Azure API Management - Vnet External mode - Gateway URL & Portal not reachable from internet, required FW openings?

Question

I'm setting up API Management in Vnet, external mode.

For internal mode you can setup Application Gateway to expose selected internal API's to external users. and the documentation goes in much more depth on how to do this compared to external mode. There are also plenty of guides on the internet using internal mode.

So how does this work with External mode? Right now the Gateway URL and Developer portal is getting blocked in the firewall (hub-spoke architecture)
The URL is inaccessible from both Internet and from within the network, as the gateway URL in external mode is on the publicly faced LB.

If I route the traffic outside the FW (route-table) it works fine with NSG using required inbound rules (Internet-tag) and default outbound.

So to my question: Am I supposed to allow outbound traffic from the vnet to Internet in FW/route-table as well so the gateway & portal is reachable by anyone?
Is that the whole point of using external mode?

In this thread a Microsoft representative says it's the Public IP of APIM that should be whitelisted in the FW, which also is nowhere to be found in the documentation

https://social.msdn.microsoft.com/Forums/en-US/214a91c4-3b8c-4fff-9b94-596a187e271d/ip-address-of-api-management-connected-to-vnet-in-external-mode?forum=azureapimgmt

Thanks in advance, any info on this is appreciated

Answer 1

Hello @Nikolai - I'll review and update you here.