Permit the correct Load Balancer health-probe source for each IP family

Source facts

Microsoft identifies 168.63.129.16 as the IPv4 Load Balancer probe source and fe80::1234:5678:9abc as the IPv6 source. Blocking the probe source prevents health checks reaching the instance and can mark that backend down. For a dual-stack load balancer, the documentation specifically requires a network security group configuration that allows the IPv6 probe to function. Microsoft Learn.

Applicability

Use this review when a backend’s probe is unhealthy, particularly after a firewall change or dual-stack deployment. Identify the actual probe protocol, port, backend and IP family. Keep the health-check path distinct from the application’s ordinary client connections.

DSE recommendation

DSE recommends tracing the probe allowance through the relevant network and host rules before changing application settings. Record the approved probe source and destination port with the backend owner. Limit any proposed rule to the needed path and retain the previous rule state. Review both IP families when the deployment uses both.

Verification

Observe probe status before and after the authorized rule adjustment and correlate it with backend-side evidence. Test the permitted application path independently and confirm excluded traffic remains excluded. If the probe still fails, investigate its configured endpoint and response rather than broadening access repeatedly. Preserve the effective rules and test timestamps with the finding.

Official references

Microsoft Learn: Azure Load Balancer health probes.