title: Logical firewall between load balancer and VMs
body: <p>I am currently trying to learn azure cloud, I have worked with AWS before so may be trying to carry over some concepts here.</p>
  <p>I need to know how we can configure a logical firewall to allow traffic from an azure load balancer to and VMs(scale sets or backend pools)?</p>
  <p>I was able to do this between different VMs by assigning the VMs to different application security groups and allowing respective traffic from those groups in the network security group. I found the service tag 'AzureLoadBalancer' as an option in NSG rules but it seems that is only for allowing traffic from healthprobes and not from actual load balancer (also there is no option to select a certain load balancer). In the end I had to allow traffic from the public ip of the load balancer to the VNET to get the load balancer to work.</p>
  <p>I hope there is a logical way to do this and if there is I am not sure what I am missing here, would appreciate anyone who could help here.</p>