|
| 1 | +--- |
| 2 | +title: Attach a cross-subscription frontend to an Azure Load Balancer |
| 3 | +titleSuffix: Azure Load Balancer |
| 4 | +description: Learn how to create a load balancer in one Azure subscription and attach a frontend IP address from another subscription in Azure Load Balancer. |
| 5 | +services: load-balancer |
| 6 | +author: mbender-ms |
| 7 | +ms.service: load-balancer |
| 8 | +ms.topic: how-to |
| 9 | +ms.date: 06/18/2024 |
| 10 | +ms.author: mbender |
| 11 | +ms.custom: |
| 12 | +--- |
| 13 | + |
| 14 | +# Attach a cross-subscription frontend to an Azure Load Balancer |
| 15 | + |
| 16 | +In this article, you learn how to create a load balancer in one Azure subscription and attach a frontend IP address from another subscription. You create a resource group for the load balancer and then create a load balancer with a frontend IP address. You also create a backend address pool, health probe, and load balancer rule. |
| 17 | + |
| 18 | +A [cross-subscription load balancer](cross-subscription-overview.md) can reference a virtual network that resides in a different subscription other than the load balancers. This feature allows you to deploy a load balancer in one subscription and reference a virtual network in another subscription. |
| 19 | + |
| 20 | +[!INCLUDE [load-balancer-cross-subscription-preview](../../includes/load-balancer-cross-subscription-preview.md)] |
| 21 | + |
| 22 | +## Prerequisites |
| 23 | + |
| 24 | +# [Azure PowerShell](#tab/azurepowershell) |
| 25 | + |
| 26 | +- Two Azure subscriptions. One subscription for the virtual network and another subscription for the load balancer. |
| 27 | +- An Azure account with active subscriptions. [Create an account for free](https://azure.microsoft.com/free/) |
| 28 | +- A public IP address deployed in one of the subscriptions. For this example, the public IP address is in **Azure Subscription A**. |
| 29 | +- An existing [Virtual Network](../virtual-network/quick-create-powershell.md). deployed in one of the subscriptions. For this example, the virtual network is in **Azure Subscription B**. |
| 30 | + |
| 31 | +If you choose to install and use PowerShell locally, this article requires the Azure PowerShell module version 5.4.1 or later. Run `Get-Module -ListAvailable Az` to find the installed version. If you need to upgrade, see Install Azure PowerShell module. If you're running PowerShell locally, you also need to run `Connect-AzAccount` to create a connection with Azure. |
| 32 | + |
| 33 | +> [!IMPORTANT] |
| 34 | +> All of the code samples will use example names and placeholders. Be sure to replace these with the values from your environment. |
| 35 | +> The values needing replacement will be enclosed in angle brackets, like this: `<example value>`. |
| 36 | +> |
| 37 | + |
| 38 | +# [Azure CLI](#tab/azurecli/) |
| 39 | + |
| 40 | +[!INCLUDE [azure-cli-prepare-your-environment.md](~/reusable-content/azure-cli/azure-cli-prepare-your-environment-no-header.md)] |
| 41 | + |
| 42 | +- Two Azure subscriptions. One subscription for the virtual network (**Azure Subscription A**) and another subscription for the load balancer(**Azure Subscription B**). |
| 43 | +- An Azure account with active subscriptions. [Create an account for free](https://azure.microsoft.com/free/) |
| 44 | +- A public IP address deployed in one of the subscriptions. For this example, the public IP address is in **Azure Subscription A**. |
| 45 | +- An existing [Virtual Network](../virtual-network/quick-create-cli.md). deployed in one of the subscriptions. For this example, the virtual network is in **Azure Subscription B**. |
| 46 | + |
| 47 | +If you choose to install and use the CLI locally, this quickstart requires Azure CLI version 2.60 or later. To find the version, run az --version. If you need to install or upgrade, see Install the Azure CLI. |
| 48 | + |
| 49 | +> [!IMPORTANT] |
| 50 | +> All of the code samples will use example names and placeholders. Be sure to replace these with the values from your environment. |
| 51 | +> The values needing replacement will be enclosed in angle brackets, like this: `<example value>`. |
| 52 | +
|
| 53 | +--- |
| 54 | + |
| 55 | +## Sign in to Azure |
| 56 | + |
| 57 | +# [Azure PowerShell](#tab/azurepowershell) |
| 58 | + |
| 59 | +With Azure PowerShell, you sign into Azure with [`Connect-AzAccount`](/powershell/module/az.accounts/connect-azaccount), and change your subscription context with [`Set-AzContext`](/powershell/module/az.accounts/set-azcontext) to **Azure Subscription A**. Then get the public IP address information with [`Get-AzPublicIpAddress`](/powershell/module/az.network/get-azpublicipaddress). You need the Azure subscription ID, resource group name, and virtual network name from your environment. |
| 60 | + |
| 61 | + |
| 62 | +```azurepowershell |
| 63 | +
|
| 64 | +# Sign in to Azure |
| 65 | +Connect-AzAccount |
| 66 | +
|
| 67 | +# Set the subscription context to Azure Subscription A |
| 68 | +Set-AzContext -Subscription '<Azure Subscription A>' |
| 69 | +
|
| 70 | +# Get the Public IP address information with Get-AzPublicIpAddress |
| 71 | +$publicIp = Get-AzPublicIpAddress @pip |
| 72 | +``` |
| 73 | + |
| 74 | +# [Azure CLI](#tab/azurecli/) |
| 75 | + |
| 76 | +With Azure CLI, you'll sign into Azure with [az login](/cli/azure/reference-index#az-login), and change your subscription context with [`az account set`](/cli/azure/account#az_account_set) to **Azure Subscription A**. |
| 77 | + |
| 78 | +```azurecli |
| 79 | +
|
| 80 | +# Sign in to Azure CLI and change subscription to Azure Subscription A |
| 81 | +Az login |
| 82 | +Az account set –subscription <Azure Subscription A> |
| 83 | +``` |
| 84 | + |
| 85 | +--- |
| 86 | + |
| 87 | +## Create a resource group |
| 88 | + |
| 89 | +In this section, you create a resource group in **Azure Subscription B**. This resource group is for all of your resources associate with your load balancer. |
| 90 | + |
| 91 | +# [Azure PowerShell](#tab/azurepowershell) |
| 92 | + |
| 93 | +With Azure PowerShell, you switch the subscription context with [`Set-AzContext`](/powershell/module/az.accounts/set-azcontext) and create a resource group with [`New-AzResourceGroup`](/powershell/module/az.resources/new-azresourcegroup). |
| 94 | + |
| 95 | +```azurepowershell |
| 96 | +
|
| 97 | +# Set the subscription context to Azure Subscription B |
| 98 | +Set-AzContext -Subscription '<Azure Subscription B>' |
| 99 | +
|
| 100 | +# Create a resource group |
| 101 | +$rg = @{ |
| 102 | + Name = 'myResourceGroupLB' |
| 103 | + Location = 'westus' |
| 104 | +} |
| 105 | +New-AzResourceGroup @rg |
| 106 | +
|
| 107 | +``` |
| 108 | +> [!NOTE] |
| 109 | +> When create the resource group for your load balancer, use the same Azure region as the virtual network in **Azure Subscription A**. |
| 110 | +
|
| 111 | +# [Azure CLI](#tab/azurecli/) |
| 112 | + |
| 113 | +With Azure CLI, you switch the subscription context with [`az account set`](/cli/azure/account#az_account_set) and create a resource group with [`az group create`](/cli/azure/group#az_group_create). |
| 114 | + |
| 115 | +```azurecli |
| 116 | +# Create a resource group in Azure Subscription B |
| 117 | +az group create --name 'myResourceGroupLB' --location westus |
| 118 | +``` |
| 119 | + |
| 120 | +> [!NOTE] |
| 121 | +> When create the resource group for your load balancer, use the same Azure region as the virtual network in **Azure Subscription A**. |
| 122 | +
|
| 123 | +--- |
| 124 | + |
| 125 | +## Create a load balancer |
| 126 | + |
| 127 | +In this section, you create a load balancer in **Azure Subscription B**. You create a load balancer with a frontend IP address. |
| 128 | + |
| 129 | +# [Azure PowerShell](#tab/azurepowershell) |
| 130 | + |
| 131 | +Create a load balancer with [`New-AzLoadBalancer`](/powershell/module/az.network/new-azloadbalancer), add a frontend IP configuration with [`Add-AzLoadBalancerFrontendIpConfig`](/powershell/module/az.network/add-azloadbalancerfrontendipconfig), and then create a backend address pool with [`New-AzLoadBalancerBackendAddressPool`](/powershell/module/az.network/new-azloadbalancerbackendaddresspool). |
| 132 | + |
| 133 | +```azurepowershell |
| 134 | +# Create a load balancer |
| 135 | +
|
| 136 | +$tags = @{ |
| 137 | +'IsRemoteFrontend'= 'true' |
| 138 | +} |
| 139 | +
|
| 140 | +$loadbalancer = @{ |
| 141 | + ResourceGroupName = 'myResourceGroupLB' |
| 142 | + Name = 'myLoadBalancer' |
| 143 | + Location = 'westus' |
| 144 | + Sku = 'Standard' |
| 145 | + Tag = $tags |
| 146 | +} |
| 147 | +
|
| 148 | +
|
| 149 | +$LB = New-AzLoadBalancer @loadbalancer |
| 150 | + |
| 151 | +$LBinfo = @{ |
| 152 | + ResourceGroupName = 'myResourceGroupLB' |
| 153 | + Name = 'myLoadBalancer’ |
| 154 | +} |
| 155 | +
|
| 156 | +
|
| 157 | +$fip = @{ |
| 158 | + Name = 'Frontend Name' |
| 159 | + PublicIpAddress = $publicip |
| 160 | +} |
| 161 | +$LB = $LB | Add-AzLoadBalancerFrontendIpConfig @fip |
| 162 | +$LB = $LB | Set-AzLoadBalancer |
| 163 | +
|
| 164 | +## Create backend address pool configuration and place in variable. |
| 165 | +$net = @{ |
| 166 | + Name = 'vnet name' |
| 167 | + ResourceGroupName = 'myResourceGroupLB' |
| 168 | +} |
| 169 | +$vnet = Get-AzVirtualNetwork @net |
| 170 | +
|
| 171 | +$be = @{ |
| 172 | + ResourceGroupName= "myResourceGroupLB" |
| 173 | + Name= "myBackEndPool" |
| 174 | + LoadBalancerName= "myLoadBalancer" |
| 175 | + VirtualNetwork=$vnet.id |
| 176 | + SyncMode= "Automatic" |
| 177 | +} |
| 178 | + |
| 179 | +#create the backend pool |
| 180 | +$backend = New-AzLoadBalancerBackendAddressPool @be |
| 181 | +$LB = Get-AzLoadBalancer @LBinfo |
| 182 | +
|
| 183 | +``` |
| 184 | +# [Azure CLI](#tab/azurecli/) |
| 185 | + |
| 186 | +With Azure CLI, you create a load balancer with [`az network lb create`](/cli/azure/network/lb#az_network_lb_create) and update the backend pool. This example configures the following resources: |
| 187 | + |
| 188 | +- A frontend IP address that receives the incoming network traffic on the load balancer. |
| 189 | + - The public IP address is pulled from subscription A, and the load balancer is deployed in subscription B. |
| 190 | + - The `IsRemoteFrontend:True` tag is added since the IP address is cross-subscription. |
| 191 | +- A backend address pool where the frontend IP sends the load balanced network traffic. |
| 192 | + |
| 193 | +```azurecli |
| 194 | +
|
| 195 | +# Create a load balancer |
| 196 | +
|
| 197 | +az network lb create --resource-group myResourceGroupLB --name myLoadBalancer --sku Standard --public-ip-address '/subscriptions/<subscription A ID>/resourceGroups/{resource group name} /providers/Microsoft.Network/publicIPAddresses/{public IP address name}’ --frontend-ip-name myFrontEnd --backend-pool-name MyBackendPool --tags 'IsRemoteFrontend=true' |
| 198 | +``` |
| 199 | + |
| 200 | +In order to utilize the cross-subscription feature of Azure load balancer, backend pools need to have the syncMode property enabled and a virtual network reference. This section updates the backend pool created prior by attaching the cross-subscription virtual network and enabling the syncMode property. |
| 201 | + |
| 202 | +```azurecli |
| 203 | +## Configure the backend address pool and syncMode property |
| 204 | +az network lb address-pool update --lb-name myLoadBalancer --resource-group myResourceGroupLB -n myResourceGroupLB --vnet ‘/subscriptions/<subscription A ID>/resourceGroups/{resource group name}/providers/Microsoft.Network/virtualNetwork/{VNet name}’ --sync-mode Automatic |
| 205 | +``` |
| 206 | + |
| 207 | +--- |
| 208 | + |
| 209 | +[!INCLUDE [load-balancer-cross-subscription-health-probe-rules](../../includes/load-balancer-cross-subscription-health-probe-rules.md)] |
| 210 | + |
| 211 | +[!INCLUDE [load-balancer-cross-subscription-clean-up](../../includes/load-balancer-cross-subscription-clean-up.md)] |
| 212 | + |
| 213 | +## Next steps |
| 214 | + |
| 215 | +> [!div class="nextstepaction"] |
| 216 | +> [Create a cross-subscription internal load balancer](./cross-subscription-how-to-internal-load-balancer.md) |
0 commit comments