Inbound IPv6 support on public multi-tenant App Service has been in public preview for a while now, so we're excited to finally be able to announce that it is now generally available across all public Azure regions, Azure Government, and Microsoft Azure operated by 21Vianet for multi-tenant apps on all Basic, Standard, and Premium SKUs, Functions Consumption, Functions Elastic Premium, and Logic Apps Standard! The limitations called out in the previous blog post have been removed except for IP-SSL IPv6 bindings still not being supported.
How it works
IPv6 inbound requires two things: an IPv6 address that accepts traffic coming in, and a DNS record that returns an IPv6 (AAAA) record. You’ll also need a client that can send and receive IPv6 traffic. This means that you may not be able to test it from your local machine since many networks today only support IPv4.
Our stamps (deployment units) all have IPv6 addresses added, which means you can start sending traffic to both the IPv4 and IPv6 address. To ensure backwards compatibility, the DNS response for the default host name (app-name.azurewebsites.net) will return only the IPv4 address. If you want to change that, we have added a site property called IPMode that you can configure to IPv6 or IPv4AndIPv6. If you set it to IPv6 only, your client will need to “understand” IPv6 in order to get a response. Setting it to IPv4 and IPv6 will allow you to have existing clients use IPv4, but also allow capable clients to use IPv6. If your client does support IPv6, you can test the IPv6 connection using curl:
curl -6 https://<app-name>.azurewebsites.netIf you are using a custom domain, you can define your custom DNS records the same way. If you only add an IPv6 (AAAA) record, your clients will need to support IPv6. You can also choose to add both, and therefore you can use a CNAME to the default hostname of the site, in which case you will use the behavior of IPMode.
IPMode is a DNS-only feature. It's important to understand that with IPv6 now broadly available, every App Service site can receive requests via both IPv4 and IPv6 endpoints—regardless of the configured IpMode. IpMode only influences how DNS resolves the endpoint, so it affects clients that rely on DNS resolution (which should be most clients), but it does not restrict which protocol endpoints can be reached.
To learn more and implement these features, head over to the App Service inbound IPv6 documentation.
Future work
- Coming soon! - Public preview of IPv6 non-vnet outbound support for Linux (multi-tenant) (Windows is already in public preview)
- Backlog - IPv6 vnet outbound support (multi-tenant and App Service Environment v3)
- Backlog - IPv6 vnet inbound support (App Service Environment v3 - both internal and external)
Microsoft