VM Scale Sets Behind Load Balancer Not Reachable

Meissner, Glenn 0

Hello,

So I have a VMSS configured to work with an external facing load balancer. The load balancer has a public IP address and is pingable from the internet. The virtual machine instances behind that is not pingable, however. I attempted to set ports 80 and 443 as inbound rules on the load balancer to see if maybe pinging a machine behind the load balancer wasn't possible, but there was still no connectivity.

I have NSGs on both the virtual network as well as the NIC of the VMSS set to allow all inbound and outbound (which will be fixed once testing is complete). I do not have an inbound NAT set up on the load balancer, and I do not use a floating IP. Any help would be appreciated, thank you.

Ganesh Patapati 735 Reputation points Microsoft Vendor

2024-10-16T16:48:55.84+00:00
Hello Meissner, Glenn,

Greetings!

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

Refer: https://zcusa.951200.xyz/en-us/azure/load-balancer/load-balancer-troubleshoot#problem-no-inbound-connectivity-to-standard-external-load-balancers-elb

I had been doing lab repros. It seems to be functioning. Please review the troubleshooting steps listed below:

Check Load Balancer Logs:

Review the logs for the load balancer to identify any errors or issues related to traffic routing to the VMSS instances.

Test Connectivity:

Use tools like telnet or curl from an external source to test connectivity to the public IP on ports 80 and 443. This can help determine if the load balancer is routing traffic correctly.

Review NSG Rules:

Double-check the NSG rules to ensure that there are no conflicting rules that might be blocking traffic. You can temporarily allow all traffic for testing purposes.

Use Inbound NAT Rules:

If you need to access specific instances directly, consider setting up inbound NAT rules on the load balancer. This allows you to map specific ports on the public IP to ports on the individual VM instances.

Check for Firewall Settings:

If you have any firewall settings configured on the VM instances themselves, ensure that they allow traffic on the required ports.

Conclusion

If you've gone through these checks and are still experiencing issues,

Please provide additional details about your load balancer configuration, NSG settings, and any error messages you may be encountering. This will help in further diagnosing the problem.

Cheers,

Ganesh
Meissner, Glenn 0 Reputation points

2024-10-16T16:55:42.2+00:00

Hello and thank you for the advice. After doing some more troubleshooting this morning it looks like both of the VMSS instances are unhealthy which was causing the external load balancer to reject traffic. When I admin set one instance as up, the load balancer itself did respond to outside pings. The inside machines still did not respond though.
Ganesh Patapati 735 Reputation points Microsoft Vendor

2024-10-17T15:35:36.84+00:00

Hey Meissner, Glenn,

Greetings,

I'm glad to hear that you were able to identify the issue with the VMSS instances being unhealthy. That's a great step forward in troubleshooting!

Now, let's focus on why the internal machines are still not responding to pings. Here are some potential reasons and next steps to consider:

VMs behind the Load Balancer aren't responding to health probes:

Refer: https://zcusa.951200.xyz/en-us/azure/load-balancer/load-balancer-troubleshoot-health-probe-status#symptom-vms-behind-the-load-balancer-arent-responding-to-health-probes

If you're still experiencing issues, please provide more details about your VMSS instance configuration, NSG settings, and any error messages you may be encountering. This will help in further diagnosing the problem better if you provide in a screenshot manner.

We are pleased to help you

Regards,

Ganesh

Share via

VM Scale Sets Behind Load Balancer Not Reachable

Your answer