# Permit the correct Load Balancer health-probe source for each IP family

> Check probe reachability before treating a backend as unavailable.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-096-permit-the-correct-load-balancer-health-probe-source-for-each-ip-family/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:24+00:00
- Modified: 2026-09-17T16:38:46+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Check probe reachability before treating a backend as unavailable.

## Potentially affected

Use this review when a backend's probe is unhealthy, particularly after a firewall change or dual-stack deployment. Identify the actual probe protocol, port, backend and IP family. Keep the health-check path distinct from the application's ordinary client connections.

## DSE recommendation

DSE recommends tracing the probe allowance through the relevant network and host rules before changing application settings.

## Article

## Source facts

Microsoft identifies 168.63.129.16 as the IPv4 Load Balancer probe source and fe80::1234:5678:9abc as the IPv6 source. Blocking the probe source prevents health checks reaching the instance and can mark that backend down. For a dual-stack load balancer, the documentation specifically requires a network security group configuration that allows the IPv6 probe to function. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-custom-probe-overview).

## Applicability

Use this review when a backend’s probe is unhealthy, particularly after a firewall change or dual-stack deployment. Identify the actual probe protocol, port, backend and IP family. Keep the health-check path distinct from the application’s ordinary client connections.

## DSE recommendation

DSE recommends tracing the probe allowance through the relevant network and host rules before changing application settings. Record the approved probe source and destination port with the backend owner. Limit any proposed rule to the needed path and retain the previous rule state. Review both IP families when the deployment uses both.

## Verification

Observe probe status before and after the authorized rule adjustment and correlate it with backend-side evidence. Test the permitted application path independently and confirm excluded traffic remains excluded. If the probe still fails, investigate its configured endpoint and response rather than broadening access repeatedly. Preserve the effective rules and test timestamps with the finding.

## Official references

[Microsoft Learn: Azure Load Balancer health probes](https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-custom-probe-overview).

## Primary reference

- Name: Azure Load Balancer health probes | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-custom-probe-overview
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Permit the correct Load Balancer health-probe source for each IP family,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-096-permit-the-correct-load-balancer-health-probe-source-for-each-ip-family/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.