Create a global load balancer with cross-subscription backends

• Two Azure subscriptions. One subscription for the regional load balancer and its virtual network (Azure Subscription A) and another subscription for the global load balancer (Azure Subscription B).
• An Azure account with active subscriptions. Create an account for free.
• A regional load balancer deployed in Azure Subscription A.
• Azure PowerShell installed locally or Azure Cloud Shell.

If you choose to install and use PowerShell locally, this article requires the Azure PowerShell module version 5.4.1 or later. Run Get-Module -ListAvailable Az to find the installed version. If you need to upgrade, see Install Azure PowerShell module. If you're running PowerShell locally, you also need to run Connect-AzAccount to create a connection with Azure.

• Two Azure subscriptions. Use one subscription for the virtual network (Azure Subscription A) and another subscription for the load balancer (Azure Subscription B).
• An Azure account with active subscriptions. Create an account for free.
• A regional load balancer deployed in Azure Subscription A. For this example, the load balancer is called load-balancer-regional in a resource group called resource-group-a.

• Use the Bash environment in Azure Cloud Shell. For more information, see Get started with Azure Cloud Shell.

  

• If you prefer to run CLI reference commands locally, install the Azure CLI. If you're running on Windows or macOS, consider running Azure CLI in a Docker container. For more information, see How to run the Azure CLI in a Docker container.

  • If you're using a local installation, sign in to the Azure CLI by using the az login command. To finish the authentication process, follow the steps displayed in your terminal. For other sign-in options, see Authenticate to Azure using Azure CLI.

  • When you're prompted, install the Azure CLI extension on first use. For more information about extensions, see Use and manage extensions with the Azure CLI.

  • Run az version to find the version and dependent libraries that are installed. To upgrade to the latest version, run az upgrade.

By using Azure PowerShell, you sign in to Azure by using Connect-AzAccount, and change your subscription context by using Set-AzContext to Azure Subscription A. Then get the regional load balancer information by using Get-AzLoadBalancer and Get-AzLoadBalancerFrontendIpConfig. You need the Azure subscription ID, resource group name, and load balancer name from your environment.

# Sign in to Azure
Connect-AzAccount

# Set the subscription context to Azure Subscription A
Set-AzContext -Subscription '<Subscription ID of Subscription A>'     

# Get the regional load balancer information with Get-AzLoadBalancer
$rlb = @{
    Name = 'load-balancer-regional'
    ResourceGroupName = 'resource-group-a'
}
$rlbinfo = Get-AzLoadBalancer @rlb
$rlbfe = Get-AzLoadBalancerFrontendIpConfig -LoadBalancer $rlbinfo

By using Azure CLI, you sign in to Azure by using az login, and change your subscription context by using az account set to Azure Subscription B.

# Sign in to Azure CLI and change subscription to Azure Subscription B
az login
az account set --subscription '<Subscription ID of Subscription B>'

By using Azure PowerShell, you switch the subscription context by using Set-AzContext and create a resource group by using New-AzResourceGroup.

# Set the subscription context to Azure Subscription B
Set-AzContext -Subscription '<Azure Subscription B>'  

# Create a resource group  
$rg = @{
    Name = 'resource-group-b'
    Location = 'eastus2'
}
New-AzResourceGroup @rg

By using Azure CLI, you can switch the subscription context by using az account set and create a resource group by using az group create.

# Create a resource group in Azure Subscription B
az group create --name resource-group-b --location eastus2

By using Azure PowerShell, you:

• Create the public IP address by using New-AzPublicIpAddress.
• Create a frontend IP configuration by using New-AzLoadBalancerFrontendIpConfig.
• Create a backend address pool by using New-AzLoadBalancerBackendAddressPoolConfig.
• Create a load balancer rule by using Add-AzLoadBalancerRuleConfig.
• Create a global load balancer by using New-AzLoadBalancer.

# Create global IP address for load balancer
$ip = @{
    Name = 'public-IP-global'
    ResourceGroupName = 'resource-group-b'
    Location = 'eastus2'
    Sku = 'Standard'
    Tier = 'Global'
    AllocationMethod = 'Static'
}
$publicIP = New-AzPublicIpAddress @ip

# Create frontend configuration
$fe = @{
    Name = 'front-end-config-global'
    PublicIpAddress = $publicIP
}
$feip = New-AzLoadBalancerFrontendIpConfig @fe

# Create backend address pool
$be = @{
    Name = 'backend-pool-global'
}
$bepool = New-AzLoadBalancerBackendAddressPoolConfig @be

# Create the load balancer rule
$rul = @{
    Name = 'HTTP-rule-global'
    Protocol = 'tcp'
    FrontendPort = '80'
    BackendPort = '80'
    FrontendIpConfiguration = $feip
    BackendAddressPool = $bepool
}
$rule = New-AzLoadBalancerRuleConfig @rul

# Create global load balancer resource
$lbp = @{
    ResourceGroupName = 'resource-group-b'
    Name = 'load-balancer-global'
    Location = 'eastus2'
    Sku = 'Standard'
    Tier = 'Global'
    FrontendIpConfiguration = $feip
    BackendAddressPool = $bepool
    LoadBalancingRule = $rule
}
$lb = New-AzLoadBalancer @lbp

By using Azure CLI, you:

• Create a global load balancer by using az network cross-region-lb create.
• Create a load balancer rule by using az network cross-region-lb rule create.

# Create global load balancer
az network cross-region-lb create --name load-balancer-global --resource-group resource-group-b --frontend-ip-name front-end-config-global --backend-pool-name backend-pool-global

# create a load balancer rule
az network cross-region-lb rule create --backend-port 80 --frontend-port 80 --lb-name load-balancer-global --name HTTP-rule-global --protocol tcp --resource-group resource-group-b --backend-pool-name backend-pool-global --frontend-ip-name front-end-config-global

By using Azure PowerShell, you:

• Create a backend address that references the regional load balancer's frontend IP configuration by using New-AzLoadBalancerBackendAddressConfig.
• Apply the backend address to the global load balancer's backend pool by using Set-AzLoadBalancerBackendAddressPool.

## Create the backend address configuration from the regional load balancer frontend ##
$rlbbaf = @{
    Name = 'backend-pool-config-regional'
    LoadBalancerFrontendIPConfigurationId = $rlbfe.Id
}
$beaddressconfigRLB = New-AzLoadBalancerBackendAddressConfig @rlbbaf

## Apply the backend address pool configuration for the global load balancer ##
$bepoolcr = @{
    ResourceGroupName = 'resource-group-b'
    LoadBalancerName = 'load-balancer-global'
    Name = 'backend-pool-global'
    LoadBalancerBackendAddress = $beaddressconfigRLB
}
Set-AzLoadBalancerBackendAddressPool @bepoolcr

By using Azure CLI, you can add the regional load balancer frontend to the backend pool of the global load balancer by using az network cross-region-lb address-pool address add.

az network cross-region-lb address-pool address add \
    --frontend-ip-address '/subscriptions/<Subscription ID of Subscription A>/resourceGroups/resource-group-a/providers/Microsoft.Network/loadBalancers/load-balancer-regional/frontendIPConfigurations/<regional frontend IP configuration name>' \
    --lb-name load-balancer-global \
    --name myFrontEnd-R2 \
    --pool-name backend-pool-global \
    --resource-group resource-group-b