How to fix outbound IPs for App Service

Published May 04 2021 10:05 AM 6,836 Views
Microsoft

App Service are powerful features to retrieve Azure computer resources as PaaS platform. In other hands, PaaS is shared services for multi-tenant, so it might be caused as issues to collaborate with legacy applications. As one of such issues, external services sometimes require to fixed IP addresses from your applications. It was not allowed to fix outbound IPs for App Service except for App Service Environment in past, because the IPs are randomly selected by runtime from assigned ones like below.

daisami_0-1620117755181.png

In addition that, the outbound IPs might be changed. Refer to Inbound and outbound IP addresses in Azure App Service for the detail.

 

Here is brief architecture to fix outbound IPs for App Service. It's required to utilize NAT Gateway and VNet Integration of App Service. You can fix outbound IP as Public IP on NAT Gateway by using this architecture. 

daisami_0-1620116452111.png

Follow steps below to setup.

  1. Create VNET and NAT Gateway
  2. Associate NAT Gateway to a subnet 
  3. Enable VNet Integration
  4. Setup WEBSITE_VNET_ROUTE_ALL = 1
  5. Confirm outbound IP with Kudu

You can setup to fix outbound IP on your App Service by following this post. NAT Gateway usage also brings other great benefit that you can avoid intermittent outbound connection errors caused by SNAT ports.

 

1. Create VNET and NAT Gateway

Follow Quickstart: Create a virtual network using the Azure portal to create a VNET.  Next, Create NAT Gateway by following Tutorial: Create a NAT gateway using the Azure portal. It's required to specify Public IP like below and the Public IP will be an outbound IP for your App Service.

daisami_2-1620117141032.png

 

2. Associate NAT Gateway to a subnet 

It's required to integrate your App Service with VNET to utilize NAT Gateway, so visit your NAT Gateway and choose "Subnets" menu from left side. Choose a subnet which your will enable VNet Integration for your App Service in later.

daisami_3-1620117390926.png

 

3. Enable VNet Integration

Visit your App Service and enable VNet Integration by choosing a subnet which you have already associated NAT Gateway.

daisami_1-1620117996877.png

 

4. Setup WEBSITE_VNET_ROUTE_ALL = 1

Next, it's also required to route all your outbound traffic to your VNET, so visit your App Service and choose configuration menu from left side. Put WEBSITE_VNET_ROUTE_ALL = 1 like below. Refer to Integrate your app with an Azure virtual network for the detail.

daisami_2-1620118481867.png

 

5. Confirm outbound IP with Kudu

App Service offers useful feature as Kudu not only development usage. Visit your App Service and open Kudu on it. Run curl command and you can confirm returned IP is same with Public IP on your NAT Gateway.

daisami_1-1620119284693.png

 

%3CLINGO-SUB%20id%3D%22lingo-sub-2320612%22%20slang%3D%22en-US%22%3EHow%20to%20fix%20outbound%20IPs%20for%20App%20Service%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2320612%22%20slang%3D%22en-US%22%3E%3CP%3EApp%20Service%20are%20powerful%20features%20to%20retrieve%20Azure%20computer%20resources%20as%20PaaS%20platform.%20In%20other%20hands%2C%20PaaS%20is%20shared%20services%20for%20multi-tenant%2C%20so%20it%20might%20be%20caused%20as%20issues%20to%20collaborate%20with%20legacy%20applications.%20As%20one%20of%20such%20issues%2C%20external%20services%20sometimes%20require%20to%20fixed%20IP%20addresses%20from%20your%20applications.%20It%20%3CSTRONG%3Ewas%3C%2FSTRONG%3E%20not%20allowed%20to%20fix%20outbound%20IPs%20for%20App%20Service%20except%20for%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fapp-service%2Fenvironment%2Fintro%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3EApp%20Service%20Environment%3C%2FA%3E%20in%20past%2C%20because%20the%20IPs%20are%20randomly%20selected%20by%20runtime%20from%20assigned%20ones%20like%20below.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22daisami_0-1620117755181.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F277787iB7968EFBBAEDD162%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22daisami_0-1620117755181.png%22%20alt%3D%22daisami_0-1620117755181.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EIn%20addition%20that%2C%20the%20outbound%20IPs%20might%20be%20changed.%20Refer%20to%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fapp-service%2Foverview-inbound-outbound-ips%23when-outbound-ips-change%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3EInbound%20and%20outbound%20IP%20addresses%20in%20Azure%20App%20Service%3C%2FA%3E%26nbsp%3Bfor%20the%20detail.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHere%20is%20brief%20architecture%20to%20fix%20outbound%20IPs%20for%20App%20Service.%20It's%20required%20to%20utilize%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fvpn-gateway%2Fvpn-gateway-about-vpngateways%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3ENAT%20Gateway%3C%2FA%3E%26nbsp%3Band%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fapp-service%2Fweb-sites-integrate-with-vnet%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3EVNet%20Integration%3C%2FA%3E%20of%20App%20Service.%20You%20can%20fix%20outbound%20IP%20as%20Public%20IP%20on%20NAT%20Gateway%20by%20using%20this%20architecture.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22daisami_0-1620116452111.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F277779i728A9F5DFD471A5E%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22daisami_0-1620116452111.png%22%20alt%3D%22daisami_0-1620116452111.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EFollow%20steps%20below%20to%20setup.%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3ECreate%20VNET%20and%20NAT%20Gateway%3C%2FLI%3E%0A%3CLI%3EAssociate%26nbsp%3BNAT%20Gateway%20to%20a%20subnet%26nbsp%3B%3C%2FLI%3E%0A%3CLI%3EEnable%20VNet%20Integration%3C%2FLI%3E%0A%3CLI%3ESetup%26nbsp%3BWEBSITE_VNET_ROUTE_ALL%20%3D%201%3C%2FLI%3E%0A%3CLI%3EConfirm%20outbound%20IP%20with%20Kudu%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3EYou%20can%20setup%20to%20fix%20outbound%20IP%20on%20your%20App%20Service%20by%20following%20this%20post.%20NAT%20Gateway%20usage%20also%20brings%20other%20great%20benefit%20that%20you%20can%20avoid%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fapp-service%2Ftroubleshoot-intermittent-outbound-connection-errors%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3Eintermittent%20outbound%20connection%20errors%20caused%20by%20SNAT%20ports%3C%2FA%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E1.%26nbsp%3BCreate%20VNET%20and%20NAT%20Gateway%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3EFollow%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fvirtual-network%2Fquick-create-portal%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3EQuickstart%3A%20Create%20a%20virtual%20network%20using%20the%20Azure%20portal%3C%2FA%3E%20to%20create%20a%20VNET.%26nbsp%3B%20Next%2C%20Create%20NAT%20Gateway%20by%20following%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fvirtual-network%2Ftutorial-create-nat-gateway-portal%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3ETutorial%3A%20Create%20a%20NAT%20gateway%20using%20the%20Azure%20portal%3C%2FA%3E.%20It's%20required%20to%20specify%20Public%20IP%20like%20below%20and%20the%20Public%20IP%20will%20be%20an%20outbound%20IP%20for%20your%20App%20Service.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22daisami_2-1620117141032.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F277783i95A4F9BA76FFCABB%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22daisami_2-1620117141032.png%22%20alt%3D%22daisami_2-1620117141032.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E2.%26nbsp%3BAssociate%26nbsp%3BNAT%20Gateway%20to%20a%20subnet%26nbsp%3B%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3EIt's%20required%20to%20integrate%20your%20App%20Service%20with%20VNET%20to%20utilize%20NAT%20Gateway%2C%20so%20visit%20your%20NAT%20Gateway%20and%20choose%20%22Subnets%22%20menu%20from%20left%20side.%20Choose%20a%20subnet%20which%20your%20will%20enable%20VNet%20Integration%20for%20your%20App%20Service%20in%20later.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22daisami_3-1620117390926.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F277785iAF8C4A3D5EC3D805%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22daisami_3-1620117390926.png%22%20alt%3D%22daisami_3-1620117390926.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E3.%26nbsp%3BEnable%20VNet%20Integration%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3EVisit%20your%20App%20Service%20and%20enable%20VNet%20Integration%20by%20choosing%20a%20subnet%20which%20you%20have%20already%20associated%20NAT%20Gateway.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22daisami_1-1620117996877.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F277788iB4F8326C8111DF60%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22daisami_1-1620117996877.png%22%20alt%3D%22daisami_1-1620117996877.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E4.%26nbsp%3BSetup%26nbsp%3BWEBSITE_VNET_ROUTE_ALL%20%3D%201%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3ENext%2C%20it's%20also%20required%20to%20route%20all%20your%20outbound%20traffic%20to%20your%20VNET%2C%20so%20v%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%3Eisit%20your%20App%20Service%20and%20choose%20configuration%20menu%20from%20left%20side.%20Put%26nbsp%3BWEBSITE_VNET_ROUTE_ALL%20%3D%201%20like%20below.%20Refer%20to%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fapp-service%2Fweb-sites-integrate-with-vnet%23troubleshooting%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3EIntegrate%20your%20app%20with%20an%20Azure%20virtual%20network%3C%2FA%3E%20for%20the%20detail.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22daisami_2-1620118481867.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F277793i03585817C3D24A5A%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22daisami_2-1620118481867.png%22%20alt%3D%22daisami_2-1620118481867.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E5.%26nbsp%3BConfirm%20outbound%20IP%20with%20Kudu%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%3EApp%20Service%20offers%20useful%20feature%20as%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fapp-service%2Fresources-kudu%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3EKudu%3C%2FA%3E%20not%20only%20development%20usage.%20Visit%20your%20App%20Service%20and%20open%20Kudu%20on%20it.%20Run%20curl%20command%20and%20you%20can%20confirm%20returned%20IP%20is%20same%20with%20Public%20IP%20on%20your%20NAT%20Gateway.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22daisami_1-1620119284693.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F277799i18AF204550E9ED2F%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22daisami_1-1620119284693.png%22%20alt%3D%22daisami_1-1620119284693.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-2320612%22%20slang%3D%22en-US%22%3E%3CP%3EApp%20Service%20are%20powerful%20features%20to%20retrieve%20Azure%20computer%20resources%20as%20PaaS%20platform.%20In%20other%20hands%2C%20PaaS%20is%20shared%20services%20for%20multi-tenant%2C%20so%20it%20might%20be%20caused%20as%20issues%20to%20collaborate%20with%20legacy%20applications.%20As%20one%20of%20such%20issues%2C%20external%20services%20sometimes%20require%20to%20fixed%20IP%20addresses%20from%20your%20applications.%20You%20can%20acquire%20knowledge%20how%20to%20meet%20such%20requirement%20with%20this%20post.%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2320612%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20App%20Service%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Version history
Last update:
‎Jun 04 2021 10:57 AM
Updated by: