APIM traffic allowed only through Cloudflare WAF

Question

APIM instance has two domains (built-in & custom ). Customer have associated the custom domain with a Cloudflare WAF, so all calls to the custom domin is coming through the WAF. Calls to the built-in domain is directly coming to APIM and we dont have option to disable or delete the builtin domain. So we are thinking of putting the APIM in a VNET external mode - (https://learn.microsoft.com/en-us/azure/api-management/api-management-using-with-vnet?tabs=stv2) and set NSG rules to only allow traffic from Cloudflare IP range. Is this correct approach

Answer 1

@Krishnan Thanks for reaching out. Yes, setting up Azure APIM in a VNET external mode and configuring NSG rules to only allow traffic from the Cloudflare IP range will restrict access to both the custom domain and the built-in domain.

When you configure your API Management instance to use the VNET external mode, it will only be accessible through the VNET subnet that you associate with it. This means that traffic to both the custom domain and the built-in domain will be routed through the VNET subnet and subject to the NSG rules that you configure.

Therefore, if you configure the NSG rules to only allow traffic from the Cloudflare IP range, all traffic to both the custom domain and the built-in domain will be restricted to the Cloudflare IP range.

do let me know incase of further queries, I would be happy to assist you.