Expressroute NAT options

Copper Contributor

I am about to get an express route connection put in from a customer network with a fixed set of IP v4 addresses, lets say I need to map specific IP addresses from this range to different services in different subscriptions with their own Virtual networks.


I will have the expressroute connection in it's own Subscription "ER" (Virtual network address space and the services in other seperate subscriptions "SUB1" (Virtual network address space and "SUB2" (Virtual network address space


1) When configuring Azure Private peering in expressroute I would expect to get the ASN and VLAN from the provider, but do I use 2 smaller subnets of the range in the Azure primary and secondary subnet or other completely different private subnets?


2) Once I have peered the Virtual networks into the ER address space they show up under peered virtual network address space in the ER Virtual network address space.


3) I can connect outbound through expressroute from VM1 ( on SUB1 and VM2  ( on SUB2


4) How do I NAT inbound to VM1  and NAT to VM2 on Port 3389.


If it needs Azure firewall to do this to I put it in the ER SUB or a firewall in each of the SUB1 and SUB2 subscriptions?



2 Replies





I looked at that but assumed this is the customer side of the expressroute which I have no access to and they have also said they won't do any NAT on their side.

I have to do the NAT from within Azure.