Azure Load Balancing Services & Firewall. Step-by-Step guide

Azure firewall, a cloud-native security service, protects north-south and east-west traffic with filtering and real-time threat intelligence, and it covers basic, standard, and premium SKUs with budget alerts.

Learn to deploy and configure an Azure firewall to control outbound traffic using IP groups, via an ARM template, with VNet subnets and application rule collections.

Deploy an Azure Firewall with two public IPs to route inbound traffic to two private VMs via IP translation, and configure application rules (google allowed, bing blocked) with CIDR-based sources.

Deploy and configure Azure firewall to govern outbound VM traffic, create DNAT, network, and application rules, and route the default subnet through the firewall for controlled internet access.

Deploy Azure Firewall in a hybrid network that links on prem data centers to Azure workloads via a hub and spoke VNet, using VNet peering, gateways, and route rules.

Configure an Azure firewall in a vnet and use a destination network address translation rule to filter inbound traffic, enabling rdp to a private vm.

Set up azure firewall with ddos protection in a two-subnet vnet, configure a firewall policy with application and nat rules, and test rdp and web access.

Learn to integrate Azure Firewall with NAT gateway to provide outbound internet access for private subnets, using VNet hub and spoke, route tables, and firewall policies.

Deploy Azure Firewall in premium tier and enable TLS inspection using a certificate from Azure Key Vault with a managed identity, routing traffic via a workload subnet and route table.

Deploy Azure firewall to protect a storage account and container, enable sftp via a private endpoint, configure nat rules for port 22, and verify connectivity.

Learn how to integrate Azure Firewall with both public and internal load balancers, avoid asymmetric routing, and use NAT rules and route updates to allow secure RDP access to VMs.

Implement Azure firewall with application rules to protect SQL endpoints, create a VNet with workload subnets, and deploy a private endpoint to verify connectivity.

Deploy Azure Firewall to protect an AKS cluster using a VNet with separate subnets, configuring network and application rules, DNS proxy, and routing to prevent asymmetric traffic.

Learn to back up Azure Firewall and firewall policy using Logic Apps, deploying a template to a storage blob, configuring API connections and permissions.

Explore public IP configuration for Azure Firewall and compare NAT gateway scaling to maximize SNAT ports, including how multiple public IPs boost outbound capacity.

Firewall Manager provides a consolidated view of firewall configurations for virtual networks, virtual hubs, and application delivery platforms, including DDoS protection and WAF policies across Azure Firewall and application gateway.

Monitor Azure firewall health state and rule hit counts to detect anomalies in application and network rules. Observe latency and SNAT port utilization, and configure diagnostic settings for Log Analytics.

Create and manage Azure firewall policies from the portal, build parent and child policy relationships, and customize nat, network, and application rule collection groups to control inbound and outbound traffic.

Explore firewall policy analytics in Azure to analyze rule usage and hits in the policy analytics dashboard, while creating sample rules, dnat and rdp rules.

Configure Azure firewall DNS settings, enable DNS proxy, and choose between Azure default DNS or custom DNS in VNets, including FQDNs and policy inheritance implications.

Enable threat intelligence in an Azure firewall policy, selecting disable, alert, or alert and deny, with whitelisting of ips or fqdns. It takes effect before nat, network, and application rules.

Explore rule processing logic in Azure firewall policy, detailing how rule types (D Nat, network, application) and priorities determine the execution order, with iterations and inbound/outbound implications.

Compare Azure firewall tiers—basic, standard, premium—and choose based on advanced threat protection, TLS termination, DNS features, web category filtration, and scalable throughput to meet workload demands.

Explore how FQDN tags and service tags simplify Azure Firewall policy rules, enabling Windows updates across Azure and on-premises environments while Microsoft manages the tags.

Explore deploying and managing Azure application gateway, configuring routing and redirection, ssl termination and end-to-end encryption, and implementing monitoring, autoscaling, vnet setup, and web application firewall.

Explain how Azure Application Gateway serves as a layer seven load balancer that routes http traffic by request attributes, with standard and WAF versions, for high availability and multi-region scenarios.

Explore how the Azure application gateway listens for requests, routes to backend pools with routing rules, uses http or https, and leverages a web application firewall.

Follow along to learn how to provision and delete Azure resources and application gateway scenarios, while budgeting costs and understanding regional pricing.

Explore application gateway routing configurations, including multiple site hosting, path-based routing, and redirection to internal or external sites, url rewriting, and internal load balancing with auto scaling and zone redundancy.

Create an Azure application gateway in Australia East with a dedicated subnet and public IP, add two VMs in a backend pool, install IIS, and test routing.

Configure an Azure application gateway to host multiple sites with two backend pools (Contoso and Fabrikam), multi-site listeners, and host-based routing to Contoso.com and Fabrikam.com.

Learn to configure url-based routing with an application gateway at layer seven, directing traffic to general, images, and video backend pools via path-based rules.

Explore traffic redirection with an Azure application gateway, configuring multi-site routing, internal and external redirects, and http to https redirection using a self-signed certificate.

Explore using an application gateway as an internal load balancer by leveraging its private IP to distribute traffic across multiple virtual machines, while also supporting a separate public IP.

Discover how rewriting sets in the application gateway secure backends by rewriting URLs and headers, and configure rules with diagnostic settings and log analytics to verify changes.

Learn how autoscaling and zone redundancy protect an application gateway by configuring minimum and maximum instances, deploying across availability zones, and avoiding downtime for production workloads.

Explore application gateway security by implementing SSL termination for the application gateway. Learn how to enable end-to-end SSL encryption, implement mutual authentication, and configure the right SSL policies.

Learn how ssl termination at the application gateway decrypts https traffic, forwards unencrypted http to backend targets, and improves performance, resource utilization, visibility, and certificate management.

Learn how to enable end-to-end ssl encryption through the application gateway by decrypting requests for routing and re-encrypting them to back-end targets with https settings and backend certificates.

Learn how to implement mutual authentication between a client and an application gateway using SSL profiles, predefined or custom SSL policies, and certificate management with Azure Key Vault.

Learn how AKS integrates with the Azure application gateway, deploying a greenfield setup or reconfiguring an existing gateway to route traffic to an AKS cluster via the ingress controller.

Explore greenfield ingress controller add-on for AKS, enabling application gateway routing from a new AKS cluster to a test sample app.

Deploy a brownfield AKS cluster and an existing application gateway, enable the application gateway ingress controller, and establish VNet peering to connect them, overcoming address space overlaps.

Implement a web application firewall policy for an application gateway, using WAF version 2 in Australia East with detection mode, and link it to the gateway and its HTTP listener.

Monitor your application gateway by configuring diagnostic settings, tracking metrics, and setting alert rules, then use the log analytics workspace and health probes to assess back end health and routings.

Configure diagnostic settings for the application gateway by selecting access, performance, and firewall logs, and send all logs and metrics to a log analytics workspace.

Explore application gateway metrics and insights, including latency, capacity units, connections, throughput, backend health, 500 errors, and how to diagnose performance bottlenecks for Azure load balancing.

Configure alerts in the application gateway to detect failed requests (500s) using static or dynamic thresholds and all current and future values, with action groups for notifications.

Review log analytics in the application gateway by examining diagnostic settings, logs (access, performance, firewall), and metrics in the log analytics workspace; explore predefined queries and retention options.

Azure application gateway monitors back-end health using default and custom health probes, testing back-end targets every 30 seconds and routing traffic away from unhealthy servers.

Explore advanced topics for the application gateway, configuring it to handle high traffic while using cookie affinity and connection draining, and compare pricing models and tiers.

Learn to enable auto scaling for the Azure application gateway, set min and max instances, and monitor compute units and capacity utilization with alerts for unhealthy targets and error rates.

Learn how Azure application gateway pricing works, with fixed costs, capacity unit costs, and hourly billing, plus outbound data transfer charges and tier differences.

Enable cookie affinity in the application gateway's http settings to keep sessions on the same backend server, with optional external caches like Redis or Cosmos DB for availability.

Learn how connection draining helps the application gateway gracefully remove backend pool targets during planned updates without terminating existing connections. Cookie-based affinity allows traffic to de-registered instances to continue.

Implement custom error pages for application gateways to brand 502 and 403 responses, improving user experience; configure listener-based pages and use Azure PowerShell for global options when needed.

enable websocket communication through the application gateway by upgrading from http to tcp after the handshake, leveraging fast, reliable websocket over http or https with backend support.

Compare application gateway version one and version two, noting autoscaling, zone redundancy, static IP, and http rewriting are not supported in version one, and describe migration options and regional availability.

Plan ahead for vnet and subnet configurations before creating the application gateway, then configure ip addresses, listeners, routing rules, http settings, and back-end pools.

Explain infrastructure requirements for deploying Azure Application Gateway within a vnet and subnet, detailing five reserved IP addresses, subnet sizing, and version-specific scalability rules, plus NSG and outbound considerations.

Explore frontend ip addresses in the application gateway, including public and private options and static or dynamic public ips, internal load balancing, and private-ip subnet requirements.

Explore application gateway listeners that handle incoming requests on specific ports, IPs, and protocols (http, https, http2) with basic and multi-site options, routing rules, and ssl termination and end-to-end encryption.

Configure application gateway routing rules to forward listener traffic to a backend pool in the correct processing order, using basic or path-based routing, with optional redirection and header/url rewriting.

Explore Http settings for the application gateway, connecting it to backend targets with options for unencrypted or https end-to-end security, and cover cookie affinity.

Link application gateway back-end pools to targets such as VMs, NICs, VM scale sets, public or private IPs, and FQDNs, with connectivity via vnet peering or vpn gateways, across regions.

Explore Azure Front Door hands-on, covering load balancing, routing decisions, caching at edge locations, web application firewall policies, health probes, monitoring, and tier pricing from standard to premium.

Azure Front Door acts as a global, scalable entry point across the edge network, using layer 7 routing to direct traffic to healthy regional gateways with global resilience.

Follow along in the Azure portal as you learn by creating resources in this hands-on course, while monitoring costs and noting a sample charge around 50 Australian dollars.

Explore the core features of Azure Front Door, including creating the front door, configuring a custom domain and security, implementing traffic redirects, managing backend pools, and purging edge caches.

Learn how to create an Azure Front Door by provisioning a resource group, two App Services as back-end targets, and configuring a front-end domain, back-end pools, and routing rules.

Add a custom domain to Azure Front Door by creating a DNS zone, linking an alias to Azure Front Door, and configuring a custom host name.

Enable https for a custom domain on Azure Front Door, choose the minimum TALF version, and decide between Front Door managed certificates or your own certificates in key vaults.

Explore how apex (root) domain names work with Azure front door, why CNAME records don’t map apex domains, and how alias records enable apex routing with key vault certificates.

Learn to redirect http traffic to https via front door routing rules, creating secure connections from the front end to the back end pool.

Demonstrates url redirection with azure front door by switching back-end routing from forward to permanent redirect, directing traffic to google with a test query, then reverting to the original routing.

Explore how to configure backends and backend pools in Azure Front Door, including targets, health checks, priority and weighted traffic routing, and active-active or active-passive setups.

Configure azure front door rules engine to add content security policy headers to http responses. Attach the rule to routing rules and test the changes.

Create and deploy a web application firewall policy for Azure Front Door, configure managed rules, add a geo location rule to deny non-Australia traffic, and attach it to Front Door.

Configure caching in Azure Front Door to cache content at global edge locations, control query string handling, set edge cache duration, and purge as needed.

Discover the rules engine configuration for Azure front door, including its architecture and when it fires for incoming requests, and learn how to specify conditions and trigger actions.

Explore how the rules engine on the front door evaluates requests against security policies, applies conditions and actions, and routes or rewrites traffic based on device type, headers, or cookies.

Build a rules engine and define conditions. Identify requests by device type, post arguments, query strings, and headers, then apply actions like forward, redirect, or caching.

Explore how Azure Front Door routes traffic by matching requests to routing rules and applying latency-based, weighted, priority-based, and session affinity routing.

Explore the routing architecture of Azure front door, from edge locations and host header matching to TLS handshakes, custom domain handling, web application firewall evaluation, caching, and backend pool selection.

Practice routing rule matching by analyzing incoming protocol, front end host, and path to select exact or wildcard route, avoiding 400 bad requests in large production front door deployments.

Learn how Azure Front Door routes traffic with latency based, priority, and weighted methods, and how latency sensitivity and session affinity shape distribution.

Explore Azure Front Door classic, standard, and premium tiers, including how to create a front door and compare features and pricing.

Learn the differences between Azure Front Door classic, standard, and premium, and configure origins, routing rules, and certificates, including private link service, wealth policies, and real-time traffic insights.

Compare Azure Front Door standard and premium features, including private origin, custom rules, bot protection, and security reports, to choose the right tier for your needs.

Explore Azure Front Door pricing across classic, standard, and premium tiers, including data transfer, outbound transfers, free transfers from origins to edge, routing rules, bandwidth, requests, and firewall costs.

Explore the web application firewall (WAF) in Azure Front Door, including policy configuration, managed vs. custom rules, and detection versus prevention modes and policy settings.

Discover how a web application firewall protects apps at the edge using front door, with managed and custom rules, in detection or prevention modes, and monitored via log analytics.

Create a web application firewall policy for Azure front door in Australia East, enable diagnostic settings, and send firewall and access logs to a Log Analytics workspace for monitoring.

Explore the web application firewall's managed rule sets, and learn how to enable, disable, or customize actions and managed exclusions for protocol attacks and sql injection.

Create and order custom rules in a web application firewall, including geo blocks, IP range denial, query string size limits, header filters, and rate limiting, executed before managed rules.

Explore web application firewall settings: enable or disable, switch detection to prevention mode, and configure policy options with redirects, response codes, and messages; view logs in the log analytics workspace.

Explore monitoring Azure Front Door metrics, set up alerts, and analyze web application firewall data with log analytics, while understanding health probes and back end target health.

Explore front door metrics, including backend health percentage, backend request codes, latency, and billable response sizes, to understand where latency comes from and how requests are handled.

Create alert rules for edge and front door resources using metrics or logs, set threshold for backend health, and route notifications through action groups to monitor traffic and security.

Review analytics in the log analytics workspace by examining diagnostic settings for front door logs, web application firewall logs, and metrics, using predefined firewall queries to filter outcomes.

Learn how the health probe checks backend health status through Azure Front Door, using a configurable interval to route traffic only to healthy backend targets.

Delete the Australia East resource group to remove all resources in one action, including Azure Front Door, policy, and the Log Analytics workspace. Complete the course by safely removing resources.

Explore Azure load balancer hands-on, covering public, internal, and gateway types, zone redundancy, DDoS protection, inbound and outbound rules, egress options, and monitoring.

Explain how Azure load balancer distributes traffic across a back end pool with public and internal options, and how to select http or non-http traffic routing across the right services.

Create a public load balancer, configure a virtual network and two VMs, set up backend pools, health probes, and HTTP rules, and test with IIS.

Demonstrates creating an internal load balancer in a new vnet, configuring a front end IP, back end pool, and health probe, and testing with three VMs (two internal, one test).

Engage in a hands-on Azure load balancing and firewall setup, creating and configuring services while monitoring costs, and learn quick cleanup to avoid ongoing monthly bills.

Configure Azure load balancer core elements by routing traffic to multiple VMs with inbound NAT rules, enable zone redundancy, and integrate gateway load balancer, NAT gateway, and DDoS protection.

Demonstrates configuring an Azure load balancer with inbound nat rules to route traffic to two VMs by port numbers within a virtual network.

Deploy multiple VMs in a single availability zone, configure a zone-specific load balancer to distribute http traffic across them, and create a virtual network with front end IP for testing.

Create a multi-zone load balancer in Sydney to distribute traffic across VMs in zone two and zone three, with a backend pool, front-end IP, port 80 rule, and health probe.

Create a global cross-region load balancer to distribute traffic to two existing load balancers, using a public front-end IP and backend pools targeting those load balancers.

Create gateway load balancer, configure front end IP configuration and back end pool, add a TCP health probe, and associate it with regional and zone load balancers for virtual machines.

Learn to integrate a load balancer with a NAT gateway by creating a public IP address for NAT gateway and routing outbound traffic from the VNet and subnet to internet.

Enable DDoS protection for the load balancer by creating a DDoS protection plan and applying it at the virtual network level, protecting the VNet resources.

Explore Azure load balancer components, including SKUs and types such as internal, global, and gateway load balancers. Examine backend pools, front end IP configuration, zone redundancy, and inbound outbound rules.

Explore basic load balancer configuration in Azure, including resource group, region, and SKU, while comparing basic and standard tiers and public versus internal options for production workloads.

Configure front end IP for azure load balancers by selecting IPv4/IPv6, choosing IP address or IP prefix, and enabling zone redundancy with regional or global public IP options.

Explore configuring Azure load balancer backend pools by nic or by ip after creating a virtual network and resource group, including front-end ip setup and a cleanup.

Create an Azure load balancer with a front end IP, public IP, and backend pool, then define an inbound load balancing rule using TCP or UDP with a health probe.

Configure inbound NAT rules for an Azure load balancer, defining front end and public IPs, back end pools, and TCP/UDP targets for VMs or pools.

Learn how to configure outbound rules on public Azure load balancers, including naming, IP version, protocol, and port allocation, and why NAT gateway is recommended for outbound internet access.

Explore zone redundancy to serve traffic through a single front end IP across zones. Compare zonal deployment and no-zone options, and learn how traffic manager directs to healthy zones.

Explore the cross region load balancer, a global, geo-redundant solution that provides instant failover across regional load balancers, traffic routing by latency, and client IP preservation.

Explore gateway load balancer for high performance and availability, enabling integration with third-party network appliances like firewalls and DDoS protection, while chaining with standard load balancers for flexible network paths.

Explore inbound connectivity in Azure Load Balancer, review inbound net rules and high availability ports, configure multiple frontends with a floating IP for inbound connections, and touch on TCP reset.

Explore inbound nat rules and port forwarding with a load balancer's front end IP, directing traffic to specific VMs via the backend pool and avoiding a single point of failure.

Learn how to enable high availability ports on Azure internal load balancers, enabling load balancing across all ports for every flow based on source and destination IPs, ports, and protocol.

Discover how to enable multiple front end IP addresses on an Azure load balancer, ensure unique destination IP and port across rules, and enable floating IP to reuse backend ports.

Enable tcp resets on load balancer rules and nat rules to align with the idle timeout, triggering a bi-directional reset that closes the session and frees resources.

Explore outbound connectivity options for Azure load balancer, including using the load balancer, a NAT gateway, or a VM's public IP. Implement egress-only traffic with the load balancer.

Explore outbound connectivity options for Azure load balancer, including front-end IP, NAT gateway, and VM public IP configurations, and understand port exhaustion and scalability.

Implement outbound-only connectivity using an internal and a public load balancer, with a front-end IP and outbound rule; note NAT gateway is recommended to avoid port exhaustion.

Explore how to monitor the health of an Azure load balancer using insights, metrics, diagnostic settings, and alerts, while distinguishing health status from backend health probes.

Explore Azure load balancer insights with monitoring graphs, front-end and back-end configurations, inbound and outbound rules, and metrics like availability, throughput, and connection monitors.

Learn to configure diagnostic settings for an Azure load balancer, pushing metrics to log analytics workspace, storage accounts, or event hubs, with cost considerations.

Explore Azure load balancer metrics, including net port status, internet port counts, connection counts, health probe status, and aggregations such as count, sum, average, min, and max.

Configure Azure load balancer alerts by linking them to metrics, setting a static threshold such as 65,000 net connections, evaluating every minute over 30 minutes, and notifying an action group.

Explore the logs and monitoring options for Azure load balancer, using pre-created queries to gain data and insights, then clean up by deleting the ELB resource group.

Master Azure Traffic Manager through hands-on labs, learning routing methods (priority, weighted, performance, geographic, subnet, multi value), endpoint health, nested profiles, and blue-green disaster recovery with monitoring and log analytics.

Azure Traffic Manager is a DNS load balancer that distributes traffic across multiple Azure regions, using health monitoring and routing methods to enable regional failover and maintenance without downtime.

Create and configure a traffic manager profile using priority routing to deliver high availability by directing traffic to Sydney first and failing over to US via endpoints.

Engage in this hands-on Azure course to create VMs, App Service, and Traffic Manager, learn load balancing services and firewall concepts, and practice clean up to minimize costs.

Explore traffic manager routing methods to configure your traffic manager profile, including priority, weighted, performance, geographic, subnet, and multi value routing.

Implement priority routing in Azure traffic manager to send all traffic to the primary endpoint and fail over to secondary endpoints to keep services available across Sydney and US regions.

Explore weighted routing in Azure traffic manager, distributing traffic across region endpoints by configured weights, with Sydney and US IIS servers as a practical example and notes on DNS caching.

Explore performance routing with Azure Traffic Manager to route users to the lowest-latency regional endpoints, using latency table and nested profiles to optimize global traffic.

Configure Azure Traffic Manager geographic routing to send traffic based on origin region to region-specific endpoints (Sydney and US) with a catch-all fallback and granular country or state targeting.

Explore subnet routing in an Azure traffic manager profile by assigning a cidr range to direct traffic. See how traffic from the specified cidr reaches a chosen endpoint.

Discover how Azure Traffic Manager's multi-value routing returns multiple healthy endpoints in one DNS query, enabling client-side retries, improving availability, and reducing latency by avoiding new DNS queries.

Explore Traffic Manager configurations, including endpoint types and health monitoring, and learn how to configure an alias record and access real user measurements and traffic view for your profile.

Create two Windows Server VMs, set up a traffic manager profile with priority routing, and configure an alias record in a DNS zone to point to external endpoints.

Learn to configure traffic manager endpoint types—Azure endpoints, external endpoints, and nested endpoints—for resilient routing. Discover how app service endpoints, slots, and region restrictions shape a priority-based profile.

Explore endpoint monitoring in Azure traffic manager: configure a traffic manager profile with priority routing, define http/https/tcp probes, custom headers, status code ranges, and probing intervals to assess endpoint health.

Learn real user measurements in Azure Traffic Manager with performance routing to Azure region with lowest latency, including key generation and data submission via Android Visual Studio or JavaScript.

Enable traffic view in the traffic manager profile to visualize traffic origin and endpoints on a world map, with a table of local DNS resolver IP, region, volume, and latency.

Explore advanced topics in Traffic Manager profiles, including nested profiles and combining multiple load balancing services in one architecture. Learn how to implement disaster recovery with Traffic Manager.

Explore nested traffic manager profiles, including parent and child configurations, nested endpoints, and routing strategies like performance and weighted routing, with health monitoring and IPv4/IPv6 considerations.

Combine traffic manager, application gateway, and regional load balancers to achieve geo redundancy, closest-region routing, and independent scalability for static and dynamic content with a database cluster.

Learn how disaster recovery with Azure Traffic Manager enables automatic failover between primary and backup sites using priority routing and health checks.

Use Azure Traffic Manager for blue-green deployment with weighted routing. Split traffic between blue production and green release to minimize impact by testing on a small subset.

Configure diagnostic settings for the traffic manager profile, monitor key metrics, and set up alerts. Explore logs in the Log Analytics workspace to analyze traffic manager performance.

Configure diagnostic settings for a traffic manager profile by creating a new diagnostic settings entry and directing all logs and metrics to a log analytics workspace, then save changes.

Explore traffic manager metrics, including endpoint status by endpoints and queries by endpoint results, with filters and alerts to monitor and optimize your Azure load balancing setup.

Create a traffic manager alert using endpoint status by endpoint, set a static threshold with an average aggregation, and trigger a critical alert every five minutes with a 24-hour look-back.

Explore traffic manager logs and diagnostic settings to diagnose endpoint outages, write custom log analytics queries, and create alert rules before cleaning up the traffic manager profile.

Verify traffic manager settings using Windows tools like nslookup and ipconfig, and test failover, weighted routing, and performance routing for your traffic manager profile.

Explore performance considerations for your traffic manager profile and tools to measure DNS performance of your traffic manager. A link to a helpful document is provided in the description.