Traffic Manager: DNS-based global routing

Keep both VMs running for both breaks.

1Break it: the primary region goes down

Stop the web server in Central India, as if the region had an outage:

az vm run-command invoke --resource-group rg-saat-l53 --name vm-central --command-id RunShellScript --scripts 'systemctl stop web; systemctl is-active web' --query "value[0].message" -o tsv

Wait about 30 seconds, then check again:

az network traffic-manager endpoint list --resource-group rg-saat-l53 --profile-name tm-saat --query "[].{name:name, priority:priority, status:endpointMonitorStatus}" -o table
Clear-DnsClientCache; Resolve-DnsName $tmName -Type CNAME | Select-Object -ExpandProperty NameHost; curl.exe -s http://$tmName/

You should see something like this:

Name        Priority    Status
----------  ----------  --------
ep-central  1           Degraded
ep-south    2           Online
saat53s12345.southindia.cloudapp.azure.com
Hello from South India

Failover worked without anyone touching DNS. The Clear-DnsClientCache step matters: without it, your laptop keeps the old answer until the TTL runs out, and many real clients cache longer than the TTL says.

Fix it: bring Central India back and watch it fail back:

az vm run-command invoke --resource-group rg-saat-l53 --name vm-central --command-id RunShellScript --scripts 'systemd-run --unit web python3 -m http.server 80 --directory /srv/www; sleep 2; systemctl is-active web' --query "value[0].message" -o tsv
az network traffic-manager endpoint list --resource-group rg-saat-l53 --profile-name tm-saat --query "[].{name:name, priority:priority, status:endpointMonitorStatus}" -o table

After about 30 seconds ep-central is Online again and DNS points back to Central India. With Priority routing, failback is automatic, which you may not always want for a database-backed app.

2Break it: a health check that hides failures

The app team asks for a dedicated health URL, so someone changes the probe path before the page exists:

az network traffic-manager profile update --resource-group rg-saat-l53 --name tm-saat --path /health -o none
az network traffic-manager endpoint list --resource-group rg-saat-l53 --profile-name tm-saat --query "[].{name:name, priority:priority, status:endpointMonitorStatus}" -o table
Clear-DnsClientCache; Resolve-DnsName $tmName -Type CNAME | Select-Object -ExpandProperty NameHost; curl.exe -s http://$tmName/

After about 30 seconds you should see something like this:

Name        Priority    Status
----------  ----------  --------
ep-central  1           Degraded
ep-south    2           Degraded
saat53c12345.centralindia.cloudapp.azure.com
Hello from Central India

Both endpoints are Degraded, yet the site still works. That’s fail open: when every endpoint is Degraded, Traffic Manager answers as if all were healthy. It looks harmless, but failover is now switched off.

Prove it by stopping Central India again:

az vm run-command invoke --resource-group rg-saat-l53 --name vm-central --command-id RunShellScript --scripts 'systemctl stop web; systemctl is-active web' --query "value[0].message" -o tsv
Start-Sleep -Seconds 30
Clear-DnsClientCache; Resolve-DnsName $tmName -Type CNAME | Select-Object -ExpandProperty NameHost; curl.exe -s http://$tmName/

You should see something like this:

saat53c12345.centralindia.cloudapp.azure.com
(curl prints nothing: the connection is refused)

Users are sent to a dead region, because health checks can no longer tell a dead endpoint from a live one.

Fix it: create the health page on both VMs, start Central India again, and check that statuses are meaningful:

az vm run-command invoke --resource-group rg-saat-l53 --name vm-central --command-id RunShellScript --scripts 'echo ok > /srv/www/health; systemd-run --unit web python3 -m http.server 80 --directory /srv/www; sleep 2; systemctl is-active web' --query "value[0].message" -o tsv
az vm run-command invoke --resource-group rg-saat-l53 --name vm-south --command-id RunShellScript --scripts 'echo ok > /srv/www/health; systemctl is-active web' --query "value[0].message" -o tsv
az network traffic-manager endpoint list --resource-group rg-saat-l53 --profile-name tm-saat --query "[].{name:name, priority:priority, status:endpointMonitorStatus}" -o table

Both endpoints return to Online. From now on, a dead region shows as Degraded and gets no traffic.

3Clean up

Delete the lab resource group:

az group delete --name rg-saat-l53 --yes
az resource list --tag lesson=53 -o table

The last command should print nothing.

✅ Checkpoint: You watched a real failover and failback, found a probe that disabled failover, and removed the lab.