Learn how to create and remove a NAT gateway resource from a virtual network subnet. A NAT gateway enables outbound connectivity for resources in an Azure Virtual Network. You can change the public IP addresses and public IP address prefixes associated with the NAT gateway changed after deployment.
This article explains how to manage the following aspects of NAT gateway:
Create a NAT gateway and associate it with an existing subnet.
Remove a NAT gateway from an existing subnet and delete the NAT gateway.
Add or remove a public IP address or public IP prefix.
The example virtual network that is used in this article is named myVNet.
The example subnet is named mySubnet.
The example NAT gateway is named myNATgateway.
To use Azure PowerShell for this article, you need:
Azure PowerShell installed locally or Azure Cloud Shell.
If you choose to install and use PowerShell locally, this article requires the Azure PowerShell module version 5.4.1 or later. Run Get-Module -ListAvailable Az to find the installed version. If you need to upgrade, see Install Azure PowerShell module.
If you run PowerShell locally, you also need to run Connect-AzAccount to create a connection with Azure.
Ensure that your Az.Network module is 4.3.0 or later. To verify the installed module, use the command Get-InstalledModule -Name "Az.Network". If the module requires an update, use the command Update-Module -Name Az.Network.
Sign in to Azure PowerShell and select the subscription that you want to use. For more information, see Sign in with Azure PowerShell.
If you prefer to run CLI reference commands locally, install the Azure CLI. If you're running on Windows or macOS, consider running Azure CLI in a Docker container. For more information, see How to run the Azure CLI in a Docker container.
If you're using a local installation, sign in to the Azure CLI by using the az login command. To finish the authentication process, follow the steps displayed in your terminal. For other sign-in options, see Sign in with the Azure CLI.
When you're prompted, install the Azure CLI extension on first use. For more information about extensions, see Use extensions with the Azure CLI.
Run az version to find the version and dependent libraries that are installed. To upgrade to the latest version, run az upgrade.
In the search box at the top of the Azure portal, enter NAT gateway. Select NAT gateways in the search results.
Select Create.
Enter the following information in the Basics tab of Create network address translation (NAT) gateway.
Select your Subscription.
Select your resource group or select Create new to create a new resource group.
NAT gateway name. Enter myNATgateway.
Select your Region. This example uses East US 2.
Select an Availability zone. This example uses No Zone. For more information about NAT gateway availability, see NAT gateway and availability zones. |
Select a TCP idle timeout (minutes). This example uses the default of 4.
Select the Outbound IP tab, or select Next: Outbound IP.
You can select an existing public IP address or prefix or both to associate with the NAT gateway and enable outbound connectivity.
To create a new public IP for the NAT gateway, select Create a new public IP address. Enter myPublicIP-NAT in Name. Select OK.
To create a new public IP prefix for the NAT gateway, select Create a new public IP prefix. Enter myPublicIPPrefix-NAT in Name. Select a Prefix size. Select OK.
Select the Subnet tab, or select Next: Subnet.
Select your virtual network. In this example, select myVNet in the dropdown list.
Select the checkbox next to mySubnet.
Select Review + create.
Select Create.
Public IP address
To create a NAT gateway with a public IP address, run the following PowerShell commands.
Use the New-AzPublicIpAddress cmdlet to create a public IP address for the NAT gateway.
## Create public IP address for NAT gateway ##
$ip = @{
Name = 'myPublicIP-NAT'
ResourceGroupName = 'myResourceGroup'
Location = 'eastus2'
Sku = 'Standard'
AllocationMethod = 'Static'
}
New-AzPublicIpAddress @ip
Use the New-AzNatGateway cmdlet to create a NAT gateway resource and associate the public IP address that you created. Use the Set-AzVirtualNetworkSubnetConfig cmdlet to configure the NAT gateway for your virtual network subnet.
## Place the virtual network into a variable. ##
$net = @{
Name = 'myVNet'
ResourceGroupName = 'myResourceGroup'
}
$vnet = Get-AzVirtualNetwork @net
## Place the public IP address you created previously into a variable. ##
$pip = @{
Name = 'myPublicIP-NAT'
ResourceGroupName = 'myResourceGroup'
}
$publicIP = Get-AzPublicIPAddress @pip
## Create NAT gateway resource ##
$nat = @{
ResourceGroupName = 'myResourceGroupNAT'
Name = 'myNATgateway'
IdleTimeoutInMinutes = '10'
Sku = 'Standard'
Location = 'eastus2'
PublicIpAddress = $publicIP
}
$natGateway = New-AzNatGateway @nat
## Create the subnet configuration. ##
$sub = @{
Name = 'mySubnet'
VirtualNetwork = $vnet
NatGateway = $natGateway
AddressPrefix = '10.0.2.0/24'
}
Set-AzVirtualNetworkSubnetConfig @sub
## Save the configuration to the virtual network. ##
$vnet | Set-AzVirtualNetwork
Public IP prefix
To create a NAT gateway with a public IP prefix, use these commands.
Use the New-AzPublicIpPrefix cmdlet to create a public IP prefix for the NAT gateway.
## Create public IP prefix for NAT gateway ##
$ip = @{
Name = 'myPublicIPPrefix-NAT'
ResourceGroupName = 'myResourceGroup'
Location = 'eastus2'
Sku = 'Standard'
PrefixLength ='29'
}
New-AzPublicIpPrefix @ip
Use the New-AzNatGateway cmdlet to create a NAT gateway resource and associate the public IP prefix you created. Use the Set-AzVirtualNetworkSubnetConfig cmdlet to configure the NAT gateway for your virtual network subnet.
## Place the virtual network into a variable. ##
$net = @{
Name = 'myVNet'
ResourceGroupName = 'myResourceGroup'
}
$vnet = Get-AzVirtualNetwork @net
## Place the public IP prefix you created previously into a variable. ##
$pip = @{
Name = 'myPublicIPPrefix-NAT'
ResourceGroupName = 'myResourceGroup'
}
$publicIPprefix = Get-AzPublicIPPrefix @pip
## Create NAT gateway resource ##
$nat = @{
ResourceGroupName = 'myResourceGroupNAT'
Name = 'myNATgateway'
IdleTimeoutInMinutes = '10'
Sku = 'Standard'
Location = 'eastus2'
PublicIpPrefix = $publicIPprefix
}
$natGateway = New-AzNatGateway @nat
## Create the subnet configuration. ##
$sub = @{
Name = 'mySubnet'
VirtualNetwork = $vnet
NatGateway = $natGateway
}
Set-AzVirtualNetworkSubnetConfig @sub
## Save the configuration to the virtual network. ##
$vnet | Set-AzVirtualNetwork
Public IP address
To create a NAT gateway with a public IP address, use the following commands.
In the search box at the top of the Azure portal, enter NAT gateway. Select NAT gateways in the search results.
Select myNATgateway.
Under Settings, select Subnets.
Select Disassociate to remove the NAT gateway from the configured subnet.
You can now associate the NAT gateway with a different subnet or virtual network in your subscription. To delete the NAT gateway resource, complete the following steps.
In the search box at the top of the Azure portal, enter NAT gateway. Select NAT gateways in the search results.
Select myNATgateway.
Select Delete.
Select Yes.
Removing the NAT gateway from a subnet by using Azure PowerShell isn't currently supported.
In the search box at the top of the Azure portal, enter Public IP address. Select Public IP addresses in the search results.
Select Create.
Enter the following information in Create public IP address.
Setting
Value
Subscription
Select your subscription.
Resource group
Select your resource group. The example uses myResourceGroup.
Region
Select a region. This example uses East US 2.
Name
Enter myPublicIP-NAT2.
IP version
Select IPv4.
SKU
Select Standard.
Availability zone
Select the default of Zone-redundant.
Tier
Select Regional.
Select Review + create and then select Create.
In the search box at the top of the Azure portal, enter NAT gateway. Select NAT gateways in the search results.
Select myNATgateway.
Under Settings, select Outbound IP.
The IP addresses and prefixes associated with the NAT gateway are displayed. Next to Public IP addresses, select Change.
Next to Public IP addresses, select the dropdown for IP addresses. Select the IP address that you created to add to the NAT gateway. To remove an address, unselect it.
Select OK.
Select Save.
Add public IP address
To add a public IP address to the NAT gateway, add it to an array object along with the current IP addresses. The PowerShell cmdlets replace all the addresses.
In this example, the existing IP address associated with the NAT gateway is named myPublicIP-NAT. Replace this value with an array that contains both myPublicIP-NAT and a new IP address. If you have multiple IP addresses already configured, you must also add them to the array.
## Create public IP address for NAT gateway ##
$ip = @{
Name = 'myPublicIP-NAT2'
ResourceGroupName = 'myResourceGroup'
Location = 'eastus2'
Sku = 'Standard'
AllocationMethod = 'Static'
}
New-AzPublicIpAddress @ip
Use Set-AzNatGateway to add the public IP address to the NAT gateway.
## Place NAT gateway into a variable. ##
$ng = @{
Name = 'myNATgateway'
ResourceGroupName = 'myResourceGroup'
}
$nat = Get-AzNatGateway @ng
## Place the existing public IP address associated with the NAT gateway into a variable. ##
$ip = @{
Name = 'myPublicIP-NAT'
ResourceGroupName = 'myResourceGroup'
}
$publicIP1 = Get-AzPublicIPaddress @ip
## Place the public IP address you created previously into a variable. ##
$ip = @{
Name = 'myPublicIP-NAT2'
ResourceGroupName = 'myResourceGroup'
}
$publicIP2 = Get-AzPublicIPaddress @ip
## Place the public IP address variables into an array. ##
$pipArray = $publicIP1,$publicIP2
## Add the IP address to the NAT gateway. ##
$nt = @{
NatGateway = $nat
PublicIpAddress = $pipArray
}
Set-AzNatGateway @nt
Remove public IP address
To remove a public IP from a NAT gateway, create an array object that doesn't contain the IP address you want to remove. For example, you have a NAT gateway configured with two public IP addresses. You want to remove one of the IP addresses. The IP addresses associated with the NAT gateway are named myPublicIP-NAT and myPublicIP-NAT2. To remove myPublicIP-NAT2, create an array object for the PowerShell command that contains only myPublicIP-NAT. When you apply the command, the array is reapplied to the NAT gateway, and myPublicIP-NAT is the only associated public IP address.
Use Set-AzNatGateway to remove a public IP address from the NAT gateway.
## Place NAT gateway into a variable. ##
$ng = @{
Name = 'myNATgateway'
ResourceGroupName = 'myResourceGroup'
}
$nat = Get-AzNatGateway @ng
## Place the existing public IP address associated with the NAT gateway into a variable. ##
$ip = @{
Name = 'myPublicIP-NAT'
ResourceGroupName = 'myResourceGroup'
}
$publicIP1 = Get-AzPublicIPaddress @ip
## Place the second public IP address into a variable. ##
$ip = @{
Name = 'myPublicIP-NAT2'
ResourceGroupName = 'myResourceGroup'
}
$publicIP2 = Get-AzPublicIPAddress @ip
## Place ONLY the public IP you wish to keep in the array. ##
$pipArray = $publicIP1
## Add the public IP address to the NAT gateway. ##
$nt = @{
NatGateway = $nat
PublicIpAddress = $pipArray
}
Set-AzNatGateway @nt
Add public IP address
In this example, the existing public IP address associated with the NAT gateway is named myPublicIP-NAT.
az network public-ip create \
--resource-group myResourceGroup \
--location eastus2 \
--name myPublicIP-NAT2 \
--sku standard
Use az network nat gateway update to add the public IP address that you created to the NAT gateway. The Azure CLI command replaces the values. It doesn't add a new value. To add the new IP address to the NAT gateway, you must also include any other IP addresses associated to the NAT gateway.
Use az network nat gateway update to remove a public IP address from the NAT gateway. The Azure CLI command replaces the values. It doesn't remove a value. To remove a public IP address, include any IP address in the command that you want to keep. Omit the value that you want to remove. For example, you have a NAT gateway configured with two public IP addresses. You want to remove one of the IP addresses. The IP addresses associated with the NAT gateway are named myPublicIP-NAT and myPublicIP-NAT2. To remove myPublicIP-NAT2, omit the name of the IP address from the command. The command reapplies the IP addresses listed in the command to the NAT gateway. It removes any IP address not listed.
In the search box at the top of the Azure portal, enter Public IP prefix. Select Public IP Prefixes in the search results.
Select Create.
Enter the following information in the Basics tab of Create a public IP prefix.
Setting
Value
Project details
Subscription
Select your subscription.
Resource group
Select your resource group. This example uses myResourceGroup.
Instance details
Name
Enter myPublicIPPrefix-NAT.
Region
Select your region. This example uses East US 2.
IP version
Select IPv4.
Prefix ownership
Select Microsoft owned.
Prefix size
Select a prefix size. This example uses /28 (16 addresses).
Select Review + create, then select Create.
In the search box at the top of the Azure portal, enter NAT gateway. Select NAT gateways in the search results.
Select myNATgateway.
Under Settings, select Outbound IP.
The page displays the IP addresses and prefixes associated with the NAT gateway. Next to Public IP prefixes, select Change.
Next to Public IP Prefixes, select the dropdown box. Select the IP address prefix that you created to add the prefix to the NAT gateway. To remove a prefix, unselect it.
Select OK.
Select Save.
Add public IP prefix
To add a public IP prefix to the NAT gateway, add it to an array object along with the current IP prefixes. The PowerShell cmdlets replace all the IP prefixes.
In this example, the existing public IP prefix associated with the NAT gateway is named myPublicIPprefix-NAT. Replace this value with an array that contains both myPublicIPprefix-NAT and a new IP address prefix. If you have multiple IP prefixes already configured, you must also add them to the array.
## Create public IP prefix for NAT gateway ##
$ip = @{
Name = 'myPublicIPPrefix-NAT2'
ResourceGroupName = 'myResourceGroup'
Location = 'eastus2'
Sku = 'Standard'
PrefixLength = '29'
}
New-AzPublicIpPrefix @ip
Use Set-AzNatGateway to add the public IP prefix to the NAT gateway.
## Place NAT gateway into a variable. ##
$ng = @{
Name = 'myNATgateway'
ResourceGroupName = 'myResourceGroup'
}
$nat = Get-AzNatGateway @ng
## Place the existing public IP prefix associated with the NAT gateway into a variable. ##
$ip = @{
Name = 'myPublicIPprefix-NAT'
ResourceGroupName = 'myResourceGroup'
}
$prefixIP1 = Get-AzPublicIPPrefix @ip
## Place the public IP prefix you created previously into a variable. ##
$ip = @{
Name = 'myPublicIPprefix-NAT2'
ResourceGroupName = 'myResourceGroup'
}
$prefixIP2 = Get-AzPublicIPprefix @ip
## Place the public IP address variables into an array. ##
$preArray = $prefixIP1,$prefixIP2
## Add the IP address prefix to the NAT gateway. ##
$nt = @{
NatGateway = $nat
PublicIpPrefix = $preArray
}
Set-AzNatGateway @nt
Remove public IP prefix
To remove a public IP prefix from a NAT gateway, create an array object that doesn't contain the IP address prefix that you want to remove. For example, you have a NAT gateway configured with two public IP prefixes. You want to remove one of the IP prefixes. The IP prefixes associated with the NAT gateway are named myPublicIPprefix-NAT and myPublicIPprefix-NAT2. To remove myPublicIPprefix-NAT2, create an array object for the PowerShell command that contains only myPublicIPprefix-NAT. When you apply the command, the array is reapplied to the NAT gateway, and myPublicIPprefix-NAT is the only prefix associated.
Use the Set-AzNatGateway cmdlet to remove a public IP prefix from the NAT gateway.
## Place NAT gateway into a variable. ##
$ng = @{
Name = 'myNATgateway'
ResourceGroupName = 'myResourceGroup'
}
$nat = Get-AzNatGateway @ng
## Place the existing public IP prefix associated with the NAT gateway into a variable. ##
$ip = @{
Name = 'myPublicIPprefix-NAT'
ResourceGroupName = 'myResourceGroup'
}
$prefixIP1 = Get-AzPublicIPPrefix @ip
## Place the secondary public IP prefix into a variable. ##
$ip = @{
Name = 'myPublicIPprefix-NAT2'
ResourceGroupName = 'myResourceGroup'
}
$prefixIP2 = Get-AzPublicIPprefix @ip
## Place ONLY the prefix you wish to keep in the array. DO NOT ADD THE SECONDARY VARIABLE ##
$preArray = $prefixIP1
## Add the IP address prefix to the NAT gateway. ##
$nt = @{
NatGateway = $nat
PublicIpPrefix = $preArray
}
Set-AzNatGateway @nt
Add public IP prefix
In this example, the existing public IP prefix associated with the NAT gateway is named myPublicIPprefix-NAT.
Use az network nat gateway update to add the public IP prefix that you created to the NAT gateway. The Azure CLI command replaces values. It doesn't add a value. To add the new IP address prefix to the NAT gateway, you must also include any other IP prefixes associated to the NAT gateway.
Use az network nat gateway update to remove a public IP prefix from the NAT gateway. The Azure CLI command replaces the values. It doesn't remove a value. To remove a public IP prefix, include any prefix in the command that you wish to keep. Omit the one you want to remove. For example, you have a NAT gateway configured with two public IP prefixes. You want to remove one of the prefixes. The IP prefixes associated with the NAT gateway are named myPublicIPprefix-NAT and myPublicIPprefix-NAT2. To remove myPublicIPprefix-NAT2, omit the name of the IP prefix from the command. The command reapplies the IP prefixes listed in the command to the NAT gateway. It removes any IP address not listed.
Tulossa pian: Vuoden 2024 aikana poistamme asteittain GitHub Issuesin käytöstä sisällön palautemekanismina ja korvaamme sen uudella palautejärjestelmällä. Lisätietoja on täällä: https://aka.ms/ContentUserFeedback.