Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Azure Firewall provides 2,496 SNAT ports per public IP address configured per backend virtual machine scale set instance (Minimum of two instances), and you can associate up to 250 public IP addresses. Depending on your architecture and traffic patterns, you might need more than the 1,248,000 available SNAT ports with this configuration. For example, when you use it to protect large Azure Virtual Desktop deployments that integrate with Microsoft 365 Apps.
One of the challenges with using a large number of public IP addresses is when there are downstream IP address filtering requirements. When Azure Firewall is associated with multiple public IP addresses, you need to apply the filtering requirements across all public IP addresses associated with it. Even if you use Public IP address prefixes and you need to associate 250 public IP addresses to meet your outbound SNAT port requirements, you still need to create and allow 16 public IP address prefixes.
A better option to scale and dynamically allocate outbound SNAT ports is to use an Azure NAT Gateway. It provides 64,512 SNAT ports per public IP address and supports up to 16 IPv4 public IP addresses. This effectively provides up to 1,032,192 outbound SNAT ports. Azure NAT Gateway also dynamically allocates SNAT ports on a subnet level, so all the SNAT ports provided by its associated IP addresses is available on demand to provide outbound connectivity.
When you associate a NAT gateway with AzureFirewallSubnet, outbound internet traffic from the firewall uses the NAT gateway's public IP addresses. You don't need an additional user-defined route (UDR) to send that traffic from the firewall through the NAT gateway. Keep the workload subnet routes that direct traffic to the firewall's private IP address for inspection. Response traffic to an outbound flow also passes through the NAT gateway. If multiple public IP addresses are associated with the NAT gateway, it selects an address randomly. You can't specify which address to use.
There’s no double NAT with this architecture. Azure Firewall instances send the traffic to NAT gateway using their private IP address rather than Azure Firewall public IP address.
Choose between multiple public IP addresses and NAT Gateway
When your firewall runs low on SNAT ports, you can either add multiple public IP addresses or use a NAT gateway:
- Add multiple public IP addresses when you're cost sensitive and your scale needs are moderate. Each public IP address adds 2,496 SNAT ports per backend instance, and you can associate up to 250 public IP addresses. For steps, see Deploy an Azure Firewall with multiple public IP addresses.
- Use a NAT gateway when you need dynamic SNAT port allocation across the subnet. It provides up to 64,512 SNAT ports per public IP address.
For a full comparison of advantages and disadvantages, see Best practices for Azure Firewall performance.
To create a StandardV2 NAT gateway as part of an Azure Firewall deployment in the portal, select Enable NAT gateway on the Advanced tab. For the complete procedure, see Create Azure Firewall with a StandardV2 NAT gateway. The following PowerShell and CLI examples associate a Standard NAT gateway with an existing firewall subnet.
Note
Use a StandardV2 NAT gateway with a zone-redundant firewall. A Standard NAT gateway doesn't support zone-redundant deployments. For steps, see Integrate Azure Firewall with NAT Gateway V2. For more information about SKU differences, see NAT Gateway SKUs. Azure NAT Gateway isn't supported inside a secured virtual hub (vWAN). In a vWAN architecture, configure NAT Gateway directly on the spoke virtual networks instead. For steps to integrate NAT Gateway with a firewall in a hub virtual network, see the NAT gateway and Azure Firewall integration tutorial. For more information about Azure Firewall architecture options, see What are the Azure Firewall Manager architecture options?
Associate a NAT gateway with an Azure Firewall subnet - Azure PowerShell
The following example creates and attaches a NAT gateway with an Azure Firewall subnet using Azure PowerShell.
# Create public IP addresses
New-AzPublicIpAddress -Name public-ip-1 -ResourceGroupName nat-rg -Sku Standard -AllocationMethod Static -Location 'South Central US'
New-AzPublicIpAddress -Name public-ip-2 -ResourceGroupName nat-rg -Sku Standard -AllocationMethod Static -Location 'South Central US'
# Create NAT gateway
$PublicIPAddress1 = Get-AzPublicIpAddress -Name public-ip-1 -ResourceGroupName nat-rg
$PublicIPAddress2 = Get-AzPublicIpAddress -Name public-ip-2 -ResourceGroupName nat-rg
New-AzNatGateway -Name firewall-nat -ResourceGroupName nat-rg -PublicIpAddress $PublicIPAddress1,$PublicIPAddress2 -Location 'South Central US' -Sku Standard
# Associate NAT gateway to subnet
$virtualNetwork = Get-AzVirtualNetwork -Name nat-vnet -ResourceGroupName nat-rg
$natGateway = Get-AzNatGateway -Name firewall-nat -ResourceGroupName nat-rg
$firewallSubnet = $virtualNetwork.subnets | Where-Object -Property Name -eq AzureFirewallSubnet
$firewallSubnet.NatGateway = $natGateway
$virtualNetwork | Set-AzVirtualNetwork
Associate a NAT gateway with an Azure Firewall subnet - Azure CLI
The following example creates and attaches a NAT gateway with an Azure Firewall subnet using Azure CLI.
# Create public IP addresses
az network public-ip create --name public-ip-1 --resource-group nat-rg --sku standard
az network public-ip create --name public-ip-2 --resource-group nat-rg --sku standard
# Create NAT gateway
az network nat gateway create --name firewall-nat --resource-group nat-rg --public-ip-addresses public-ip-1 public-ip-2 --sku standard
# Associate NAT gateway to subnet
az network vnet subnet update --name AzureFirewallSubnet --vnet-name nat-vnet --resource-group nat-rg --nat-gateway firewall-nat