Private Link with Standard Load Balancer

This document outlines how to leverage Azure Private Link in conjunction with a Standard Load Balancer to securely access Azure PaaS services from your virtual networks without exposing them to the public internet.

Key Concepts

Understanding the following concepts is essential:

• Azure Private Link: A service that provides private connectivity to Azure PaaS services and Azure hosted customer-owned services, using a private endpoint from your virtual network.
• Azure Standard Load Balancer: A regional, highly available network load balancer that enables you to distribute network traffic to your applications. It supports both public and internal load balancing.
• Private Endpoint: A network interface that connects you privately and securely to a service powered by Azure Private Link. It uses a private IP address from your virtual network, effectively bringing the service into your network.

Scenario: Private Link Service with Standard Load Balancer

A common scenario involves exposing a custom application hosted in Azure, behind a Standard Load Balancer, to consumers in other virtual networks. Consumers can access this application via a Private Endpoint.

Steps to Implement

The implementation typically involves these high-level steps:

1. Deploy your application: Host your application in Azure, ensuring it's accessible behind a Standard Load Balancer. This load balancer can be either internal or public, depending on your requirements.
2. Create a Private Link Service: Configure a Private Link Service associated with the frontend IP configuration of your Standard Load Balancer. This service acts as the entry point for consumers.
3. Consumer deploys a Private Endpoint: In the consumer's virtual network, create a Private Endpoint. When creating the Private Endpoint, the consumer will select your Private Link Service. This assigns a private IP address from the consumer's VNet to the Private Endpoint.
4. Configure DNS: Ensure correct DNS resolution so that the application's FQDN resolves to the private IP address of the Private Endpoint. Azure Private DNS zones are highly recommended for this.

Configuration Details

Configuring the Private Link Service

When creating a Private Link Service, you'll need to specify:

• The resource group and region.
• The alias for your service.
• The target Azure Load Balancer (your Standard Load Balancer).
• The network security group (NSG) that applies to the subnet of the load balancer.
• The type of load balancer (Standard).

Consider the following example using Azure CLI:

az network private-link-service create \
  --name myPrivateLinkService \
  --resource-group myResourceGroup \
  --location eastus \
  --lb-frontend-ip-configurations /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myResourceGroup/providers/Microsoft.Network/loadBalancers/myLoadBalancer/frontendIPConfigurations/myFrontendIP \
  --auto-approval-user-ids <consumer-subscription-id>
            

Configuring the Private Endpoint

For the consumer, creating a Private Endpoint involves:

• Specifying the resource group and region for the Private Endpoint.
• Selecting the virtual network and subnet where the Private Endpoint will reside.
• Choosing the Private Link Service you want to connect to.
• Configuring the Private DNS zone for name resolution.

Example using Azure PowerShell:

$privateEndpoint = New-AzPrivateEndpoint -Name "myPrivateEndpoint" `
    -ResourceGroupName "myResourceGroup" `
    -Location "eastus" `
    -Subnet $subnet `
    -PrivateLinkServiceId $privateLinkService.Id `
    -ConnectionName "myConnection"

Set-AzPrivateEndpoint -PrivateEndpoint $privateEndpoint
            

Considerations

• Network Security Groups (NSGs): Ensure your NSGs allow traffic between the Private Endpoint subnet and the Private Link Service.
• Subnet Sizing: Plan your subnet sizes carefully to accommodate Private Endpoints.
• Regional Availability: Private Link and Standard Load Balancer services are regional. Ensure your Private Link Service and Private Endpoint are in the same region or that you have appropriate VNet peering or VPN connectivity.
• Service Specifics: Refer to the documentation for the specific Azure service you are connecting to for any service-specific Private Link configurations.