Edit

Share via

Attach a cross-subscription frontend to an Azure Load Balancer

  • Article

In this article, you learn how to create a load balancer in one Azure subscription and attach a frontend IP address from another subscription. You create a resource group for the load balancer and then create a load balancer with a frontend IP address. You also create a backend address pool, health probe, and load balancer rule.

A cross-subscription load balancer can reference a virtual network that resides in a different subscription other than the load balancers. This feature allows you to deploy a load balancer in one subscription and reference a virtual network in another subscription.

Important

Cross Subscription Load Balancer is currently in preview.

This preview version is provided without a service level agreement, and it's not recommended for production workloads. Certain features might not be supported or might have constrained capabilities. For more information, see Supplemental Terms of Use for Microsoft Azure Previews.

Prerequisites

  • Two Azure subscriptions. One subscription for the virtual network and another subscription for the load balancer.
  • An Azure account with active subscriptions. Create an account for free
  • A public IP address deployed in one of the subscriptions. For this example, the public IP address is in Azure Subscription A.
  • An existing Virtual Network. deployed in one of the subscriptions. For this example, the virtual network is in Azure Subscription B.

If you choose to install and use PowerShell locally, this article requires the Azure PowerShell module version 5.4.1 or later. Run Get-Module -ListAvailable Az to find the installed version. If you need to upgrade, see Install Azure PowerShell module. If you're running PowerShell locally, you also need to run Connect-AzAccount to create a connection with Azure.

Important

All of the code samples will use example names and placeholders. Be sure to replace these with the values from your environment. The values needing replacement will be enclosed in angle brackets, like this: <example value>.

Sign in to Azure

With Azure PowerShell, you sign into Azure with Connect-AzAccount, and change your subscription context with Set-AzContext to Azure Subscription A. Then get the public IP address information with Get-AzPublicIpAddress. You need the Azure subscription ID, resource group name, and virtual network name from your environment.


# Sign in to Azure
Connect-AzAccount

# Set the subscription context to Azure Subscription A
Set-AzContext -Subscription '<Azure Subscription A>'     

# Get the Public IP address information with Get-AzPublicIpAddress
$publicIp = Get-AzPublicIpAddress @pip

Create a resource group

In this section, you create a resource group in Azure Subscription B. This resource group is for all of your resources associate with your load balancer.

With Azure PowerShell, you switch the subscription context with Set-AzContext and create a resource group with New-AzResourceGroup.


# Set the subscription context to Azure Subscription B
Set-AzContext -Subscription '<Azure Subscription B>'  

# Create a resource group  
$rg = @{
    Name = 'myResourceGroupLB'
    Location = 'westus'
}
New-AzResourceGroup @rg

Note

When create the resource group for your load balancer, use the same Azure region as the virtual network in Azure Subscription A.

Create a load balancer

In this section, you create a load balancer in Azure Subscription B. You create a load balancer with a frontend IP address.

Create a load balancer with New-AzLoadBalancer, add a frontend IP configuration with Add-AzLoadBalancerFrontendIpConfig, and then create a backend address pool with New-AzLoadBalancerBackendAddressPool.

# Create a load balancer

$tags = @{
'IsRemoteFrontend'= 'true'
}

$loadbalancer = @{
    ResourceGroupName = 'myResourceGroupLB'
    Name = 'myLoadBalancer'
    Location = 'westus'
    Sku = 'Standard'
    Tag = $tags
}


$LB = New-AzLoadBalancer @loadbalancer
 
$LBinfo = @{
    ResourceGroupName = 'myResourceGroupLB'
    Name = 'myLoadBalancer'
}


$fip = @{
    Name = 'Frontend Name'
    PublicIpAddress = $publicip
}
$LB = $LB | Add-AzLoadBalancerFrontendIpConfig @fip
$LB = $LB | Set-AzLoadBalancer

## Create backend address pool configuration and place in variable. 
$net = @{
    Name = 'vnet name'
    ResourceGroupName = 'myResourceGroupLB'
}
$vnet = Get-AzVirtualNetwork @net

$be = @{
    ResourceGroupName= "myResourceGroupLB"
    Name= "myBackEndPool"
    LoadBalancerName= "myLoadBalancer"
    VirtualNetwork=$vnet.id
    SyncMode= "Automatic"
}
 
#create the backend pool
$backend = New-AzLoadBalancerBackendAddressPool @be
$LB = Get-AzLoadBalancer @LBinfo

Create a health probe and load balancer rule

Create a health probe that determines the health of the backend VM instances and a load balancer rule that defines the frontend IP configuration for the incoming traffic, the backend IP pool to receive the traffic, and the required source and destination port.

With Azure PowerShell, create a health probe with Add-AzLoadBalancerProbeConfig that determines the health of the backend VM instances. Then create a load balancer rule with Add-AzLoadBalancerRuleConfig that defines the frontend IP configuration for the incoming traffic, the backend IP pool to receive the traffic, and the required source and destination port.

## Create the health probe and place in variable. ##
$probe = @{
    Name = 'myHealthProbe2'
    Protocol = 'tcp'
    Port = '80'
    IntervalInSeconds = '360'
    ProbeCount = '5'
}

## Create the load balancer rule and place in variable. ##
$lbrule = @{
    Name = 'myHTTPRule2'
    Protocol = 'tcp'
    FrontendPort = '80'
    BackendPort = '80'
    IdleTimeoutInMinutes = '15'
    FrontendIpConfiguration = $LB.FrontendIpConfigurations[0]
    BackendAddressPool = $backend
}
## Set the load balancer resource. ##
$LB | Add-AzLoadBalancerProbeConfig @probe
$LB | Add-AzLoadBalancerRuleConfig  @lbrule
$LB | Set-AzLoadBalancer

Clean up resources

When no longer needed, you can use the Remove-AzResourceGroup command to remove the resource group you created along with the load balancer, and the remaining resources.

Remove-AzResourceGroup -Name 'myResourceGroupLB'

Next steps

Create a cross-subscription internal load balancer