{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-356-check-the-ip-configuration-boundary-of-load-balancer-outbound-rules/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-356-check-the-ip-configuration-boundary-of-load-balancer-outbound-rules/", "slug": "dse-20260909-356-check-the-ip-configuration-boundary-of-load-balancer-outbound-rules", "url": "https://update.dsesecurity.com/updates/dse-20260909-356-check-the-ip-configuration-boundary-of-load-balancer-outbound-rules/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-356-check-the-ip-configuration-boundary-of-load-balancer-outbound-rules.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-356-check-the-ip-configuration-boundary-of-load-balancer-outbound-rules/" }, "title": "Check the IP-configuration boundary of Load Balancer outbound rules", "summary": "IPv4 outbound rules support a NIC's primary configuration, not its secondary IPv4 addresses.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:26:00+00:00", "modified_at": "2026-09-10T02:01:55+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 244, "potentially_affected": "Azure VMs and network appliances using public Standard Load Balancer outbound rules.", "dse_recommendation": "Map the application's source configuration to the supported outbound-rule boundary before troubleshooting ports.", "primary_source": { "name": "Outbound Rules for Azure Load Balancer | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/load-balancer/outbound-rules", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Load Balancer outbound rules explicitly configure SNAT for backend instances on a public Standard Load Balancer. Microsoft limits IPv4 outbound rules to a NIC’s primary IP configuration: secondary IPv4 configurations on a VM or network appliance are not supported.

\n

Multiple NICs are supported, while outbound rules for secondary IP configurations are supported only for IPv6. Outbound NAT supports TCP and UDP, not ICMP. Microsoft Learn.

\n

Applicability

\n

Outbound rules apply only when the backend VM has no instance-level public IP address. Identify that prerequisite alongside the actual source IP configuration, address family, protocol and backend membership. A second NIC and a second IPv4 configuration on one NIC are different cases in this support review.

\n

DSE recommendation

\n

DSE recommends starting with the source configuration used by the application before increasing SNAT allocation or widening destination rules. If the intended flow originates from an unsupported secondary IPv4 configuration, have the network owner choose a supported egress design. Keep ping results separate from the TCP or UDP behavior being evaluated, and avoid declaring the configured rule broken based only on an unsupported test.

\n

Verification

\n

In an approved test, record the originating interface and address for representative application traffic. Compare the observed result with the rule’s backend configuration and supported protocol. Test each required source separately rather than assuming success from one primary address proves every secondary address can use the same outbound mechanism.

\n

Official references

\n

Microsoft Learn: Outbound Rules for Azure Load Balancer. Source retrieved September 9, 2026.

", "content_text": "Source facts\nLoad Balancer outbound rules explicitly configure SNAT for backend instances on a public Standard Load Balancer. Microsoft limits IPv4 outbound rules to a NIC’s primary IP configuration: secondary IPv4 configurations on a VM or network appliance are not supported.\nMultiple NICs are supported, while outbound rules for secondary IP configurations are supported only for IPv6. Outbound NAT supports TCP and UDP, not ICMP. Microsoft Learn.\nApplicability\nOutbound rules apply only when the backend VM has no instance-level public IP address. Identify that prerequisite alongside the actual source IP configuration, address family, protocol and backend membership. A second NIC and a second IPv4 configuration on one NIC are different cases in this support review.\nDSE recommendation\nDSE recommends starting with the source configuration used by the application before increasing SNAT allocation or widening destination rules. If the intended flow originates from an unsupported secondary IPv4 configuration, have the network owner choose a supported egress design. Keep ping results separate from the TCP or UDP behavior being evaluated, and avoid declaring the configured rule broken based only on an unsupported test.\nVerification\nIn an approved test, record the originating interface and address for representative application traffic. Compare the observed result with the rule’s backend configuration and supported protocol. Test each required source separately rather than assuming success from one primary address proves every secondary address can use the same outbound mechanism.\nOfficial references\nMicrosoft Learn: Outbound Rules for Azure Load Balancer. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nLoad Balancer outbound rules explicitly configure SNAT for backend instances on a public Standard Load Balancer. Microsoft limits IPv4 outbound rules to a NIC’s primary IP configuration: secondary IPv4 configurations on a VM or network appliance are not supported.\n\nMultiple NICs are supported, while outbound rules for secondary IP configurations are supported only for IPv6. Outbound NAT supports TCP and UDP, not ICMP. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/load-balancer/outbound-rules).\n\n## Applicability\n\nOutbound rules apply only when the backend VM has no instance-level public IP address. Identify that prerequisite alongside the actual source IP configuration, address family, protocol and backend membership. A second NIC and a second IPv4 configuration on one NIC are different cases in this support review.\n\n## DSE recommendation\n\nDSE recommends starting with the source configuration used by the application before increasing SNAT allocation or widening destination rules. If the intended flow originates from an unsupported secondary IPv4 configuration, have the network owner choose a supported egress design. Keep ping results separate from the TCP or UDP behavior being evaluated, and avoid declaring the configured rule broken based only on an unsupported test.\n\n## Verification\n\nIn an approved test, record the originating interface and address for representative application traffic. Compare the observed result with the rule’s backend configuration and supported protocol. Test each required source separately rather than assuming success from one primary address proves every secondary address can use the same outbound mechanism.\n\n## Official references\n\n[Microsoft Learn: Outbound Rules for Azure Load Balancer](https://learn.microsoft.com/en-us/azure/load-balancer/outbound-rules). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-356-check-the-ip-configuration-boundary-of-load-balancer-outbound-rules/", "url": "https://update.dsesecurity.com/updates/dse-20260909-356-check-the-ip-configuration-boundary-of-load-balancer-outbound-rules/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-356-check-the-ip-configuration-boundary-of-load-balancer-outbound-rules/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check the IP-configuration boundary of Load Balancer outbound rules", "item": "https://update.dsesecurity.com/updates/dse-20260909-356-check-the-ip-configuration-boundary-of-load-balancer-outbound-rules/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-356-check-the-ip-configuration-boundary-of-load-balancer-outbound-rules/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-356-check-the-ip-configuration-boundary-of-load-balancer-outbound-rules/", "url": "https://update.dsesecurity.com/updates/dse-20260909-356-check-the-ip-configuration-boundary-of-load-balancer-outbound-rules/", "headline": "Check the IP-configuration boundary of Load Balancer outbound rules", "description": "IPv4 outbound rules support a NIC's primary configuration, not its secondary IPv4 addresses.", "abstract": "IPv4 outbound rules support a NIC's primary configuration, not its secondary IPv4 addresses.", "articleBody": "Source facts\nLoad Balancer outbound rules explicitly configure SNAT for backend instances on a public Standard Load Balancer. Microsoft limits IPv4 outbound rules to a NIC’s primary IP configuration: secondary IPv4 configurations on a VM or network appliance are not supported.\nMultiple NICs are supported, while outbound rules for secondary IP configurations are supported only for IPv6. Outbound NAT supports TCP and UDP, not ICMP. Microsoft Learn.\nApplicability\nOutbound rules apply only when the backend VM has no instance-level public IP address. Identify that prerequisite alongside the actual source IP configuration, address family, protocol and backend membership. A second NIC and a second IPv4 configuration on one NIC are different cases in this support review.\nDSE recommendation\nDSE recommends starting with the source configuration used by the application before increasing SNAT allocation or widening destination rules. If the intended flow originates from an unsupported secondary IPv4 configuration, have the network owner choose a supported egress design. Keep ping results separate from the TCP or UDP behavior being evaluated, and avoid declaring the configured rule broken based only on an unsupported test.\nVerification\nIn an approved test, record the originating interface and address for representative application traffic. Compare the observed result with the rule’s backend configuration and supported protocol. Test each required source separately rather than assuming success from one primary address proves every secondary address can use the same outbound mechanism.\nOfficial references\nMicrosoft Learn: Outbound Rules for Azure Load Balancer. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:26:00+00:00", "dateModified": "2026-09-10T02:01:55+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-356-check-the-ip-configuration-boundary-of-load-balancer-outbound-rules/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-356-check-the-ip-configuration-boundary-of-load-balancer-outbound-rules/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check the IP-configuration boundary of Load Balancer outbound rules" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 244, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Outbound Rules for Azure Load Balancer | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/load-balancer/outbound-rules" } } ] } }