IPv6 for App Services

nikize 6

App Services running in Azure
How to get these IPv6 enabled?, also why is it not enabled by default?

We can find several posts that it so far is IPv4 only and that you should set up a IPv6 FrontDoor to get IPv6.
This of course is not acceptable, we need to have IPv6 on the services without extra steps.
If anything it should be the other way around, if you need IPv4, put up a FrontDoor to provide it.

Proof:

dig aaaa waws-prod-db3-001.vip.azurewebsites.windows.net.

or if on windows:

nslookup -type=aaaa waws-prod-db3-001.vip.azurewebsites.windows.net.

x.azurewebsites.net. IN CNAME waws-prod-db3-001.vip.azurewebsites.windows.net.  
waws-prod-db3-001.vip.azurewebsites.windows.net. IN CNAME waws-prod-db3-001.cloudapp.net.

Note the missing AAAA record here.

Azure needs to get this on v6 and fix AAAA records. (work arounds thru frontdoors or proxies are not acceptable)

No Tags available for app-services? or IPv6.
Similar post from 2019: https://learn.microsoft.com/en-us/answers/questions/2133/ipv6-supported-by-app-service.html
Different post from this year, with an accepted answer that is unacceptable as described above: https://learn.microsoft.com/en-us/answers/questions/587342/doesn39t-azure-web-application-support-ipv6.html

M-21-07 Mandates that all US gov move towards IPv6 only, this puts Microsoft and Azure in a spot where they have to support it or otherwise not have them as customers.

1 answer

ajkuma 22,401 Reputation points Microsoft Employee

2021-12-28T20:01:23.017+00:00

nikize, my humble apologies, IPv6 is still not supported on App Service. I completely understand this not the answer you wanted hear, we regret any inconvenience with this.

Our product engineering is working on it, but there is no ETA to share on this yet.

Please be assured that I have relayed your feedback to our product team internally.

If you wish you may always share your feedback on our [Uservoice][1] as well- All of the feedback you share in these forums will be monitored and reviewed by the Microsoft engineering teams responsible for building Azure. Also, Users with a similar request, can up-vote you post and add their comment.

We appreciate your valuable feedback.

-PS. You have posted the question on the right tag(s) [azure-webapps]/

[1] : https://feedback.azure.com/d365community/forum/b09330d1-c625-ec11-b6e6-000d3a4f0f1c?page=1&sort=most-votes
Please sign in to rate this answer.

1 person found this answer helpful.
nikize 6 Reputation points

2021-12-28T20:26:52.14+00:00

Well, after searching and looking around a bit and finding: https://feedback.azure.com/d365community/idea/a8cec51b-8826-ec11-b6e6-000d3a4f0789
That says 6 years ago. ;)

ajkuma 22,401 Reputation points Microsoft Employee

2021-12-29T12:06:01.223+00:00

nikize, Thanks for sharing the Uservoice URL. Yes, we have been receiving feedback for enabling IPv6 for all the Azure services, specially Azure WebApps.
-I'll further follow-up with our product team internally, in case there are any updates sooner from the team, will share it here.

Much appreciate your valuable feedback. Thanks, again.

Bell E 21 Reputation points

2022-06-20T14:38:59.21+00:00

Hi there,
Any news regarding this important topic?
We developed several services exclusively on Azure, among which App Services and now, due to this limitation on IPV6, our clients are asking us to explore some other services...
We are not keen on migrating/deploying somewhere else just for IPV6 ....
Any news on ETA?

Thanks a lot for your help and concern!

ajkuma 22,401 Reputation points Microsoft Employee

2022-06-22T20:18:24.657+00:00

BellE-9056, Thanks for the follow-up. I did follow-up on this internally, we still do not have a concrete ETA to share. Apologies for the long wait time on this, thanks for your patience! As soon as we have more updates, we will share it here, as well update on the Uservoice and other applicable Azure docs.

Bell E 21 Reputation points

2022-06-24T15:37:01.62+00:00

Dear Ajkuma,
Thanks a lot for your feedback ! And really sorry to hear that...
Would it be possible to obtain a broad idea on ETA, is it a matter of months, years ? Or you do not have any idea regarding this, maybe?
What would be the recommended way to circumvent this limitation according to you?
Thanks a lot for your help and attention.

ajkuma 22,401 Reputation points Microsoft Employee

2022-07-01T20:13:42.297+00:00

BellE-9056, Apologies we do not have a ballpark estimate that can be shared. I understand this not the answer you wanted hear, As soon as I have more updates, I'll share it here + our product/author team would update the appropriate docs/articles.

You may leverage Azure Front Door service for inbound, kindly see this doc- https://learn.microsoft.com/azure/frontdoor/front-door-overview

If you wish, you may keep a tab on these, for updates:

Azure updates - To get the latest updates on Azure products and features. Subscribe to notifications to stay informed

Azure Announcements - Check out upcoming changes to Azure Products. Subscribe to notifications to stay informed

Azure App Service | blog and Azure App Service Team Blog

nikize 6 Reputation points

2022-07-02T07:59:15.527+00:00

Frontdoor uses traffic manager.
Lets not forget that the traffic manager dns configuration is broken. See https://learn.microsoft.com/en-us/answers/questions/640940/enable-ipv6-on-azure-cdn-azureedgenet.html#answer-container-646841

The DNS servers for trafficmanager does not have IPv6, and MS team on this claims that "every recursive DNS server has legacy-v4 access, so there is no issue" this is simply not true.

So no, this is not a valid solution, connectivity breaks with that setup.

Could we get a clear answer on to why you simply don't stick a v6 on each appservice by default?
This would also resolve the requirement for you to comply with US gov M-21-07 mandate.

nikize 6 Reputation points

2022-07-04T13:07:24.98+00:00

In a different topic https://learn.microsoft.com/en-us/answers/questions/640940/enable-ipv6-on-azure-cdn-azureedgenet.html?childToView=913227#comment-913227 @Patrick O'Brien

The reality however is that many services do not and will not support IPv6 natively for the short-term to medium-term.

So I would have to assume that this is several years, if not decades away. (If Azure is still alive at that time)

Patrick O'Brien 6 Reputation points Microsoft Employee

2022-07-04T13:54:05.517+00:00

Native support for ipv6 inbound for App Services would be indeterminate ETA. However, there are other Azure services that can be used in parallel to achieve this and Azure has government workloads which have been evaluated as compliant. I understand the concern about DNS behavior described above, my response would be that historically we have government users which have met this mandate using Azure services in the current design.

Since the feedback item you noted above posted 6 years ago, there have been numerous new features regarding IPv6 for various services. Investment is being done in this area, although we do not consider the absence of ipv6 inbound to App Services to be a strict blocker for any workload due to the options available.

We do appreciate and understand the feedback. I have been and will continue to be an advocate for this feature internally. We hope that all users can be successful on Azure.

nikize 6 Reputation points

2022-07-04T14:26:59.543+00:00

The specific issue that is 6 years old, is still not fixed.
This DOES NOT conform to the mandate, someone missed this v4 only point when checking, or did not check the DNS flow at all, just that the host itself had v6.

At least fix the TM DNS issue so at least that works.

The only other option is to run your own reverse proxy in a VM using VNET, but even that is broken to some extent, with v6 we should not need to have NAT or other messy intermediate private network. That is not how the internet is supposed to work, and absolutely not v6.

I appreciate your advocacy, but I start to fell it is to many things, in to many places that is simply broken, to take another example, Office 365 does not seem to be able to deliver emails to a v6 only MX, so that is broken as well.

ajkuma 22,401 Reputation points Microsoft Employee

2022-07-05T19:28:30.207+00:00

Thanks for sharing additional details. We have followed-up further with our Networking PG and relayed the feedback. Once again, we greatly value your feedback, and appreciate your patience in this regard.
Sign in to comment