Verify the actual frontend-port mapping for each inbound NAT target

Source facts

Microsoft’s inbound NAT tutorial uses an Azure Load Balancer public address together with a port number to connect to a VM in the virtual network. It directs operators to the port-mapping view for backend-pool VMs. Its connection example uses the selected NAT frontend port when opening the remote session. Microsoft Learn.

Applicability

Use this review when documenting or changing an approved inbound NAT management path. Identify the load balancer, frontend address, rule, mapped port and target VM. Treat the tutorial’s port numbers and broad deployment examples as sample values rather than production requirements.

DSE recommendation

DSE recommends an endpoint register that pairs each approved frontend tuple with its intended backend identity and owner. Verify the mapping before distributing connection instructions or modifying a backend pool. Review access restrictions and credentials independently, and preserve the prior mapping in the change record. Do not infer the target solely from a remembered port number.

Verification

Inspect the current port mapping and connect from an authorized source using the approved credentials. Confirm the remote machine’s identity before performing administrative work. Record the frontend tuple and observed target, then repeat after any rule or pool change. Resolve a mismatched destination before updating user instructions or making changes on the reached host.

Official references

Microsoft Learn: Tutorial: Create Inbound NAT rule V2 – Azure portal.