Distinguish SDN load balancing from outbound NAT and full VIP forwarding

Source facts

Microsoft documents Software Load Balancer for incoming distribution, inbound NAT, and outbound NAT. Its outbound NAT example gives a VM in private virtual-network address space an internet-bound translation path. An L3 forwarding rule maps a virtual IP to one VM network interface without specifying individual ports. Microsoft describes that rule as forwarding all traffic to and from that VM through the assigned VIP. Microsoft documentation.

Applicability

Identify the traffic direction, intended virtual IP, backend interfaces, approved ports, and service owner. Review whether the requirement is a shared service, outbound access, or a whole-address mapping before adapting an example.

DSE recommendation

Create a traffic contract listing the required source, destination, direction, and scope. Have the application and network owners review any whole-address forwarding request explicitly. Record the backend membership and avoid substituting a broad rule merely because a narrower service test failed.

Verification

Test the required traffic and a deliberately excluded path from the intended networks. Confirm which backend receives the request and which translated address is observed. Preserve the actual rule and membership with the test results, and investigate unexpected exposure before placing the rule into wider service.

Official references

Microsoft Learn: Configure the Software Load Balancer for Load Balancing and Network Address Translation (NAT). Source reviewed September 8, 2026.