Site-to-Site connection with Single IP for ingress and egress traffic

Enrique Gutierrez 0 Reputation points
2024-04-27T13:50:32.75+00:00

Hi. I have a requirement to connect to a SAAS API via Site-to-Site VPN but they only allow one private IP to send and receive the traffic. I have a K8s cluster in AKS and my system has 2 deployments that will be hitting their API, a HTTPS web service and Queue management service for async jobs. Starting there, it will be impossible to have one single IP for egress and ingress, not to mention that multiple pods could be created for high availability (so more pods == more IPs). How can i met this requirement?

Azure Kubernetes Service (AKS)
Azure Kubernetes Service (AKS)
An Azure service that provides serverless Kubernetes, an integrated continuous integration and continuous delivery experience, and enterprise-grade security and governance.
1,877 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Raviraj Nallasivam 170 Reputation points
    2024-04-28T23:52:00.2866667+00:00

    VPN gateway will have one public IP address. AKS clusters services such as HTTPs Web service and Queue management will have virtual network private IP addresses. so, both ingress and egress traffic will flow through public IP address from Azure to SAAS API.

    Please reply if you have more questions.

  2. Anveshreddy Nimmala 2,540 Reputation points Microsoft Vendor
    2024-05-03T04:40:37.2166667+00:00

    Hello Enrique Gutierrez,

    Inbound connections, you typically need to expose your services via a public endpoint.

    Deploy an Azure Application Gateway with WAF (Web Application Firewall) that can be pre-configured with your AKS services.

    The Application Gateway can act as a reverse proxy, directing incoming requests to the appropriate services in your AKS cluster

    Create a azure lb to manage the inbound traffic. point your DNS records to the Load Balancer, which then routes traffic to your services based on the configuration.

    Need to have the VPN gateway configured to accept connections from the SaaS provider’s network and route them appropriately within your VNet.

    configure Network Security Groups and routing tables to ensure that inbound traffic from the VPN is routed to the AGW or ALB, and then to your AKS services.

    Make sure that all outbound traffic from your AKS to the SaaS provider appears to come from a single IP address.

    Hope this helps you

    0 comments