deploy.

Create a public IP address

To access your web app on the Internet, you need a public IP address for the load balancer.

Use az network public-ip create to:

  • Create a standard zone redundant public IP address named myPublicIP.
  • In myResourceGroupLB.
  az network public-ip create \
    --resource-group myResourceGroupLB \
    --name myPublicIP \
    --sku Standard

To create a zonal redundant public IP address in Zone 1:

  az network public-ip create \
    --resource-group myResourceGroupLB \
    --name myPublicIP \
    --sku Standard \
    --zone 1

Create standard load balancer

This section details how you can create and configure the following components of the load balancer:

  • A frontend IP pool that receives the incoming network traffic on the load balancer.
  • A backend IP pool where the frontend pool sends the load balanced network traffic.
  • A health probe that determines health of the backend VM instances.
  • A load balancer rule that defines how traffic is distributed to the VMs.

Create the load balancer resource

Create a public load balancer with az network lb create:

  • Named myLoadBalancer.
  • A frontend pool named myFrontEnd.
  • A backend pool named myBackEndPool.
  • Associated with the public IP address myPublicIP that you created in the preceding step.
  az network lb create \
    --resource-group myResourceGroupLB \
    --name myLoadBalancer \
    --sku Standard \
    --public-ip-address myPublicIP \
    --frontend-ip-name myFrontEnd \
    --backend-pool-name myBackEndPool       

Create the health probe

A health probe checks all virtual machine instances to ensure they can send network traffic.

A virtual machine with a failed probe check is removed from the load balancer. The virtual machine is added back into the load balancer when the failure is resolved.

Create a health probe with az network lb probe create:

  • Monitors the health of the virtual machines.
  • Named myHealthProbe.
  • Protocol TCP.
  • Monitoring Port 80.
  az network lb probe create \
    --resource-group myResourceGroupLB \
    --lb-name myLoadBalancer \
    --name myHealthProbe \
    --protocol tcp \
    --port 80   

Create the load balancer rule

A load balancer rule defines:

  • Frontend IP configuration for the incoming traffic.
  • The backend IP pool to receive the traffic.
  • The required source and destination port.

Create a load balancer rule with az network lb rule create:

  • Named myHTTPRule
  • Listening on Port 80 in the frontend pool myFrontEnd.
  • Sending load-balanced network traffic to the backend address pool myBackEndPool using Port 80.
  • Using health probe myHealthProbe.
  • Protocol TCP.
  • Enable outbound source network address translation (SNAT) using the frontend IP address.
  az network lb rule create \
    --resource-group myResourceGroupLB \
    --lb-name myLoadBalancer \
    --name myHTTPRule \
    --protocol tcp \
    --frontend-port 80 \
    --backend-port 80 \
    --frontend-ip-name myFrontEnd \
    --backend-pool-name myBackEndPool \
    --probe-name myHealthProbe \
    --disable-outbound-snat true 

Add virtual machines to load balancer backend pool

Add the virtual machines to the backend pool with az network nic ip-config address-pool add:

VM1

  • In backend address pool myBackEndPool.
  • In resource group myResourceGroupLB.
  • Associated with network interface myNicVM1 and ipconfig1.
  • Associated with load balancer myLoadBalancer.
  az network nic ip-config address-pool add \
   --address-pool myBackendPool \
   --ip-config-name ipconfig1 \
   --nic-name myNicVM1 \
   --resource-group myResourceGroupLB \
   --lb-name myLoadBalancer

VM2

  • In backend address pool myBackEndPool.
  • In resource group myResourceGroupLB.
  • Associated with network interface myNicVM2 and ipconfig1.
  • Associated with load balancer myLoadBalancer.
  az network nic ip-config address-pool add \
   --address-pool myBackendPool \
   --ip-config-name ipconfig1 \
   --nic-name myNicVM2 \
   --resource-group myResourceGroupLB \
   --lb-name myLoadBalancer

VM3

  • In backend address pool myBackEndPool.
  • In resource group myResourceGroupLB.
  • Associated with network interface myNicVM3 and ipconfig1.
  • Associated with load balancer myLoadBalancer.
  az network nic ip-config address-pool add \
   --address-pool myBackendPool \
   --ip-config-name ipconfig1 \
   --nic-name myNicVM3 \
   --resource-group myResourceGroupLB \
   --lb-name myLoadBalancer

Create outbound rule configuration

Load balancer outbound rules configure outbound SNAT for VMs in the backend pool.

For more information on outbound connections, see Outbound connections in Azure.

Create outbound public IP address or public IP prefix.

Use az network public-ip create to create a single IP for the outbound connectivity.

Use az network public-ip prefix create to create a public IP prefix for the outbound connectivity.

For more information on scaling outbound NAT and outbound connectivity, see Scale outbound NAT with multiple IP addresses.

Public IP

  • Named myPublicIPOutbound.
  • In myResourceGroupLB.
  az network public-ip create \
    --resource-group myResourceGroupLB \
    --name myPublicIPOutbound \
    --sku Standard

To create a zonal redundant public IP address in Zone 1:

  az network public-ip create \
    --resource-group myResourceGroupLB \
    --name myPublicIPOutbound \
    --sku Standard \
    --zone 1

Public IP prefix

  • Named myPublicIPPrefixOutbound.
  • In myResourceGroupLB.
  • Prefix length of 28.
  az network public-ip prefix create \
    --resource-group myResourceGroupLB \
    --name myPublicIPPrefixOutbound \
    --length 28

To create a zonal redundant public IP prefix in Zone 1:

  az network public-ip prefix create \
    --resource-group myResourceGroupLB \
    --name myPublicIPPrefixOutbound \
    --length 28 \
    --zone 1

Create outbound frontend IP configuration

Create a new frontend IP configuration with az network lb frontend-ip create :

Select the public IP or public IP prefix commands based on decision in previous step.

Public IP

  • Named myFrontEndOutbound.
  • In resource group myResourceGroupLB.
  • Associated with public IP address myPublicIPOutbound.
  • Associated with load balancer myLoadBalancer.
  az network lb frontend-ip create \
    --resource-group myResourceGroupLB \
    --name myFrontEndOutbound \
    --lb-name myLoadBalancer \
    --public-ip-address myPublicIPOutbound 

Public IP prefix

  • Named myFrontEndOutbound.
  • In resource group myResourceGroupLB.
  • Associated with public IP prefix myPublicIPPrefixOutbound.
  • Associated with load balancer myLoadBalancer.
  az network lb frontend-ip create \
    --resource-group myResourceGroupLB \
    --name myFrontEndOutbound \
    --lb-name myLoadBalancer \
    --public-ip-prefix myPublicIPPrefixOutbound 

Create outbound pool

Create a new outbound pool with az network lb address-pool create:

  • Named myBackEndPoolOutbound.
  • In resource group myResourceGroupLB.
  • Associated with load balancer myLoadBalancer.
  az network lb address-pool create \
    --resource-group myResourceGroupLB \
    --lb-name myLoadBalancer \
    --name myBackendPoolOutbound

Create outbound rule

Create a new outbound rule for the outbound backend pool with az network lb outbound-rule create:

  • Named myOutboundRule.
  • In resource group myResourceGroupLB.
  • Associated with load balancer myLoadBalancer
  • Associated with frontend myFrontEndOutbound.
  • Protocol All.
  • Idle timeout of 15.
  • 10000 outbound ports.
  • Associated with backend pool myBackEndPoolOutbound.
  az network lb outbound-rule create \
    --resource-group myResourceGroupLB \
    --lb-name myLoadBalancer \
    --name myOutboundRule \
    --frontend-ip-configs myFrontEndOutbound \
    --protocol All \
    --idle-timeout 15 \
    --outbound-ports 10000 \
    --address-pool myBackEndPoolOutbound

Add virtual machines to outbound pool

Add the virtual machines to the outbound pool with az network nic ip-config address-pool add:

VM1

  • In backend address pool myBackEndPoolOutbound.
  • In resource group myResourceGroupLB.
  • Associated with network interface myNicVM1 and ipconfig1.
  • Associated with load balancer myLoadBalancer.
  az network nic ip-config address-pool add \
   --address-pool myBackendPoolOutbound \
   --ip-config-name ipconfig1 \
   --nic-name myNicVM1 \
   --resource-group myResourceGroupLB \
   --lb-name myLoadBalancer

VM2

  • In backend address pool myBackEndPoolOutbound.
  • In resource group myResourceGroupLB.
  • Associated with network interface myNicVM2 and ipconfig1.
  • Associated with load balancer myLoadBalancer.
  az network nic ip-config address-pool add \
   --address-pool myBackendPoolOutbound \
   --ip-config-name ipconfig1 \
   --nic-name myNicVM2 \
   --resource-group myResourceGroupLB \
   --lb-name myLoadBalancer

VM3

  • In backend address pool myBackEndPoolOutbound.
  • In resource group myResourceGroupLB.
  • Associated with network interface myNicVM3 and ipconfig1.
  • Associated with load balancer myLoadBalancer.
  az network nic ip-config address-pool add \
   --address-pool myBackendPoolOutbound \
   --ip-config-name ipconfig1 \
   --nic-name myNicVM3 \
   --resource-group myResourceGroupLB \
   --lb-name myLoadBalancer

Test the load balancer

To get the public IP address of the load balancer, use az network public-ip show.

Copy the public IP address, and then paste it into the address bar of your browser.

  az network public-ip show \
    --resource-group myResourceGroupLB \
    --name myPublicIP \
    --query [ipAddress] \
    --output tsv

Test the load balancer

Clean up resources

When no longer needed, use the az group delete command to remove the resource group, load balancer, and all related resources.

  az group delete \
    --name myResourceGroupLB

Next steps

In this quickstart

  • You created a standard or public load balancer
  • Attached virtual machines.
  • Configured the load balancer traffic rule and health probe.
  • Tested the load balancer.

To learn more about Azure Load Balancer, continue to..