Logical firewall between load balancer and VMs

Question

I am currently trying to learn azure cloud, I have worked with AWS before so may be trying to carry over some concepts here.

I need to know how we can configure a logical firewall to allow traffic from an azure load balancer to and VMs(scale sets or backend pools)?

I was able to do this between different VMs by assigning the VMs to different application security groups and allowing respective traffic from those groups in the network security group. I found the service tag 'AzureLoadBalancer' as an option in NSG rules but it seems that is only for allowing traffic from healthprobes and not from actual load balancer (also there is no option to select a certain load balancer). In the end I had to allow traffic from the public ip of the load balancer to the VNET to get the load balancer to work.

I hope there is a logical way to do this and if there is I am not sure what I am missing here, would appreciate anyone who could help here.

I'm not a network expert, but isn't that how firewalls work? You define routing rules using IP addresses. How was it don't differently in AWS? — Nick.McDermaid
Yes, that's how firewalls work. Although in aws, in case there are 2 instances on 2 different security groups, while allowing traffic from one instance to the other we can allow traffic from the security group itself rather than putting the instance's ip. This is really beneficial for scaling as new instances, especially in autoscaling groups, can be added to the allowed security group straightaway, instead of adding new ips everytime. — Ashish Ranjan