Inbound internet connectivity in Azure VMware Solution

Question

Hi,

I would like to understand the how internet-facing applications running on Azure VMware Solution should be published (inbound internet connectivity).

How inbound internet connectivity enables applications running on Azure VMware Solution (AVS) to be exposed to the internet via public IP addresses

How would I ensure that the applications running on Azure VMware Solution that must be reachable over public IP addresses.

Architecture:

On-prem-Site-to-Site VPN → Hub VNet → Azure Firewall → AVS

Answer 1

To publish internet-facing applications running on Azure VMware Solution (AVS), you need to ensure that these applications are reachable over public IP addresses. This is achieved through a combination of network devices and Azure services that facilitate inbound internet connectivity.

Key Considerations for Inbound Internet Connectivity:

1. Network Virtual Appliances (NVAs): You can use NVAs, such as firewalls and application delivery controllers, either hosted in an Azure virtual network or directly on the AVS. These devices help secure and manage traffic to your applications.
2. Azure Firewall: This is the preferred option for exposing generic TCP or UDP endpoints. To publish an application through Azure Firewall, you need to configure a Destination Network Address Translation (DNAT) rule that maps the firewall's public IP to the private IP of the AVS application. Azure Firewall will translate the source IP addresses of incoming traffic to its own private IP, ensuring that the AVS VMs receive traffic from the firewall's IP.
3. Azure Application Gateway: This service is ideal for HTTP(S) applications. It acts as a reverse proxy and can route HTTP requests to the appropriate backend pools in your AVS. When using Application Gateway, the source IP of the client can be preserved in HTTP headers, allowing your application to access this information if needed.
4. Public IP on NSX-T Data Center Edge: If you're using third-party NVAs deployed on AVS, you need to enable Public IP on the NSX-T Data Center Edge. This associates Azure Public IPs with your private cloud and configures routing for internet traffic to reach your NVAs.

Architecture Example:

In your architecture, where you have an On-prem-Site-to-Site VPN connected to a Hub VNet, followed by Azure Firewall and then to AVS, you would:

• Configure the Azure Firewall with DNAT rules to map public IPs to the private IPs of your AVS applications.
• Ensure that the Azure Firewall is correctly set up to handle incoming traffic and that it routes this traffic to the appropriate NVAs or directly to the AVS applications.

By following these guidelines, you can effectively expose your applications running on Azure VMware Solution to the internet via public IP addresses, ensuring they are reachable as needed.

Answer 2

Hi Kaushal, Pravesh

Thank you for sharing your architecture details (On-prem → Hub VNet → Azure Firewall → AVS). Based on the setup, the issue appears to be that inbound internet traffic is not reaching the AVS workloads. This is typically caused by missing DNAT rules on Azure Firewall, incorrect routing, or NSX firewall blocks within the AVS SDDC.

To expose AVS workloads to the internet, remember that AVS VMs cannot get public IPs directly. They must be published through a service like Azure Firewall DNAT, Application Gateway, or the AVS Public IP feature. In your architecture, Azure Firewall DNAT is the recommended approach.

Reference: https://learn.microsoft.com/en-us/azure/azure-vmware/architecture-design-public-internet-access

Next, review your route tables. The AVS ExpressRoute connection should return traffic through the Azure Firewall. The Hub VNet route table must route 0.0.0.0/0 through the Firewall, and AVS CIDRs should be reachable over ExpressRoute.

Inside the AVS environment, ensure NSX Gateway Firewall and Distributed Firewall rules allow inbound traffic to the workload. Blocking at NSX is one of the most common causes of failed AVS publishing.

Reference: https://learn.microsoft.com/en-us/azure/azure-vmware/enable-public-ip-nsx-edge

Once this is set up, test the flow from outside using tools like telnet publicIP 80 or online port-check utilities, and verify DNAT hits in Azure Firewall logs.

Reference: Filter inbound Internet or intranet traffic with Azure Firewall DNAT using the Azure portal

Hope this helps! Please let me know if you have any queries.