PaaS Service egress\outbound

Question

PaaS Service egress\outbound

Jayesh Dave 296

Hello:

If I bring my PaaS service in Private Endpoints, the ingress\inbound will work but egress\outbound will work on PaaS public IP address. I don't want PaaS Service talk on PaaS public IP address, I want to force in some kind of Private endpoint\private link.

I am looking for best secure options or any link that will help me.

I have gone thru MS documentations but nothing on Secure egress\outbound when your PaaS service is on Private Endpoint.

Any help or pointer is greatly appreciated.

Thanking in advance.

1 answer

Your answer

Answer 1

Alan Kinane 16,951 MVP Volunteer Moderator

You could deploy a NAT gateway and egress out through a dedicated public IP address on your NAT gateway.

https://learn.microsoft.com/en-us/azure/virtual-network/nat-gateway/nat-gateway-resource

https://learn.microsoft.com/en-us/azure/architecture/networking/guide/well-architected-network-address-translation-gateway

An example below with an app service:

https://learn.microsoft.com/en-us/azure/app-service/networking/nat-gateway-integration

Jayesh Dave 296 Reputation points

2022-05-16T11:57:44.627+00:00
Hello Alan:

Thanks for your reply.

What I understood that I have to use PaaS public IP for outbound to connect to another PaaS service.

This is what I am trying to achieve:-

No outbound access to Internet.

I don't think so it is possible but still want to know if I can use Private IP to connect for outbound and disable or block PaaS public IP.

All PaaS configured on Private IP can connect & talk to each other on Private IP and not Public IP.

Please let me know which of the above points are possible?

Thank you again for your help.
Alan Kinane 16,951 Reputation points MVP Volunteer Moderator

2022-05-16T12:10:17.517+00:00

I'm not sure that I can give you a complete answer without seeing your full solution but you can use service endpoints and private endpoints for most PaaS services these days to avoid the requirement for public IP addresses.

The article gives a good overview:
https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure-paas-services
Jayesh Dave 296 Reputation points

2022-05-16T13:25:23.5+00:00

Hello Alan:

Thanks for your reply & the link. I have couple of questions form the the link that you provided. (https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure-paas-services)

Q1 - Enterprises often have concerns about public endpoints for PaaS services that must be appropriately mitigated.
It doesn't elaborates how to mitigate ???

Q2 - We don't recommend that you implement forced tunneling to enable communication from Azure to Azure resources.
Good to know but WHY ????

So still Its not clear to me that there is no way PaaS can communicate outbound on Private IPs and without Public IP, PaaS cannot talk to other PaaS Services who are configured using Private Endpoints.
Jayesh Dave 296 Reputation points

2022-05-16T19:45:30.77+00:00
Hello Alan:

I am seeing some conflicting statements as per MS documentations.

If you read from this link --- https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-for-azure-services

I can communicate over Private IP address to PaaS Services and send data across and no Public IP address is required.

Resources within the virtual network can communicate with each other privately, through private IP addresses. Example, directly transferring data between HDInsight and SQL Server running on a virtual machine, in the virtual network.

Virtual networks can be peered to enable resources in the virtual networks to communicate with each other, using private IP addresses.

This is confusing lot based on earlier discussions\replies.
Alan Kinane 16,951 Reputation points MVP Volunteer Moderator

2022-05-17T08:31:17.263+00:00

I'm not fully understanding what you are trying to achieve. If you want to avoid routing your traffic over the Internet between your Azure services then this is what private endpoints are for, effectively your are provisioning a NIC for your PaaS service and attaching to a virtual network in order to route traffic privately. PaaS endpoints are public facing but you can put access restrictions on them.
Jayesh Dave 296 Reputation points

2022-05-17T13:14:14.34+00:00

Hello Alan:

As you mentioned "I'm not fully understanding what you are trying to achieve. ".
I want to know if there is a way to make one PaaS Service can connect and talk to another PaaS Service over Private Endpoints. I want to restrict PaaS public IP address for communicating to each other.

Overall objective is to stop using Public IP addresses for PaaS Services which are deployed with Private endpoints.
Alan Kinane 16,951 Reputation points MVP Volunteer Moderator

2022-05-17T13:21:58.367+00:00

Yes, this is possible by using private endpoints. If you are using private endpoints then all traffic can be configured to flow privately through your virtual network(s) and not via public IP addresses.

Not all PaaS services can support private endpoints at this time but you can review this list here: https://learn.microsoft.com/en-us/azure/private-link/availability
Jayesh Dave 296 Reputation points

2022-05-17T15:14:48.503+00:00

Thank you Alan for your reply but our discussion is circling back to from where i started with my original question.

MS has clearly stated about ingress for PaaS Service in Private Endpoints but for egress MS have not done good job of clarifying egress on Private Endpoints. As I repeated earlier that there is no documentation where MS have stated in detail that how you can to PaaS egress over Private Endpoints?
Alan Kinane 16,951 Reputation points MVP Volunteer Moderator

2022-05-17T15:53:47.607+00:00

Do you mean egress over the Internet? You would always need a public endpoint in this case. The only way to do this privately would be with ExpressRoute where you use a connectivity provider to establish a private connection to the Microsoft Cloud.

https://learn.microsoft.com/en-gb/azure/expressroute/expressroute-introduction
Jayesh Dave 296 Reputation points

2022-05-17T16:22:42.283+00:00

Not egress over internet. I will be blocking egress to Internet with Firewall rule.

I cannot disable PaaS Public IP address but I can block it. Egress between PaaS Services on Private Endpoints.

Share via

PaaS Service egress\outbound

1 answer

Your answer