Azure PaaS service - Internet Access egress path

Question

Hi,

Please confirm whether access to the Internet from an Azure PaaS service traverses to virtual networks and egress out of the virtual hub core firewall?

Like to understand how the traffic flows in a standard topology.

Thanks

Answer 1

@Sumeetha Mogasati ,

Apologies for the delayed response here.

Depending on how your PaaS services are integrated within the VNET. Like for example based on this architecture where Azure App service and Azure SQL are integrated in a VNET using Private Endpoints you can secure both ingress and egress traffic using an Azure Firewall.

Please let me know if you have any additional questions here.

Answer 2

Hi,

By default, any PaaS service you deploy will take its own service IP to egress out to Internet. For example, in App service you can see the outbound IPs listed which it takes to egress out to Internet.

If you need to flow via VNET, then you will need to make some modifications on the respective PaaS resource to flow via VNET, where you will need to add some route table to force traffic via Firewall / NVA.

Regards,
Karthik Srinivas