Enable Public IP to the NSX Edge for Azure VMware Solution

In this article, you'll learn how to enable Public IP to the NSX Edge for your Azure VMware Solution.

Tip

Before you enable Internet access to your Azure VMware Solution, review the Internet connectivity design considerations.

Public IP to the NSX Edge is a feature in Azure VMware Solution that enables inbound and outbound internet access for your Azure VMware Solution environment.

Important

The use of Public IPv4 addresses can be consumed directly in Azure VMware Solution and charged based on the Public IPv4 prefix shown on Pricing - Virtual Machine IP Address Options..

The Public IP is configured in Azure VMware Solution through the Azure portal and the NSX-T Data center interface within your Azure VMware Solution private cloud.

With this capability, you have the following features:

  • A cohesive and simplified experience for reserving and using a Public IP down to the NSX Edge.
  • The ability to receive up to 1000 or more Public IPs, enabling Internet access at scale.
  • Inbound and outbound internet access for your workload VMs.
  • DDoS Security protection against network traffic in and out of the Internet.
  • HCX Migration support over the Public Internet.

Reference architecture

The architecture shows Internet access to and from your Azure VMware Solution private cloud using a Public IP directly to the NSX Edge. Diagram that shows architecture of Internet access to and from your Azure VMware Solution Private Cloud using a Public IP directly to the NSX Edge.

Configure a Public IP in the Azure portal

  1. Log on to the Azure portal.
  2. Search for and select Azure VMware Solution.
  3. Select the Azure VMware Solution private cloud.
  4. In the left navigation, under Workload Networking, select Internet connectivity.
  5. Select the Connect using Public IP down to the NSX-T Edge button.

Tip

Before selecting a Public IP, ensure you understand the implications to your existing environment. For more information, see Internet connectivity design considerations.

  1. Select Public IP. Diagram that shows how to select public IP to the NSX Edge

  2. Enter the Public IP name and select a subnet size from the Address space dropdown and select Configure.

  3. This Public IP should be configured within 20 minutes and will show the subnet. Diagram that shows Internet connectivity in Azure VMware Solution.

  4. If you don't see the subnet, refresh the list. If the refresh fails, try the configuration again.

  5. After configuring the Public IP, select the Connect using the Public IP down to the NSX-T Edge checkbox to disable all other Internet options.

  6. Select Save.

You have successfully enabled Internet connectivity for your Azure VMware Solution private cloud and reserved a Microsoft allocated Public IP. You can now configure this Public IP down to the NSX Edge for your workloads. The NSX-T Datacenter is used for all VM communication. There are several options for configuring your reserved Public IP down to the NSX Edge.

There are three options for configuring your reserved Public IP down to the NSX Edge: Outbound Internet Access for VMs, Inbound Internet Access for VMs, and Gateway Firewall used to Filter Traffic to VMs at T1 Gateways.

Outbound Internet access for VMs

A Sourced Network Translation Service (SNAT) with Port Address Translation (PAT) is used to allow many VMs to one SNAT service. This connection means you can provide Internet connectivity for many VMs.

Important

To enable SNAT for your specified address ranges, you must configure a gateway firewall rule and SNAT for the specific address ranges you desire. If you don't want SNAT enabled for specific address ranges, you must create a No-NAT rule for the address ranges to exclude. For your SNAT service to work as expected, the No-NAT rule should be a lower priority than the SNAT rule.

Add rule

  1. From your Azure VMware Solution private cloud, select vCenter Credentials
  2. Locate your NSX-T URL and credentials.
  3. Log in to VMWare NSX-T.
  4. Navigate to NAT Rules.
  5. Select the T1 Router.
  6. Select ADD NAT RULE.

Configure rule

  1. Enter a name.
  2. Select SNAT.
  3. Optionally, enter a source such as a subnet to SNAT or destination.
  4. Enter the translated IP. This IP is from the range of Public IPs you reserved from the Azure VMware Solution Portal.
  5. Optionally, give the rule a higher priority number. This prioritization will move the rule further down the rule list to ensure more specific rules are matched first.
  6. Click SAVE.

Logging can be enabled by way of the logging slider. For more information on NSX-T NAT configuration and options, see the NSX-T NAT Administration Guide

No NAT rule for specific address ranges

A No NAT rule can be used to exclude certain matches from performing Network Address Translation. This policy can be used to allow private IP traffic to bypass the NAT rule.

  1. From your Azure VMware Solution private cloud, select vCenter Credentials.
  2. Locate your NSX-T URL and credentials.
  3. Log in to VMWare NSX-T and then select NAT Rules.
  4. Select the T1 Router and then select ADD NAT RULE.
  5. The Source IP is the range of addreses you do not want to be translated and Destination IP is the range of IP addresses that you do not want the "Source IP" to reach.
  6. Select SAVE.

Inbound Internet Access for VMs

A Destination Network Translation Service (DNAT) is used to expose a VM on a specific Public IP address and/or a specific port. This service provides inbound internet access to your workload VMs.

Log in VMware NSX-T

  1. From your Azure VMware Solution private cloud, select VMware credentials.
  2. Locate your NSX-T URL and credentials.
  3. Log in to VMware NSX-T.

Configure the DNAT rule

  1. Name the rule.
  2. Select DNAT as the action.
  3. Enter the reserved Public IP in the destination match. This IP is from the range of Public IPs reserved from the Azure VMware Solution Portal.
  4. Enter the VM Private IP in the translated IP.
  5. Select SAVE.
  6. Optionally, configure the Translated Port or source IP for more specific matches.

The VM is now exposed to the internet on the specific Public IP and/or specific ports.

Gateway Firewall used to filter traffic to VMs at T1 Gateways

You can provide security protection for your network traffic in and out of the public internet through your Gateway Firewall.

  1. From your Azure VMware Solution Private Cloud, select VMware credentials.

  2. Locate your NSX-T URL and credentials.

  3. Log in to VMware NSX-T.

  4. From the NSX-T home screen, select Gateway Policies.

  5. Select Gateway Specific Rules, choose the T1 Gateway and select ADD POLICY.

  6. Select New Policy and enter a policy name.

  7. Select the Policy and select ADD RULE.

  8. Configure the rule.

    1. Select New Rule.
    2. Enter a descriptive name.
    3. Configure the source, destination, services, and action.
  9. Select Match External Address to apply firewall rules to the external address of a NAT rule.

For example, the following rule is set to Match External Address, and this setting will allow SSH traffic inbound to the Public IP. Screenshot Internet connectivity inbound Public IP.

If Match Internal Address was specified, the destination would be the internal or private IP address of the VM. For more information on the NSX-T Gateway Firewall see the NSX-T Gateway Firewall Administration Guide The Distributed Firewall could be used to filter traffic to VMs. This feature is outside the scope of this document. For more information, see NSX-T Distributed Firewall Administration Guide.

Next steps

Internet connectivity design considerations (Preview)

Enable Managed SNAT for Azure VMware Solution Workloads (Preview)

Disable Internet access or enable a default route

Enable HCX access over the internet