VMSS Health Probe Showing Unhealthy Status Despite Whitelisting Wireserver IP 168.63.129.16

Question

We are currently exploring the configuration of our production Virtual Machine Scale Sets (VMSS), which are behind an Azure Application Gateway. We have implemented a health extension check using the HTTP protocol on port 80. However, we are encountering an issue when attempting to whitelist specific IP addresses for the VMSS, resulting in instances being marked as unhealthy for the health probe.

Key details:

• We have restricted access to port 80 and created a whitelist of specific IP addresses allowed to access the VMSS, while all others are denied.
• We have already whitelisted the Wireserver IP 168.63.129.16 for health probes, as per Azure's recommendations.
• Health probe communication is allowed to originate from 168.63.129.16, but despite these settings, our VMSS instances still show an unhealthy status.
• We cannot implement a NAT Gateway to ensure that a consistent IP is used for any outbound communication due to cost constraints.

Questions:

1. Is there a specific IP range or additional set of IPs that Azure VMSS uses to perform health checks on its instances (besides the Wireserver IP 168.63.129.16) that should be whitelisted?
2. Are there any additional configurations or settings that need to be considered for health probes in this context?
3. Could there be any other reasons why the VMSS instances are showing as unhealthy despite the Wireserver IP being allowed?
4. Is there any alternative to NAT that can ensure a consistent outbound IP for the VMSS without incurring additional costs?

We would greatly appreciate any insights or guidance on resolving this issue.We are currently exploring the configuration of our production Virtual Machine Scale Sets (VMSS), which are behind an Azure Application Gateway. We have implemented a health extension check using the HTTP protocol on port 80. However, we are encountering an issue when attempting to whitelist specific IP addresses for the VMSS, resulting in instances being marked as unhealthy for the health probe.

Key details:

• We have restricted access to port 80 and created a whitelist of specific IP addresses allowed to access the VMSS, while all others are denied.
• We have already whitelisted the Wireserver IP 168.63.129.16 for health probes, as per Azure's recommendations.
• Health probe communication is allowed to originate from 168.63.129.16, but despite these settings, our VMSS instances still show an unhealthy status.
• We cannot implement a NAT Gateway to ensure that a consistent IP is used for any outbound communication due to cost constraints.

Questions:

1. Is there a specific IP range or additional set of IPs that Azure VMSS uses to perform health checks on its instances (besides the Wireserver IP 168.63.129.16) that should be whitelisted?
2. Are there any additional configurations or settings that need to be considered for health probes in this context?
3. Could there be any other reasons why the VMSS instances are showing as unhealthy despite the Wireserver IP being allowed?
4. Is there any alternative to NAT that can ensure a consistent outbound IP for the VMSS without incurring additional costs?

We would greatly appreciate any insights or guidance on resolving this issue.

Answer 1

@Niket Kumar Singh ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I am afraid you are confusing Load Balancer and Application Gateway.

• May I ask where did you see "168.63.129.16" will be the source IP of the health probes?
  • Can you share the doc please
• Wireserver IP is supposed to be the health probe's origin IP in case of Load Balancer only, not App Gateway

See : Probe Behavior | Source IP address

The source IP address of the probes depends on the backend server type:

• If the server in the backend pool is a public endpoint, the source address will be your application gateway's frontend public IP address.
• If the server in the backend pool is a private endpoint, the source IP address will be from your application gateway subnet's address space.

Now, to address your queries

1 . Is there a specific IP range or additional set of IPs that Azure VMSS uses to perform health checks on its instances (besides the Wireserver IP 168.63.129.16) that should be whitelisted?

• Yes
• Whitelist the App gateway Subnet's IP Range in the VMSS Subnet

2 . Are there any additional configurations or settings that need to be considered for health probes in this context?

• For Poet 80 (HTTP), it should be straight forward.
• As long as the VMSS servers traffic on Port 80, you should not face any difficulties with health probes.
• You can go through the docs :
  • Application Gateway - Backend health and
  • Application Gateway health probes overview

3 . Could there be any other reasons why the VMSS instances are showing as unhealthy despite the Wireserver IP being allowed?

• On the VMSS Subnet, please whitelist the App gateway Subnet's IP Range

4 . Is there any alternative to NAT that can ensure a consistent outbound IP for the VMSS without incurring additional costs?

• I see this question is not related to Application gateway's configuration.
• See : Explicit network outbound connectivity for Flexible scale sets
• For a explicit outbound connectivity method, you can consider Load Balancer Outbound Rules.

Hope this helps.

Can you please let us know if the issue persists after whitelisting the App Gateway's subnet in NSG?

Cheers,

Kapil