An employee of Nordlicht Reisen GmbH, a fictional travel agency, reports: "The booking machine cannot reach the database." You know nothing more. You are supposed to find the fault without guessing everything and without opening up rules just to see whether it works then. The exam calls this troubleshoot network connectivity and troubleshoot load balancing.
Prior knowledge: Virtual networks and subnets are lesson 4.1, peering and routes lesson 4.2, network security groups with the default rules lesson 4.3, DNS lesson 4.5, the load balancer lesson 4.6. How TCP, ports, and name resolution work in principle is in K3, lessons 3.0.2 and 3.0.3. This lesson combines them into one procedure.
The procedure: from the bottom up
A connection can fail in four places. Check them in order, always with a tool that delivers the answer instead of guessing:
| Layer | Question | Tool |
|---|---|---|
| 1. Name | Does the name resolve to the right address? | nslookup, lesson 4.5 |
| 2. Route | Where does Azure send the packet? | Next hop, effective routes |
| 3. Filter | Does an NSG let the packet through? | IP flow verify, Effective security rules, NSG diagnostics |
| 4. Target | Is anyone listening on the port at the target, and does it answer? | Connection troubleshoot, test on the target itself |
A fault higher up hides the ones further down: With a wrong name, no NSG rule helps; with a missing route, the NSG needs no check. Where Azure allows everything, the fault is at the target itself, such as the VM's firewall.