# Trace both address families through a dual-stack Load Balancer deployment

> Check the frontend, backend and VM interface as one end-to-end configuration.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-133-trace-both-address-families-through-a-dual-stack-load-balancer-deployment/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:47+00:00
- Modified: 2026-09-17T16:42:36+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Check the frontend, backend and VM interface as one end-to-end configuration.

## Potentially affected

Use this review when proposing the Standard Load Balancer pattern described by the source. Identify both public endpoints, the backend associations, subnet prefixes and application listeners. Keep the assessment separate from Application Gateway's different IPv6 feature set.

## DSE recommendation

DSE recommends a two-column configuration checklist for IPv4 and IPv6.

## Article

## Source facts

Microsoft’s dual-stack application example includes IPv4 and IPv6 load-balancer frontends, a dual-stack VNet and subnet, dual IP configurations on VM network interfaces, and corresponding network-security rules. Its NIC procedure creates one IPv4 configuration and one IPv6 configuration for each VM interface. A second public frontend alone does not reproduce that documented design. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/load-balancer/deploy-ipv4-ipv6-dual-stack-standard-load-balancer).

## Applicability

Use this review when proposing the Standard Load Balancer pattern described by the source. Identify both public endpoints, the backend associations, subnet prefixes and application listeners. Keep the assessment separate from Application Gateway’s different IPv6 feature set.

## DSE recommendation

DSE recommends a two-column configuration checklist for IPv4 and IPv6. At each layer, record the intended resource, address and permitted application path. Have the network and application owners resolve missing entries before opening client traffic. Review the current source’s complete configuration rather than copying sample addresses or broad administrative-access rules into production.

## Verification

Use approved clients with working connectivity for each address family. Test the same application operation through both frontends and correlate backend observations with the planned interfaces. Check the intended security decisions separately. Preserve evidence by address family so a successful IPv4 request does not close an untested or incomplete IPv6 path.

## Official references

[Microsoft Learn: Deploy IPv6 dual stack application](https://learn.microsoft.com/en-us/azure/load-balancer/deploy-ipv4-ipv6-dual-stack-standard-load-balancer).

## Primary reference

- Name: Deploy IPv6 dual stack application | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/load-balancer/deploy-ipv4-ipv6-dual-stack-standard-load-balancer
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Trace both address families through a dual-stack Load Balancer deployment,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-133-trace-both-address-families-through-a-dual-stack-load-balancer-deployment/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.