Skip to main content
Administering network traffic in Azure is essential for building resilient, secure, and highly available applications. This lesson covers the core Azure networking services you need to design and operate production-ready workloads:
  • Configure Azure Load Balancer (Layer 4)
  • Configure Azure Application Gateway (Layer 7)
  • Monitor and diagnose networks with Network Watcher
These topics will show you how to distribute traffic, secure web applications, and troubleshoot network behavior across your Azure subscription.
Before you begin, confirm you have an active Azure subscription, a resource group, and at least one virtual network and virtual machine for testing. Also make sure the Azure CLI is installed and you’re logged in (az login).

​
Why this matters

  • Load balancing ensures service availability and scale by distributing traffic across healthy backend instances.
  • Application Gateway provides application-aware routing, SSL termination, WAF protection, and path/host-based routing for web workloads.
  • Network Watcher lets you validate connectivity, inspect security rules, and capture packets for deep troubleshooting.
Quick links:

​
Configure Azure Load Balancer (Layer 4)

Azure Load Balancer is a transport-layer (Layer 4) service that distributes incoming IP traffic across backend resources (VMs, VM scale sets, or IP addresses) to provide high availability and resilience. Key concepts and components:
  • Frontend IP configuration — public or private IP that receives incoming traffic.
  • Backend pool — collection of backend endpoints (VMs, scale sets, or IPs).
  • Health probes — determine backend instance health so only healthy instances receive traffic.
  • Load-balancing rules — map frontend IP/port to backend pool and backend port.
  • Inbound NAT rules — provide direct access to specific backend instances (useful for management SSH/RDP).
  • Session persistence (client IP affinity) — optionally route a client to the same backend instance for session stickiness.
Table — Load Balancer components at a glance Example CLI — create a basic Standard Load Balancer with frontend and backend pool:
Tips:
  • Use Standard SKU for production workloads (supports availability zones, more features, and secure by default).
  • Configure health probes matching the protocol and port your service exposes.

​
Configure Azure Application Gateway (Layer 7)

Azure Application Gateway operates at the application layer (Layer 7) and is designed for HTTP/HTTPS workloads. It supports advanced routing, SSL termination, host- and path-based routing, and optional Web Application Firewall (WAF) protection. Primary components:
  • Listener — receives incoming HTTP/HTTPS requests on a specific frontend IP and port.
  • Rules — route requests from a listener to backend pools.
  • Backend pools — application servers or endpoints that serve web traffic.
  • HTTP settings — define how the gateway forwards requests to backend servers (timeouts, protocol, cookie-based affinity).
  • URL-based and multi-site routing — route different hostnames or paths to distinct backends.
  • SSL termination / end-to-end SSL — terminate TLS at the gateway or pass it through to backends.
  • Web Application Firewall (WAF) — protects against common web vulnerabilities (OWASP rules).
Table — Application Gateway features Example CLI — create a Standard_v2 Application Gateway with cookie-based affinity enabled:
Best practices:
  • Use Standard_v2 or WAF_v2 SKUs for production (autoscaling, zone redundancy).
  • Centralize TLS certificates in Application Gateway for simplified certificate lifecycle.
  • Combine Application Gateway with Azure Front Door for global routing and CDN capabilities when necessary.

​
Network Watcher — Monitor and Diagnose Network Issues

Network Watcher provides tools to monitor, troubleshoot, and diagnose network problems in Azure. Enable Network Watcher in the region you operate to access its features. Key capabilities:
  • Connection troubleshoot — run TCP/ICMP checks to validate connectivity between endpoints.
  • IP flow verify — check whether traffic is allowed or denied by Network Security Groups (NSGs).
  • Security group view & NSG diagnostics — inspect applied NSG rules and their effect.
  • Packet capture — record traffic flows to analyze packets for debugging or forensics.
  • Topology — visualize network resources and their connections.
  • Flow logs — capture NSG allowed/denied flows for analytics and auditing.
Enable Network Watcher for a region (example CLI):
Quick troubleshooting steps using Network Watcher:
  1. Use Connection troubleshoot to validate reachability between two endpoints.
  2. Run IP flow verify to confirm whether a security rule is blocking traffic.
  3. Use packet capture to collect traffic samples for deeper inspection.
  4. Visualize topology to identify misconfigured network routes or peering issues.

​
Quick CLI Reference

​
Next Steps

  • Implement a sample backend pool of web VMs and test both Azure Load Balancer (for TCP services) and Application Gateway (for HTTP/HTTPS).
  • Enable Network Watcher in your region and run a few diagnostics: connection troubleshoot and IP flow verify.
  • Review the linked Microsoft documentation to explore advanced options: WAF tuning, autoscaling, and NSG flow logs.
With these fundamentals — L4 load balancing, L7 application routing and security, and network diagnostics — you’re ready to design, secure, and operate scalable network architectures in Azure. With that, we’ll begin.

Watch Video