question

David-1424 avatar image
0 Votes"
David-1424 asked GitaraniSharmaMSFT-4262 commented

Route app gateway v2 through NAT gateway

Hi Everyone,

We have an AKS cluster set up with an app gateway. We need both autoscaling (only available in v2) and the ability to route traffic to/from the Internet so that Internet<>App Gateway always hops across the the nat gateway.

In other words, we want the traffic to route:
Ingress: nat gateway public IP > nat gateway > app gateway
Egress: app gateway > nat gateway > nat gateway public IP

And we want to prohibit:
Ingress: Internet > app gateway public IP > app gateway
Egress: app gateway > app gateway public IP > Internet

Since v2 requires a public IP and open ports, we can't simply block all inbound on its public IP and force use of the nat gateway IP as that is not allowed by Azure. I'm thinking this needs to be done with UDRs, but I can't figure how to do it in a way Azure finds acceptable.

Is there a solution for this?

Environment: The nat gateway and app gateway are located in the hub vnet. Each have their own subnet. The AKS cluster is located in a spoke vnet with its own subnet. The two vnets are peered together. Currently the nat gateway and app gateway both have their own public IPs.

Thanks!

azure-application-gateway
· 4
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hello @David-1424 ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

NAT gateway provides outbound internet connectivity for one or more subnets of a virtual network. Inbound initiated traffic is not affected by the addition of NAT gateway.
Refer : https://docs.microsoft.com/en-us/azure/virtual-network/nat-gateway/nat-gateway-resource

NAT gateway can be integrated with AKS as part of cluster creation, so that instances in a private subnet can connect to external services, but external services cannot initiate a connection. This feature is in public preview.
Refer : https://azure.microsoft.com/en-us/updates/public-preview-nat-gateway-integration-with-aks-2/

Could you please us know why Application gateway's Public IP is not preferrable in your inbound traffic flow?

Regards,
Gita

0 Votes 0 ·

Hello @David-1424 ,

I'm following up on my above comment. Could you please provide an update on this post for further discussion?

Regards,
Gita

0 Votes 0 ·

Hello @David-1424 ,

Could you please provide an update on this post for further discussion?

Regards,
Gita

0 Votes 0 ·

Hello @David-1424 , do you have any updates on this issue?

0 Votes 0 ·

0 Answers