# Check the IP-configuration boundary of Load Balancer outbound rules

> IPv4 outbound rules support a NIC's primary configuration, not its secondary IPv4 addresses.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-356-check-the-ip-configuration-boundary-of-load-balancer-outbound-rules/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:26:00+00:00
- Modified: 2026-09-10T02:01:55+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

IPv4 outbound rules support a NIC's primary configuration, not its secondary IPv4 addresses.

## Potentially affected

Azure VMs and network appliances using public Standard Load Balancer outbound rules.

## DSE recommendation

Map the application's source configuration to the supported outbound-rule boundary before troubleshooting ports.

## Article

## Source facts

Load Balancer outbound rules explicitly configure SNAT for backend instances on a public Standard Load Balancer. Microsoft limits IPv4 outbound rules to a NIC’s primary IP configuration: secondary IPv4 configurations on a VM or network appliance are not supported.

Multiple NICs are supported, while outbound rules for secondary IP configurations are supported only for IPv6. Outbound NAT supports TCP and UDP, not ICMP. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/load-balancer/outbound-rules).

## Applicability

Outbound rules apply only when the backend VM has no instance-level public IP address. Identify that prerequisite alongside the actual source IP configuration, address family, protocol and backend membership. A second NIC and a second IPv4 configuration on one NIC are different cases in this support review.

## DSE recommendation

DSE recommends starting with the source configuration used by the application before increasing SNAT allocation or widening destination rules. If the intended flow originates from an unsupported secondary IPv4 configuration, have the network owner choose a supported egress design. Keep ping results separate from the TCP or UDP behavior being evaluated, and avoid declaring the configured rule broken based only on an unsupported test.

## Verification

In an approved test, record the originating interface and address for representative application traffic. Compare the observed result with the rule’s backend configuration and supported protocol. Test each required source separately rather than assuming success from one primary address proves every secondary address can use the same outbound mechanism.

## Official references

[Microsoft Learn: Outbound Rules for Azure Load Balancer](https://learn.microsoft.com/en-us/azure/load-balancer/outbound-rules). Source retrieved September 9, 2026.

## Primary reference

- Name: Outbound Rules for Azure Load Balancer | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/load-balancer/outbound-rules
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check the IP-configuration boundary of Load Balancer outbound rules,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-356-check-the-ip-configuration-boundary-of-load-balancer-outbound-rules/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.