Check the IP-configuration boundary of Load Balancer outbound rules

Source facts

Load Balancer outbound rules explicitly configure SNAT for backend instances on a public Standard Load Balancer. Microsoft limits IPv4 outbound rules to a NIC’s primary IP configuration: secondary IPv4 configurations on a VM or network appliance are not supported.

Multiple NICs are supported, while outbound rules for secondary IP configurations are supported only for IPv6. Outbound NAT supports TCP and UDP, not ICMP. Microsoft Learn.

Applicability

Outbound rules apply only when the backend VM has no instance-level public IP address. Identify that prerequisite alongside the actual source IP configuration, address family, protocol and backend membership. A second NIC and a second IPv4 configuration on one NIC are different cases in this support review.

DSE recommendation

DSE recommends starting with the source configuration used by the application before increasing SNAT allocation or widening destination rules. If the intended flow originates from an unsupported secondary IPv4 configuration, have the network owner choose a supported egress design. Keep ping results separate from the TCP or UDP behavior being evaluated, and avoid declaring the configured rule broken based only on an unsupported test.

Verification

In an approved test, record the originating interface and address for representative application traffic. Compare the observed result with the rule’s backend configuration and supported protocol. Test each required source separately rather than assuming success from one primary address proves every secondary address can use the same outbound mechanism.

Official references

Microsoft Learn: Outbound Rules for Azure Load Balancer. Source retrieved September 9, 2026.