DMZ design options in Azure VMware Solution (AVS) generation 2

Question

DMZ design options in Azure VMware Solution (AVS) generation 2

Kaushal, Pravesh 125

Hello everyone,

I am looking into DMZ design options in Azure VMware Solution (AVS) generation 2. Is it recommended to use a dedicated Tier-1 gateway for the DMZ, or should both Tier-0 and Tier-1 gateways be dedicated for a DMZ setup in AVS?

Regards

Pravesh

Manish Deshpande 8,135 Reputation points Microsoft External Staff Moderator

2026-02-10T20:17:32.3233333+00:00

Hello Kaushal, Pravesh

I wanted to check if my last response made sense. I’d be glad to assist further or explain anything in more detail and please accept as Yes and upvote if the answer is helpful so that it can help others in the community.

Answer accepted by question author

Manish Deshpande 8,135 Microsoft External Staff Moderator

Hello Kaushal, Pravesh

Thank you for contacting us about the VM ware issue.

In Azure VMware Solution (AVS) Generation 2, the recommended and supported DMZ design is to use a dedicated Tier‑1 gateway for the DMZ, while continuing to use the default Microsoft‑managed Tier‑0 gateway.

A dedicated Tier‑0 gateway for DMZ is neither required nor supported in AVS Gen 2.

Why dedicated Teir 1 gateway is the right design:

In AVS:

The Tier‑0 (T0) gateway is fully Microsoft‑managed
Customers cannot create or dedicate their own Tier‑0 gateways
Tier‑0 provides north‑south connectivity (Azure, internet, on‑premises)
Tier‑1 (T1) gateways are customer‑managed and intended for workload isolation

Because of this architecture, DMZ isolation is achieved at the Tier‑1 layer, not Tier‑0.

This model has been successfully implemented in multiple AVS Gen 2 customer DMZ deployments, including internet‑facing workloads and hub‑and‑spoke topologies.

https://bogdanburuiana.com/index.php/2023/11/23/azure-vmware-solution-nsx-t-configuration/

Use a dedicated Tier‑1 gateway for DMZ

Create a separate Tier‑1 gateway specifically for DMZ segments
Attach only DMZ logical segments to this Tier‑1
Apply NAT, firewall rules, and route advertisements at this Tier‑1

Continue using the default Tier‑0

DMZ Tier‑1 connects upstream to the default AVS Tier‑0
Tier‑0 handles:
- Internet egress/ingress
- Azure VNet connectivity
- On‑premises connectivity via ExpressRoute

Security enforcement

Use NSX‑T Distributed Firewall (DFW) for east‑west traffic
Use NAT + Tier‑1 firewall rules for north‑south DMZ traffic
Optional: integrate third‑party firewalls (NVA) for advanced inspection.

Links:

https://learn.microsoft.com/en-us/azure/azure-vmware/native-network-design-consideration

https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/scenarios/azure-vmware/example-architectures

Thanks,
Manish Deshpande.

Kaushal, Pravesh 125 Reputation points

2026-02-11T10:46:22.9466667+00:00

Hi Manish,Thank you.

Does this mean that we can still configure NAT on the Tier-1 Gateway in AVS Gen 2?

I would also like some clarification regarding the public IP to be used for SNAT and DNAT. Should this be the public IP of the Azure Firewall or Gateway? My understanding is that in AVS Gen 2, internet traffic is not terminated at the Tier-0 level (NSX Edge) as it was in AVS Gen 1.

Could you please confirm the correct design approach in this scenario?

Regards,

Pravesh Kaushal
Manish Deshpande 8,135 Reputation points Microsoft External Staff Moderator

2026-02-13T14:28:56.2666667+00:00

Hello Kaushal,

Yes, NAT is supported and expected to be configured on a dedicated Tier‑1 gateway in AVS Gen 2. The public IPs used for SNAT and DNAT should be Azure‑native public IPs (for example, Azure Firewall or a supported NVA), not NSX Tier‑0. In Gen 2, internet traffic is not terminated on the NSX Tier‑0 as it was in Gen 1. The supported design is to use Azure Firewall or an NVA for internet ingress/egress, with Tier‑1 providing DMZ isolation, NAT, and security controls.

1 additional answer

Your answer

Manish Deshpande 8,135 Reputation points Microsoft External Staff Moderator

2026-02-10T20:17:32.3233333+00:00

Hello Kaushal, Pravesh

I wanted to check if my last response made sense. I’d be glad to assist further or explain anything in more detail and please accept as Yes and upvote if the answer is helpful so that it can help others in the community.
Kaushal, Pravesh 125 Reputation points

2026-02-11T10:46:22.9466667+00:00

Hi Manish,Thank you.

Does this mean that we can still configure NAT on the Tier-1 Gateway in AVS Gen 2?

I would also like some clarification regarding the public IP to be used for SNAT and DNAT. Should this be the public IP of the Azure Firewall or Gateway? My understanding is that in AVS Gen 2, internet traffic is not terminated at the Tier-0 level (NSX Edge) as it was in AVS Gen 1.

Could you please confirm the correct design approach in this scenario?

Regards,

Pravesh Kaushal
Manish Deshpande 8,135 Reputation points Microsoft External Staff Moderator

2026-02-13T14:28:56.2666667+00:00

Hello Kaushal,

Yes, NAT is supported and expected to be configured on a dedicated Tier‑1 gateway in AVS Gen 2. The public IPs used for SNAT and DNAT should be Azure‑native public IPs (for example, Azure Firewall or a supported NVA), not NSX Tier‑0. In Gen 2, internet traffic is not terminated on the NSX Tier‑0 as it was in Gen 1. The supported design is to use Azure Firewall or an NVA for internet ingress/egress, with Tier‑1 providing DMZ isolation, NAT, and security controls.

Answer 1

In Azure VMware Solution (AVS), it is generally recommended to use a dedicated Tier-1 gateway for the DMZ setup. The Tier-1 gateways can be linked to the default Tier-0 gateway, which provides connectivity to the physical network outside the vSphere/NSX-T cluster. This setup allows for better management and isolation of DMZ traffic, ensuring that security policies can be effectively applied without impacting other network segments.

Using a dedicated Tier-1 gateway for the DMZ helps to streamline traffic management and enhances security by isolating DMZ traffic from other workloads. However, the Tier-0 gateway is managed by Microsoft and is not consumable by end users, so it cannot be dedicated for DMZ purposes.

Therefore, the best practice is to utilize a dedicated Tier-1 gateway for the DMZ while relying on the Tier-0 gateway for overall connectivity.