API Management - Networking FAQs (Demystifying Series I)

sathishkumartlb · ‎Jul 01 2020

API Management – Networking FAQs

(Demystifying series I)

This article includes frequently asked questions about API Management while configuring it with Azure networking components such as VNET, NSG and route tables.

If you feel there are more topics to be covered under the demystifying series, let us know in the comments section.

FAQ Index:

Network Security Group (NSG):

1. What is NSG? Purpose of NSG?

Azure network security group is used to filter network traffic to and from Azure resources in an Azure virtual network. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources. For each rule, you can specify source and destination, port, and protocol.

2. Scenarios for using NSG with API Management

When an API Management is configured with a VNET, Network Security Group plays a vital role in allowing inbound and outbound traffic into the subnet in which API Management is deployed. You would not want all the resources within or outside the VNET to access the API Management and in that case you can configure a NSG at the API Management subnet level and allow/deny the desired ports/IPs.

3. Scenario: The APIs in API Management shows loading, and the APIs never show up

Configuration:

In internal mode, an API Management service is hosted in a dedicated subnet of a VNET. This subnet must have a Network Security Group associated with it. Network Security Groups have default inbound and outbound security rules.

Symptoms:

Navigate to the APIs section under API Management and open browser developer tools. In the console section, you will see a similar message based on the screenshot below.

Error message:

{"code":"ManagementApiRequestFailed","message":"Failed to connect to Management endpoint <your_apim_instance_name>.azure-api.net:3443 for a service deployed in a Virtual Network. Make sure to follow guidance at https://aka.ms/apim-vnet-common-issues.","details":null,"innerError":null}

Troubleshooting:

The error message clearly states that the API Management endpoint is not reachable, hence it is not able to fetch the resources of the APIs. Allowing Management endpoint traffic on port 3443 in inbound security rule of NSG should resolve the issue

Additional Information:

4. What are the mandatory inbound and outbound rules in NSG for API Management?

There are few mandatory ports which needs to be configured under the inbound and the outbound rules of the NSG for the proper functioning of API Management.

Source port	Destination port	Direction	Source Service tag	Destination service tag
*	3443	Inbound	API Management	Virtual Network
*	80, 443	Inbound	Internet	Virtual Network
*	443	Outbound	Virtual Network	Storage
*	1443	Outbound	Virtual Network	SQL

NSG Inbound rules: (default)

[The default NSG inbound rules]

NSG Inbound rules: (creation)

[While creating an NSG inbound rule, make sure to select the service tag option under source to get the following parameters]

NSG Inbound rules: (custom)

[The highlighted rules are the custom NSG inbound rules added. Note that the priority of these rules must be higher than that of the default rules]

NSG Outbound rules: (default)

[The default NSG outbound rules]

NSG Outbound rules: (creation)

[While creating an NSG outbound rule, make sure to select the service tag option under destination to get the following parameters]

NSG Outbound rules: (custom)

[The highlighted rules are the custom NSG outbound rules added. Note that the priority of these rules must be higher than that of the default rules]

The port 3443 is associated with the Management endpoint. A load balanced public IP address (VIP) will also be reserved to provide access to the Management service endpoint over port 3443. The public IP address is used only for control plane traffic to the Management endpoint over port 3443 and can be locked down to the API Management service tag.

The Azure Storage account connectivity is required in the outbound rules to store the API Management operation and data. This is the point where it is cached and retried for API Management.

Note: We don't need to explicitly allow outbound connection in NSG. 
It is allowed by default. 
In case of any Deny rule in the outbound section, then the above mentioned two outbound ports must be allowed explicitly with a higher priority.

5. Recommendation for NSG at the API Management level

All Incoming/outgoing traffic for the service goes through Azure Load balancer. So, at the minimum, it is required to allow incoming port 80, 443, 3443 and any outgoing ports that are required by their (APIM) backend. We recommend all ports as if you created a new API that connects to a backend over a non-standard port, that would fail unless the port is opened up for Azure Load Balancer.

The security rule for Azure Load balancer must be configured as shown in the below screenshot.

6. What if I still face the management endpoint issue?

In case if you are still facing an issue though the NSG rules are configured as per the documentation, then the best practice at this point is to remove the NSG associated with the subnet under which the APIM is present. Save the changes at the VNET and then go to the respective APIM instance ->Virtual Network -> Click on ‘Apply Network Configuration’, once it is completed the network changes must be effective at the APIM level.

If the issue is still occurring, then the cause is not the NSG, if you do not see the management endpoint issue once the NSG is disassociated, then it was the NSG configuration which was causing the issue and it is recommended to consult with your network team to understand what might be causing the issue. Kindly raise a support ticket if the issue persists.

User Defined Route (UDR):

1. What is UDR? Purpose of UDR?

Azure routes outbound traffic from a subnet based on the routes in a subnet's route table. Azure automatically creates system routes and assigns the routes to each subnet in a virtual network. You can't create system routes, nor can you remove system routes. There are scenarios where the system routes will not be sufficient to fulfill the requirement and in order to establish a connection/request-flow, we will need to over-ride the default routes using custom routes. You can achieve this using User Defined Routes concept.

2. How can UDR be configured with API Management?

UDR can control only the outbound traffic from the subnet. When the API Management is configured in a subnet, route table can be associated with that subnet. The route table will have user-defined routes (UDR) to determine the next hop type for a particular address prefix.

[The above screenshot shows the subnet in which the API Management is configured. The subnet contains the address range, NSG and a Route Table (UDR)].

3. Why my APIs are not loading when the API Management is configured in a VNET?

Scenario:

The API management service is hosted in an internal mode and the APIs under the API Management are not showing up and keep loading forever. The below screenshot shows a sample of the issue scenario and what the console section of the browser developer tools read. [Refer to the screenshot from 3rd point under NSG]