Azure Networking - #12 - Azure NAT Gateway

[@kauffmann101]

This is an awesome short turtorial to learn the new features of Azure. Thanks for your effort ,Dean! Keep going 👍

[@AzureAcademy]

Thanks for the feedback Kafka! Let me know if you have an suggestions for other videos you would like us to do

[@lynnecromack4933]

OK. 4:47 why does the LB back-end pool have a VM that also has its own instance PiP? Did you mean the 2 VM icons in subnet 1 are nt actually the B/E pool, just further VMs in the subnet? Thanks Dean.

[@AzureAcademy]

Hey Lynne I not positive that it does. The LB does not have a VM directly under it. Subnet A has the LB and also 2 VMs 1 with a PIP and the other using the nat gateway. One of the advantages of the LB is that you should not have a pip and LB for the same VM If it is intended to have the VM with the pip also behind the LB I’d say that the doc is wrong

[@andreipostolachi7927]

Probably a stupid question, bear with me, still learning, but could Azure NAT Gateway be used to translate the IP range for AWS to Azure site to site VPN connections if there are IPs overlapping? Quick example, I have SFTP in my Azure account and there other 3x 3rd party platforms in either AWS or Azure vendors' accounts that needs site-to-site VPN connection between their could and my cloud, could my Azure NAT manage the translation to avoid IP overlapping? Thank you

[@AzureAcademy]

No, in Azure all VMs get a private IP address by default, and when those VMs send traffic to the internet they are issued a SNAT public ip that cN change over time. The purpose of the NAT Gateway is to give an entire subnet of VMs a SNAT public ip that does not change so it is only for outbound communication from Azure to the internet. Example: The random public IP address your VM hosting FTP would get is 100.65.18.4 in the new connection started tomorrow the IP address would be 52.16.20.125. The NAT gateway would give you the same public ip every time of 52.18.16.202 Now when anyone from any cloud or any other service anywhere in the world wants to talk to your SFTP server they would use that IP address

[@musadhk]

How can we control the outbound connectivity on NAT gateway? Lets say I want to allow only few destinations only. Can we add FW or NSG directly(I didn't see that option though) on an NAT gateway? Thanks

[@AzureAcademy]

If you have a firewall before the internet then it is your NAT. All traffic goes through the firewall and you can allow/deny what you want. You can add and NSG with outbound rules but you don’t add that to the NAT Gateway, you add it to hell the subnet

[@mosksky]

Thank you Dean! please don't stop keep publishing your video so good to learn from you. PS: just the background music is a bit destructing, not a big deal but figured i share my feedback :)

[@AzureAcademy]

Thanks for the feedback Len. Can you give me more info on that? Is it the music I picked, the volume level or that there is anything playing at all, or something else?

[@mosksky]

@@AzureAcademy good music and volume. You have very good voice timbre, which helps to concentrate on the topic i don't think any background sound is necessary (only in my opinion) Once again great training as always! thank you again!!!

[@AzureAcademy]

Great, thanks for the additional feedback!

[@deychand11]

Nice explaination. Thanks for publishing.

[@AzureAcademy]

Happy to help, and thanks for the feedback!

[@Martialbertrand]

The nat ip is a public ip address. Do you plan to have the option to include private ip option? Instead of translating to an Pip, it will be nice if you can have the option translate to Private ip. It will help resolve the issue of overlapping ip addressess between subnets in vpn scenario where you don't want any public ip access to your vnet. Do you know any solution can resolve that issue?

[@AzureAcademy]

Not currently...however it never hurts to provide that feedback...who knows, they might do it. The only was to avoid that VPN overlap I know of today is planning...

[@AzureAcademy]

+Martial bertrand as far as I know there are no plans to make Nat Gateway work on the private IP address range...but you never know 😏 Stay tuned for our upcoming video on Azure Virtual WAN for a different way to approach this

[@carstenk7502]

The playlist links in the show notes are broken.

[@AzureAcademy]

Thanks for letting me know. In the description under the video, or a pop up card in the video? Oh, and which one was broken?

[@berkinheisen7924]

Great video. Thank you so much for this learning. Hi Dean, have a question. We have an 8 servers deployment in our environment, and all that servers will be NAT’ed to Azure Firewall for Outbound traffic. However, all of our 8 servers also need to connect to SMTP server which is 3rd Party owned and need to whitelist our requested Public IP. Do I need to request 8 Public IPs for each server and NAT it to the NAT-gateway IP for SMTP outbound traffic? or there’s a way I can route my servers Private IP to Azure firewall via SMTP port 25. Appreciate your great advice. Thanks

[@AzureAcademy]

If the 8 VMs are behind the NAT Gateway or the Azure Firewall then they have a single front end IP already. You do not need a NAT Gateway AND an Azure Firewall in the same flow.

[@berkinheisen7924]

Hi Dean, thank you so much for your response. Would like to confirm. I have 4vms in Prod(Spoke1 ) Environment, and 4 vms in Non-prod(Spoke 2). Would it be best practice for if I will NAT (1) all of the VMs in one NAT gateway IP or (2) per Spoke to NAT GW or (3) per Subnet to NAT GW? This is for the outbound Smtp traffic only. thanks

[@AzureAcademy]

the purpose Is to provide a single public IP for outgoing traffic. You can have multiple subnets behind a single NAT Gateway as well...however, SMTP is outgoing mail server...why would you want a single outgoing IP for this? All VMs have outbound internet without the NAT Gateway...is there some application server they are communicating with that you want to have 1 specific IP to talk to?

[@berkinheisen7924]

Hi Dean, thanks for your time again and appreciate it much. I believe yes. SMTP provider needs a Public IP which a NAT gateway IP is bind for their whitelisting in smtp relay. my servers only have priv IP for security purpose. Yes, plan to NAT servers subnet for each Spokes in a NAT gateway IPs(1 for spoke1 and 1 for spoke2). My other concern is if I’m going to route all of my servers outbound traffic to FW via UDR(0.0.0.0/0 to FW Private-IP), will it affect my servers outgoing traffic on NAT gateway via smtp? Since as I know Azure FW currently does not support outbound smtp traffic.

[@AzureAcademy]

The NAT Gateway is not needed and will not do you any good if you want to use a firewall. The NAT Gateway works but directing all your outbound INTERNET traffic to the NAT Gateway’s dedicated public IP. When you use a firewall, you have to set ups custom route to send your traffic to the firewall, in the case of the internet traffic it is the 0.0.0.0/0 route, like you said. This means that the NAT Gateway will not be able to help you. And there is no point to have a NAT Gateway in front of Firewall, because the firewall also has a dedicated public IP. The Firewall’s public IP will be your dedicated outbound public IP for SMTP traffic that you can whitelist. The firewall doesnt have to specifically support port 25 traffic (but it does by the way 😎) because you are sending port 25 outbound to the internet. The App service on the internet side will only care that it allows port 25 from a public IP address. Example: ip=18.247.65.9 port=25 Allow=$true Does that make sense to you? If you know of something specific in the firewall docs that directly says port 25 CANNOT be used, processed or passed through the firewall I would like to see it ☺️

[@venkataranga5095]

Great Video. I have question, will this work with AppService? I created a VNet and NAT Gateway and did a VNet integration on AppService. But I still see the outbound IP is one of the possible outbound IPs of AppService and not the Public IP tied to NAT Gateway. Thanks In Advance

[@AzureAcademy]

So in your example...did you build an ASE (App Service Environment)

[@venkataranga5095]

Azure Academy not ASE, it is in a premium plan P1V2. We deployed java app and one of the service this app calls required to have a static outbound IP for whitelisting. All example I saw on NAT Gateway are explained using VM but i thought it would still work because we can go VNet integration. Will NAT works only private IP to public IP? Sorry not a networking guy.

[@AzureAcademy]

understood. I have not run into this example before...The NAT Gateway will take all of the VMs on a given subnet and have them all use the same outbound Public IP Address without the need of a firewall or load balancer. I have not used the App Service Premium plan P1V2 you mentioned...so I am not sure. However I can say that in general App Services get their IP addresses from the App Service Plan...which is a cloud based Web Server. Since that is an Azure PaaS I do not think it will work with the NAT Gateway...but the way you can test it. Build a VM on the same subnet that the App service is on. BE SURE TO NOT BUILD A PUBLIC IP ADDRESS FOR THE VM. If you do then it will use that and not the NAT Gateway. Then find out how to get your App Service public IP and compare that to the VMs public IP from an internet source like whatismyipaddress.com/ If they are the same...then it is working. If not then NAT Gateway doesn't support the App Service in that way.

[@AzureAcademy]

+dinesh ranga that’s on the list...stay tuned!

[@richardlphillips]

Great video Dean. I have a WVD deployment and I want to whitelist the wvd servers from MFA. So want a single IP ideally. Can I apply this to a vnet of an existing wvd deployment ? I tried and got "cannot be deployed on subnet containing Basic SKU Public IP addresses or Basic SKU Load Balancer". I didn't want to start messing around in case it broke something 🤔

[@AzureAcademy]

So did you put an Azure load balancer in front of the WVD VMs & give that load balancer a public IP? Load balancers and public ip are to allow and control traffic flow INBOUND, into the VM...the WVD service should be the only way in...this is better security the a public IP. You also cannot force the WVD traffic to use your public IP. As far as the NAT Gateway...this allows a single public ip for all the VMs in a subnet to get out to the internet...but I don’t know if doing that will be able to force all the WVD traffic to the NAT Gateway. What is the purpose of this test?

[@richardlphillips]

@@AzureAcademy Hiya, all i want it outbound internet traffic from WVD hosts to go out an appear from a known IP i can whitelist. Like in your example. I dont want to control inbound traffic to WVD. Once they have connected via the remote desktop client. I want them to fire up a browser and appear from a fixed IP i can add to my MFA whitelist, so teams / onedrive, or going to office.com doesnt give an MFA prompt.

[@richardlphillips]

I think its failing because i have a VPN gateway with a basic public IP SKU on the same subnet

[@AzureAcademy]

oh I see for the outbound traffic from the VM...I believe that should work, although it hasn't been tested to my knowledge...

[@AzureAcademy]

Yeah, the NAT Gateway wants there to only be standard Public IPs 👍

[@ArcaLuiNeo]

Thanks for the video. I was wondering, how does this work with the Azure Firewall because in a way, if you have an Az FW associated through a route table to your subnet, you get the same SNAT benefit?

[@AzureAcademy]

Excellent question Silviu. You are basically correct. The FW IP will be your NAT'd IP. The difference is cost and management. The NatGateway cost is a lot less than the FW because it takes less compute. FW cost = $1.25 per hour + $0.016 per GB NatGW = $0.045 per hour + $0.045 per GB The other side is management. NatGW management is connect it to a subnet FW has multiple rule sets, and now you can use the FW Manager and FW Policy So they both have their place, pick the right tool for your workload.

[@ArcaLuiNeo]

@@AzureAcademy I assumed that the price difference will be an important factor. But I guess that the Route Table rules take precedence over the NatGW.

[@AzureAcademy]

I believe you are correct on the routing

[@sidzhang]

Another great episode, I should spend more time to go through all, this solves my doubt why the source and destination VNET IP range are the same in the MS doc. By the way, does Azure VNET Gateway have similar functionality? I had a customer asking if they could NAT their Azure VNET range from 10.0.0.0/24 to 172.17.0.0/24, while talking to the on-prems offices. It's due to customer's unique policy requirement, I assume there is no such functionality for VNET GW.

[@AzureAcademy]

Nat Gateway is not in internal / private vnet to vnet NAT...yet. Who knows how it will improve over time

[@RAJATRAWAT88]

That is really good explanation Dean, Thanks. I have question. Is this the way we use private subnets in Azure? i.e If I create private subnets, with all vms having private IP address than I will be using NAT gateway for private subnets so that those machines can use the internet? Also can do a video about public and private subnets in cloud and how to implement that in Azure? there is very less information about out there.

[@AzureAcademy]

public subnets is not a correct term in Azure. All IP addressed assigned to resources in an Azure subnet have private IPs (RFC 1918) you can give a resource a public IP address that will allow inbound access from the internet to the resource on the Azure subnet. With the NAT Gateway, this is meant to be used for a static outbound IP address for the VMs instead of the normal SNAT which will change over time WITHOUT using a public IP address. The Nat Gateway is also subnet wide. So all the resources in a subnet can share that outbound NAT'd IP. I hope that clears it up for you 👍

[@RAJATRAWAT88]

@@AzureAcademy Thanks for the reply. Also I just read Azure doc, by default all vms in Azure has outbound connection (Private or Public) so basically private or public subnet is not there in Azure as it is not dependent on subnet bit on resource. Thanks again for the help.

[@AzureAcademy]

correct...EVERY Azure VM is given a Public IP from the SNAT to get out to the internet but this IP will change over time, The Nat Gateway is a way to have all the VMs in the subnet use the same IP...and it won't change. and correct...there is no such concept as public or private subnet. there are public and private IP Addresses and a VM can have both.

[@Yippee1865]

@@AzureAcademy Thanks for clearing that up. I didn't know that...

[@AzureAcademy]

anytime

[@partyateo]

First of all thenk you so much for the video, it helped me a great deal! I have a question, is an Application Gateway compatible with a NAT Gateway?

[@AzureAcademy]

No. NAT Gateway has to do with traffic going out of the vnet, APP Gateway has to do with traffic coming into the vnet

[@partyateo]

Thanks for the answer! I'm asking because accordint to Azure documentation one cannot deploy any other resource of this kind if you have an APP Gateway deployed, we are trying to find a solution to have a static public ip in order to connect to outside application servers (for the ip to be whitelisted) and we thought that NAT gateway could work.

[@AzureAcademy]

No, NAT Gateway is for your VMs to have a single IP address to get out from. You have a single ip for clients over the internet to get to your VMs in Azure You need an Azure Public IP address. If you have multiple computers in Azure They can either all get their own public ip Or If they are part of the same app the. It depends on what network layer the traffic is... Layers 7 is for port 80 and 443 traffic...which would use either APP Gateway or Azure Front Door All other traffic would use the Azure Load Balancer

[@IVOTEBID]

Superb

[@AzureAcademy]

Thank you

[@AftabAli-ys7bp]

Thanks bro, I did this.

[@AzureAcademy]

Awesome! If you have any suggestions for new videos please let me know.

[@pranithad1462]

Nice video.. I have a question. I am really trying hard to understand how to create a public and private subnet?? What makes a subnet public?? How can we say or identify a subnet as public or private?? Please answer..thnq

[@AzureAcademy]

All subnets in Azure are private However if you have a public IP address on a resource in that subnet you have opened public access to that subnet is some way Does that help

[@pranithad1462]

@@AzureAcademy Make sense. Thanks for the reply.

[@AzureAcademy]

👍👍

[@AzureAcademy]

+US World public is where there is inbound internet access into the subnet. Private is where inbound internet access is not allowed. All Azure subnet are private but

[@AzureAcademy]

+US World it’s the VMs is the subnet that are public or private. If a VM has a public IP then the VM is accessible from the internet…

[@erwinadrados4747]

Thanks sir! I'm learning a lot thru your courses. Just want to add, it would be better if you show the ipconfig of "Yet-Another-VM" to show its private IP 192.168.1.4. :) Best regards!

[@AzureAcademy]

Great suggestion...thanks @Erwin

[@erwinadrados4747]

@@AzureAcademy sure thing mate :)

[@AzureAcademy]

👍

[@jerewrig12345]

SNAT is source NAT, not secure NAT :)

[@AzureAcademy]

Thanks for pointing this out. You are correct, however I have heard it both ways. I have also been corrected by the NAT Gateway product owner and wanted to share what he said with everyone, "In NAT there are two fundamental notions. SNAT and DNAT. source and destination address rewrite and more specifically, the SNAT in azure in this case is port masquerading source network address translation. Secure NAT is a bad backronym." sorry for that...and thanks jerewrig12345 for the correction as well.

[@harinarayanan94]

NAT Gateways are awesome , but unfortunately this doesent work with VNET Integrated Webapps , Webapps are a place where we run into SNAT issues a lot and NAT Gateways should be highly beneficial there ... Please pass over to someone at MS who can maybe evaluate this

[@AzureAcademy]

can you provide more details Hari? What would you want it to do? How is it behaving that isn't as you would expect or want?

[@harinarayanan94]

@@AzureAcademy Hi , so when i tie NAT gateway to a subnet which lets say has a Virtual Machine tied to it , then all the outbound calls from the virtual machine will go through the NAT gateways Public IP . When you try to achieve the same using webapps it just dosent work . Let me explain . In Azure Webapps we have a feature called VNET integration which allows us to tie webapps to a subnet . When we do vnet integ of a webapp to a subnet and attatch a NAT gateway to that subnet , still the outbound calls from the webapp happens thought the list of Public IP that the webapp has , while techinally since we have NAT gateway tied i was hoping it would flow through nat gateway PIP as it happens with VM's

[@AzureAcademy]

understood...I will have to look into this further, but sounds like a good feature request from the product teams.