{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-104-distinguish-sdn-load-balancing-from-outbound-nat-and-full-vip-forwarding/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-104-distinguish-sdn-load-balancing-from-outbound-nat-and-full-vip-forwarding/", "slug": "dse-20260908-104-distinguish-sdn-load-balancing-from-outbound-nat-and-full-vip-forwarding", "url": "https://update.dsesecurity.com/updates/dse-20260908-104-distinguish-sdn-load-balancing-from-outbound-nat-and-full-vip-forwarding/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-104-distinguish-sdn-load-balancing-from-outbound-nat-and-full-vip-forwarding.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-104-distinguish-sdn-load-balancing-from-outbound-nat-and-full-vip-forwarding/" }, "title": "Distinguish SDN load balancing from outbound NAT and full VIP forwarding", "summary": "Which SDN load-balancer rule matches the required traffic direction and exposure?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:15:27+00:00", "modified_at": "2026-09-08T18:23:26+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 1, "word_count": 210, "potentially_affected": "Administrators configuring Microsoft SDN Software Load Balancer rules.", "dse_recommendation": "Create a traffic contract listing the required source, destination, direction, and scope.", "primary_source": { "name": "Configure the Software Load Balancer for Load Balancing and Network Address Translation (NAT)", "url": "https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/Configure-SLB-and-NAT", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft documents Software Load Balancer for incoming distribution, inbound NAT, and outbound NAT. Its outbound NAT example gives a VM in private virtual-network address space an internet-bound translation path. An L3 forwarding rule maps a virtual IP to one VM network interface without specifying individual ports. Microsoft describes that rule as forwarding all traffic to and from that VM through the assigned VIP. Microsoft documentation.

\n

Applicability

\n

Identify the traffic direction, intended virtual IP, backend interfaces, approved ports, and service owner. Review whether the requirement is a shared service, outbound access, or a whole-address mapping before adapting an example.

\n

DSE recommendation

\n

Create a traffic contract listing the required source, destination, direction, and scope. Have the application and network owners review any whole-address forwarding request explicitly. Record the backend membership and avoid substituting a broad rule merely because a narrower service test failed.

\n

Verification

\n

Test the required traffic and a deliberately excluded path from the intended networks. Confirm which backend receives the request and which translated address is observed. Preserve the actual rule and membership with the test results, and investigate unexpected exposure before placing the rule into wider service.

\n

Official references

\n

Microsoft Learn: Configure the Software Load Balancer for Load Balancing and Network Address Translation (NAT). Source reviewed September 8, 2026.

", "content_text": "Source facts\nMicrosoft documents Software Load Balancer for incoming distribution, inbound NAT, and outbound NAT. Its outbound NAT example gives a VM in private virtual-network address space an internet-bound translation path. An L3 forwarding rule maps a virtual IP to one VM network interface without specifying individual ports. Microsoft describes that rule as forwarding all traffic to and from that VM through the assigned VIP. Microsoft documentation.\nApplicability\nIdentify the traffic direction, intended virtual IP, backend interfaces, approved ports, and service owner. Review whether the requirement is a shared service, outbound access, or a whole-address mapping before adapting an example.\nDSE recommendation\nCreate a traffic contract listing the required source, destination, direction, and scope. Have the application and network owners review any whole-address forwarding request explicitly. Record the backend membership and avoid substituting a broad rule merely because a narrower service test failed.\nVerification\nTest the required traffic and a deliberately excluded path from the intended networks. Confirm which backend receives the request and which translated address is observed. Preserve the actual rule and membership with the test results, and investigate unexpected exposure before placing the rule into wider service.\nOfficial references\nMicrosoft Learn: Configure the Software Load Balancer for Load Balancing and Network Address Translation (NAT). Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\nMicrosoft documents Software Load Balancer for incoming distribution, inbound NAT, and outbound NAT. Its outbound NAT example gives a VM in private virtual-network address space an internet-bound translation path. An L3 forwarding rule maps a virtual IP to one VM network interface without specifying individual ports. Microsoft describes that rule as forwarding all traffic to and from that VM through the assigned VIP. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/Configure-SLB-and-NAT).\n\n## Applicability\n\nIdentify the traffic direction, intended virtual IP, backend interfaces, approved ports, and service owner. Review whether the requirement is a shared service, outbound access, or a whole-address mapping before adapting an example.\n\n## DSE recommendation\n\nCreate a traffic contract listing the required source, destination, direction, and scope. Have the application and network owners review any whole-address forwarding request explicitly. Record the backend membership and avoid substituting a broad rule merely because a narrower service test failed.\n\n## Verification\n\nTest the required traffic and a deliberately excluded path from the intended networks. Confirm which backend receives the request and which translated address is observed. Preserve the actual rule and membership with the test results, and investigate unexpected exposure before placing the rule into wider service.\n\n## Official references\n\n[Microsoft Learn: Configure the Software Load Balancer for Load Balancing and Network Address Translation (NAT)](https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/Configure-SLB-and-NAT). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-104-distinguish-sdn-load-balancing-from-outbound-nat-and-full-vip-forwarding/", "url": "https://update.dsesecurity.com/updates/dse-20260908-104-distinguish-sdn-load-balancing-from-outbound-nat-and-full-vip-forwarding/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-104-distinguish-sdn-load-balancing-from-outbound-nat-and-full-vip-forwarding/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Distinguish SDN load balancing from outbound NAT and full VIP forwarding", "item": "https://update.dsesecurity.com/updates/dse-20260908-104-distinguish-sdn-load-balancing-from-outbound-nat-and-full-vip-forwarding/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-104-distinguish-sdn-load-balancing-from-outbound-nat-and-full-vip-forwarding/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-104-distinguish-sdn-load-balancing-from-outbound-nat-and-full-vip-forwarding/", "url": "https://update.dsesecurity.com/updates/dse-20260908-104-distinguish-sdn-load-balancing-from-outbound-nat-and-full-vip-forwarding/", "headline": "Distinguish SDN load balancing from outbound NAT and full VIP forwarding", "description": "Which SDN load-balancer rule matches the required traffic direction and exposure?", "abstract": "Which SDN load-balancer rule matches the required traffic direction and exposure?", "articleBody": "Source facts\nMicrosoft documents Software Load Balancer for incoming distribution, inbound NAT, and outbound NAT. Its outbound NAT example gives a VM in private virtual-network address space an internet-bound translation path. An L3 forwarding rule maps a virtual IP to one VM network interface without specifying individual ports. Microsoft describes that rule as forwarding all traffic to and from that VM through the assigned VIP. Microsoft documentation.\nApplicability\nIdentify the traffic direction, intended virtual IP, backend interfaces, approved ports, and service owner. Review whether the requirement is a shared service, outbound access, or a whole-address mapping before adapting an example.\nDSE recommendation\nCreate a traffic contract listing the required source, destination, direction, and scope. Have the application and network owners review any whole-address forwarding request explicitly. Record the backend membership and avoid substituting a broad rule merely because a narrower service test failed.\nVerification\nTest the required traffic and a deliberately excluded path from the intended networks. Confirm which backend receives the request and which translated address is observed. Preserve the actual rule and membership with the test results, and investigate unexpected exposure before placing the rule into wider service.\nOfficial references\nMicrosoft Learn: Configure the Software Load Balancer for Load Balancing and Network Address Translation (NAT). Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:15:27+00:00", "dateModified": "2026-09-08T18:23:26+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-104-distinguish-sdn-load-balancing-from-outbound-nat-and-full-vip-forwarding/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-104-distinguish-sdn-load-balancing-from-outbound-nat-and-full-vip-forwarding/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Distinguish SDN load balancing from outbound NAT and full VIP forwarding" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 210, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Configure the Software Load Balancer for Load Balancing and Network Address Translation (NAT)", "url": "https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/Configure-SLB-and-NAT" } } ] } }