{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-133-trace-both-address-families-through-a-dual-stack-load-balancer-deployment/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-133-trace-both-address-families-through-a-dual-stack-load-balancer-deployment/", "slug": "dse-20260917-133-trace-both-address-families-through-a-dual-stack-load-balancer-deployment", "url": "https://update.dsesecurity.com/updates/dse-20260917-133-trace-both-address-families-through-a-dual-stack-load-balancer-deployment/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-133-trace-both-address-families-through-a-dual-stack-load-balancer-deployment.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-133-trace-both-address-families-through-a-dual-stack-load-balancer-deployment/" }, "title": "Trace both address families through a dual-stack Load Balancer deployment", "summary": "Check the frontend, backend and VM interface as one end-to-end configuration.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:32:47+00:00", "modified_at": "2026-09-17T16:42:36+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 209, "potentially_affected": "Use this review when proposing the Standard Load Balancer pattern described by the source. Identify both public endpoints, the backend associations, subnet prefixes and application listeners. Keep the assessment separate from Application Gateway's different IPv6 feature set.", "dse_recommendation": "DSE recommends a two-column configuration checklist for IPv4 and IPv6.", "primary_source": { "name": "Deploy IPv6 dual stack application | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/load-balancer/deploy-ipv4-ipv6-dual-stack-standard-load-balancer", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s dual-stack application example includes IPv4 and IPv6 load-balancer frontends, a dual-stack VNet and subnet, dual IP configurations on VM network interfaces, and corresponding network-security rules. Its NIC procedure creates one IPv4 configuration and one IPv6 configuration for each VM interface. A second public frontend alone does not reproduce that documented design. Microsoft Learn.

\n

Applicability

\n

Use this review when proposing the Standard Load Balancer pattern described by the source. Identify both public endpoints, the backend associations, subnet prefixes and application listeners. Keep the assessment separate from Application Gateway’s different IPv6 feature set.

\n

DSE recommendation

\n

DSE recommends a two-column configuration checklist for IPv4 and IPv6. At each layer, record the intended resource, address and permitted application path. Have the network and application owners resolve missing entries before opening client traffic. Review the current source’s complete configuration rather than copying sample addresses or broad administrative-access rules into production.

\n

Verification

\n

Use approved clients with working connectivity for each address family. Test the same application operation through both frontends and correlate backend observations with the planned interfaces. Check the intended security decisions separately. Preserve evidence by address family so a successful IPv4 request does not close an untested or incomplete IPv6 path.

\n

Official references

\n

Microsoft Learn: Deploy IPv6 dual stack application.

", "content_text": "Source facts\nMicrosoft’s dual-stack application example includes IPv4 and IPv6 load-balancer frontends, a dual-stack VNet and subnet, dual IP configurations on VM network interfaces, and corresponding network-security rules. Its NIC procedure creates one IPv4 configuration and one IPv6 configuration for each VM interface. A second public frontend alone does not reproduce that documented design. Microsoft Learn.\nApplicability\nUse this review when proposing the Standard Load Balancer pattern described by the source. Identify both public endpoints, the backend associations, subnet prefixes and application listeners. Keep the assessment separate from Application Gateway’s different IPv6 feature set.\nDSE recommendation\nDSE recommends a two-column configuration checklist for IPv4 and IPv6. At each layer, record the intended resource, address and permitted application path. Have the network and application owners resolve missing entries before opening client traffic. Review the current source’s complete configuration rather than copying sample addresses or broad administrative-access rules into production.\nVerification\nUse approved clients with working connectivity for each address family. Test the same application operation through both frontends and correlate backend observations with the planned interfaces. Check the intended security decisions separately. Preserve evidence by address family so a successful IPv4 request does not close an untested or incomplete IPv6 path.\nOfficial references\nMicrosoft Learn: Deploy IPv6 dual stack application.", "content_markdown": "## Source facts\n\nMicrosoft’s dual-stack application example includes IPv4 and IPv6 load-balancer frontends, a dual-stack VNet and subnet, dual IP configurations on VM network interfaces, and corresponding network-security rules. Its NIC procedure creates one IPv4 configuration and one IPv6 configuration for each VM interface. A second public frontend alone does not reproduce that documented design. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/load-balancer/deploy-ipv4-ipv6-dual-stack-standard-load-balancer).\n\n## Applicability\n\nUse this review when proposing the Standard Load Balancer pattern described by the source. Identify both public endpoints, the backend associations, subnet prefixes and application listeners. Keep the assessment separate from Application Gateway’s different IPv6 feature set.\n\n## DSE recommendation\n\nDSE recommends a two-column configuration checklist for IPv4 and IPv6. At each layer, record the intended resource, address and permitted application path. Have the network and application owners resolve missing entries before opening client traffic. Review the current source’s complete configuration rather than copying sample addresses or broad administrative-access rules into production.\n\n## Verification\n\nUse approved clients with working connectivity for each address family. Test the same application operation through both frontends and correlate backend observations with the planned interfaces. Check the intended security decisions separately. Preserve evidence by address family so a successful IPv4 request does not close an untested or incomplete IPv6 path.\n\n## Official references\n\n[Microsoft Learn: Deploy IPv6 dual stack application](https://learn.microsoft.com/en-us/azure/load-balancer/deploy-ipv4-ipv6-dual-stack-standard-load-balancer)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-133-trace-both-address-families-through-a-dual-stack-load-balancer-deployment/", "url": "https://update.dsesecurity.com/updates/dse-20260917-133-trace-both-address-families-through-a-dual-stack-load-balancer-deployment/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-133-trace-both-address-families-through-a-dual-stack-load-balancer-deployment/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Trace both address families through a dual-stack Load Balancer deployment", "item": "https://update.dsesecurity.com/updates/dse-20260917-133-trace-both-address-families-through-a-dual-stack-load-balancer-deployment/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-133-trace-both-address-families-through-a-dual-stack-load-balancer-deployment/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-133-trace-both-address-families-through-a-dual-stack-load-balancer-deployment/", "url": "https://update.dsesecurity.com/updates/dse-20260917-133-trace-both-address-families-through-a-dual-stack-load-balancer-deployment/", "headline": "Trace both address families through a dual-stack Load Balancer deployment", "description": "Check the frontend, backend and VM interface as one end-to-end configuration.", "abstract": "Check the frontend, backend and VM interface as one end-to-end configuration.", "articleBody": "Source facts\nMicrosoft’s dual-stack application example includes IPv4 and IPv6 load-balancer frontends, a dual-stack VNet and subnet, dual IP configurations on VM network interfaces, and corresponding network-security rules. Its NIC procedure creates one IPv4 configuration and one IPv6 configuration for each VM interface. A second public frontend alone does not reproduce that documented design. Microsoft Learn.\nApplicability\nUse this review when proposing the Standard Load Balancer pattern described by the source. Identify both public endpoints, the backend associations, subnet prefixes and application listeners. Keep the assessment separate from Application Gateway’s different IPv6 feature set.\nDSE recommendation\nDSE recommends a two-column configuration checklist for IPv4 and IPv6. At each layer, record the intended resource, address and permitted application path. Have the network and application owners resolve missing entries before opening client traffic. Review the current source’s complete configuration rather than copying sample addresses or broad administrative-access rules into production.\nVerification\nUse approved clients with working connectivity for each address family. Test the same application operation through both frontends and correlate backend observations with the planned interfaces. Check the intended security decisions separately. Preserve evidence by address family so a successful IPv4 request does not close an untested or incomplete IPv6 path.\nOfficial references\nMicrosoft Learn: Deploy IPv6 dual stack application.", "datePublished": "2026-09-17T16:32:47+00:00", "dateModified": "2026-09-17T16:42:36+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-133-trace-both-address-families-through-a-dual-stack-load-balancer-deployment/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-133-trace-both-address-families-through-a-dual-stack-load-balancer-deployment/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Trace both address families through a dual-stack Load Balancer deployment" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 209, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Deploy IPv6 dual stack application | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/load-balancer/deploy-ipv4-ipv6-dual-stack-standard-load-balancer" } } ] } }