Modern cloud applications must handle large amounts of traffic reliably and efficiently. Microsoft Azure provides several services for distributing traffic across applications and infrastructure. Understanding when to use each service is essential for designing scalable architectures.
This article explains the core Azure traffic distribution services:
- Azure Load Balancer
- Azure Application Gateway
- Azure Traffic Manager
- Azure Front Door
Azure Load Balancer
Azure Load Balancer operates at OSI Layer 4 (Transport Layer) and distributes traffic based on TCP/UDP information.
It comes in two SKUs:
| SKU | Pricing | Health Probes | Backend Pool |
|---|---|---|---|
| Basic | Free | HTTP, TCP | Scale Sets, Availability Sets |
| Standard | Charged per data processed (~$0.007/GB) + rule charges | HTTP, HTTPS, TCP | Scale Sets, Availability Sets, VMs |
Basic vs Standard Load Balancer
Basic Load Balancer Features
Basic Load Balancers support:
- Port forwarding
- Automatic backend reconfiguration
- Health probes
- Outbound connections via SNAT
- Diagnostics via Azure Log Analytics
Limitations:
- Can only be used with Availability Sets
- No availability zone support
- Limited scalability
Standard Load Balancer Features
Standard Load Balancer includes all Basic features plus:
- HTTPS health probes
- Availability zone support
- Diagnostics via Azure Monitor
- High Availability (HA) ports
- Explicit outbound rules
- 99.99% SLA when two or more VMs are deployed
Standard Load Balancer is the recommended choice for production workloads.
Direct Server Return (DSR)
Direct Server Return (DSR) is a load balancing pattern where:
- Inbound traffic passes through the load balancer.
- Outbound traffic bypasses the load balancer and goes directly from the server to the client.
This reduces load on the load balancer and improves throughput.
When is DSR useful?
DSR is particularly beneficial when:
- The response size is much larger than the request size
- Example workloads include:
- Video streaming
- File downloads
- Media distribution
Requirements
To implement Direct Server Return:
- Support for a Virtual IP (VIP)
- Backend VMs and the load balancer must be on the same network segment
Azure Load Balancer Components
An Azure Load Balancer consists of several core components:
Frontend IP
The public or private IP address that clients connect to.
Backend Pool
The group of resources receiving traffic, such as:
- Virtual Machines
- VM Scale Sets
Health Probe
Continuously checks backend health and removes unhealthy instances from rotation.
Load Balancing Rules
Define how traffic is distributed from the frontend to the backend.
Inbound NAT Rules
Inbound NAT rules are used for direct access to specific VMs.
Characteristics:
- Do not perform load balancing
- Map a specific port/protocol to a single VM
- Useful for SSH or RDP access
- Free of charge
Example:
PublicIP:5001 → VM1:22
PublicIP:5002 → VM2:22
Outbound Rules
Outbound rules define how backend resources access the internet.
Important note:
- Basic Load Balancer automatically performs outbound SNAT
- Standard Load Balancer requires explicit outbound configuration
Traffic Distribution Modes
Azure Load Balancer distributes traffic using hashing.
5-Tuple Hash (Default)
Based on:
- Source IP
- Destination IP
- Source Port
- Destination Port
- Protocol
This provides the most granular distribution.
3-Tuple Hash
Based on:
- Source IP
- Destination IP
- Protocol
2-Tuple Hash
Based on:
- Source IP
- Destination IP
Session Affinity
When sticky sessions are required:
- 2-tuple or 3-tuple hashing is typically used.
Azure Application Gateway
Azure Application Gateway is a Layer 7 (Application Layer) load balancer designed for HTTP/HTTPS workloads.
Unlike Azure Load Balancer, it can make routing decisions based on URL paths, headers, and domains.
It requires a dedicated subnet.
Key Features
Application Gateway supports:
- Path-based routing
- Multi-site hosting
- URL redirection
- HTTP header rewrite
- Custom error pages
- Web Application Firewall (WAF)
Application Gateway Components
Core components include:
- Frontend – public or private entry point
- Backend pool – servers or services receiving traffic
- Listener and routing rules – define request routing behaviour
Azure Traffic Manager
Azure Traffic Manager is a DNS-based traffic routing service.
Instead of proxying traffic, it returns the best endpoint via DNS resolution.
Supported Endpoints
Traffic Manager can route traffic to:
- Cloud Services
- App Services
- App Service slots
- Public IP addresses
Nested Traffic Manager
Traffic Manager profiles can be nested to create sophisticated routing policies, such as:
- Global failover
- Regional traffic distribution
- Performance-based routing
Azure Front Door
Azure Front Door is a global Layer 7 load balancer and CDN-like edge service.
It provides:
- Global HTTP load balancing
- SSL termination
- Edge caching
- Application acceleration
Limitation
Front Door cannot access backend VMs without a public IP.
Azure Outbound Connectivity Methods
Azure provides multiple ways for VMs to connect to the internet.
| # | Method | Port Allocation | Production Ready | Rating |
|---|---|---|---|---|
| 1 | Load Balancer outbound rules | Static | No | OK |
| 2 | NAT Gateway attached to subnet | Static | Yes | Best |
| 3 | Public IP assigned to VM | Static | Yes | OK |
| 4 | Load Balancer implicit outbound | Implicit | No | Poor |
| 5 | Default SNAT | Automatic | No | Worst |
Recommended Approach
For production systems, NAT Gateway is the preferred outbound connectivity solution because it provides:
- Predictable port allocation
- Scalability
- Better reliability
Web Application Firewall (WAF)
Azure provides a Web Application Firewall integrated with:
- Application Gateway
- Azure Front Door
WAF Capabilities
WAF protects applications from common web attacks such as:
- SQL injection
- Cross-site scripting (XSS)
- Malicious crawlers and scanners
Additional capability:
- Rate limiting (Front Door only)
Choosing the Right Azure Traffic Service
| Service | Layer | Primary Use |
|---|---|---|
| Load Balancer | Layer 4 | High-performance TCP/UDP load balancing |
| Application Gateway | Layer 7 | HTTP routing and WAF |
| Traffic Manager | DNS | Global DNS-based routing |
| Front Door | Layer 7 + Edge | Global HTTP acceleration and routing |
Final Thoughts
Azure provides multiple traffic distribution services designed for different layers of the networking stack.
A common production architecture may combine several of these services:
- Front Door for global routing
- Application Gateway for web routing and WAF
- Load Balancer for internal service distribution
Understanding how these services work together allows you to design highly scalable and resilient cloud architectures.
