Scale Azure Firewall SNAT ports with NAT Gateway for giant workloads | Azure Blog and Updates

This submit was co-authored by Suren Jamiyanaa, Product Manager II, Azure Networking.

As giant organizations throughout all industries develop their cloud enterprise and operations, one core standards for his or her cloud infrastructure is to make connections over the web at scale. However, a standard outbound connectivity challenge encountered when dealing with large-scale outbound visitors is supply community tackle translation (SNAT) port exhaustion. Each time a brand new connection to the identical vacation spot endpoint is revamped the web, a brand new SNAT port is used. SNAT port exhaustion happens when all accessible SNAT ports run out. Environments that usually require making many connections to the identical vacation spot, corresponding to accessing a database hosted in a service supplier’s knowledge middle, are vulnerable to SNAT port exhaustion. When it involves connecting outbound to the web, prospects have to not solely think about potential dangers corresponding to SNAT port exhaustion but in addition how one can present safety for his or her outbound visitors.

Azure Firewall is an clever safety service that protects cloud infrastructures in opposition to new and rising assaults by filtering community visitors. All outbound web visitors utilizing Azure Firewall is inspected, secured, and undergoes SNAT to hide the unique shopper IP tackle. To bolster outbound connectivity, Azure Firewall could be scaled out by associating a number of public IPs to Azure Firewall. Some large-scale environments could require manually associating as much as lots of of public IPs to Firewall with the intention to meet the demand of large-scale workloads, which is usually a problem to handle long-term. Partner locations additionally generally have a restrict on the variety of IPs that may be whitelisted at their vacation spot websites, which might create challenges when Firewall outbound connectivity must be scaled out with many public IPs. Without scaling this outbound connectivity, prospects are extra vulnerable to outbound connectivity failures as a consequence of SNAT port exhaustion.

This is the place community tackle translation (NAT) gateway is available in. NAT gateway could be simply deployed to an Azure Firewall subnet to mechanically scale connections and filter visitors by the firewall earlier than connecting to the web. NAT gateway not solely gives a bigger SNAT port stock with fewer public IPs however NAT gateway’s distinctive technique of SNAT port allocation is particularly designed to deal with dynamic and large-scale workloads. NAT gateway’s dynamic allocation and randomized collection of SNAT ports considerably cut back the chance of SNAT port exhaustion whereas additionally protecting overhead administration of public IPs at a minimal.

In this weblog, we’ll discover the advantages of utilizing NAT Gateway with Azure Firewall in addition to how one can combine each into your structure to make sure you have the perfect setup for assembly your safety and scalability wants for outbound connectivity.

Benefits of utilizing NAT Gateway with Azure Firewall

One of the best advantages of integrating NAT gateway into your Firewall structure is the scalability that it gives for outbound connectivity. SNAT ports are a key part to creating new connections over the web and distinguishing totally different connections from each other coming from the identical supply endpoint. NAT gateway gives 64,512 SNAT ports per public IP and may scale out to make use of 16 public IP addresses. This means, when totally scaled out with 16 public IP addresses, NAT gateway gives over 1 million SNAT ports. Azure Firewall, however, helps 2,496 SNAT ports per public IP per digital machine occasion inside a digital machine scale set (minimal of two situations). This signifies that to attain the identical quantity of SNAT port stock as NAT gateway when totally scaled out, Firewall could require as much as 200 public IPs. Not solely does NAT gateway supply extra SNAT ports with fewer public IPs, however these SNAT ports are allotted on demand to any digital machine in a subnet. On-demand SNAT port allocation is essential to how NAT gateway considerably reduces the chance of widespread outbound connectivity points like SNAT port exhaustion.

NAT gateway additionally gives 50 Gbps of information throughput for outbound visitors that can be utilized in step with a typical SKU Azure Firewall, which gives 30 Gbps of information throughput. Premium SKU Azure Firewall gives 100 Gbps of information throughput.

With NAT gateway you additionally be sure that your outbound visitors is completely safe since no inbound visitors can get by NAT gateway. All inbound visitors is topic to safety guidelines enabled on the Azure Firewall earlier than it might probably attain any non-public sources inside your cloud infrastructure.

To study extra in regards to the different advantages that NAT gateway gives in Azure Firewall architectures, see NAT gateway integration with Azure Firewall.

How to get probably the most out of utilizing NAT Gateway with Azure Firewall

Let’s check out how one can arrange NAT gateway with Azure Firewall and the way connectivity to and from the web works upon integrating each into your cloud structure.

Production-ready outbound connectivity with NAT Gateway and Azure Firewall

For manufacturing workloads, Azure recommends separating Azure Firewall and manufacturing workloads right into a hub and spoke topology. Introducing NAT gateway into this setup is straightforward and could be executed in only a couple brief steps. First, deploy Azure Firewall to an Azure Firewall Subnet inside the hub digital community (VNet). Attach NAT gateway to the Azure Firewall Subnet and add as much as 16 public IP addresses and also you’re executed. Once configured, NAT gateway turns into the default route for all outbound visitors from the Azure Firewall Subnet. This signifies that internet-directed visitors (visitors with the prefix 0.0.0.0/0) routed from the spoke Vnets to the Hub Vnet’s Azure Firewall Subnet will mechanically use the NAT gateway to attach outbound. Because NAT gateway is totally managed by Azure, NAT gateway allocates SNAT ports and scales to fulfill your outbound connectivity wants mechanically. No extra configurations are required.

Figure: Separate the Azure Firewall from the manufacturing workloads in a hub and spoke topology and connect NAT gateway to the Azure Firewall Subnet within the hub digital community. Once configured, all outbound visitors out of your spoke digital networks is directed by NAT gateway and all return visitors is directed again to the Azure Firewall Public IP to take care of circulate symmetry. 

How to arrange NAT Gateway with Azure Firewall

To guarantee that you’ve got arrange your workloads to path to the Azure Firewall Subnet and use NAT gateway for connecting outbound, observe these steps:

1. Deploy your Firewall to an Azure Firewall Subnet inside its personal digital community. This would be the Hub Vnet.
2. Add NAT gateway to the Azure Firewall Subnet and connect no less than one public IP tackle.
3. Deploy your workloads to subnets in separate digital networks. These digital networks would be the spokes. Create as many spoke Vnets in your workload as wanted.
4. Set up Vnet peering between the hub and spoke Vnets.
5. Insert a path to the spoke subnets to route 0.0.0.0/0 web visitors to the Azure Firewall.
6. Add a community rule to the Firewall coverage to permit visitors from the spoke Vnets to the web.

Refer to this tutorial for step-by step steerage on how one can deploy NAT gateway and Azure Firewall in a hub and spoke topology.

Once NAT gateway is deployed to the Azure Firewall Subnet, all outbound visitors is directed by the NAT gateway. Normally, NAT gateway additionally receives any return visitors. However, within the presence of Azure Firewall, NAT gateway is used for outbound visitors solely. All inbound and return visitors is directed by the Azure Firewall with the intention to guarantee visitors circulate symmetry.

FAQ

1. Can NAT gateway be utilized in a safe hub digital community structure with Azure Firewall?
   1. No, NAT gateway just isn’t supported in a safe hub (vWAN) structure. A hub digital community structure as described above have to be used as an alternative.
2. How does NAT gateway work with a zone-redundant Azure Firewall?
   1. NAT gateway is a zonal useful resource that may present outbound connectivity from a single zone for a digital community no matter whether or not it used with a zonal or zone-redundant Azure Firewall. To study extra about how one can optimize your availability zone deployments with NAT gateway, seek advice from our final weblog.

Benefits of NAT Gateway with Azure Firewall

When it involves offering outbound connectivity to the web from cloud architectures utilizing Azure Firewall, look no additional than NAT gateway. The advantages of utilizing NAT gateway with Azure Firewall embrace:

1. Simple configuration. Attach NAT gateway to the Azure Firewall Subnet in a matter of minutes and begin connecting outbound immediately. No extra configurations required.
2. Fully managed by Azure. NAT gateway is totally managed by Azure and mechanically scales to fulfill the demand of your workload.
3. Requires fewer static public IPs. NAT gateway could be related to as much as 16 static public IP addresses which permits for straightforward whitelisting at vacation spot endpoints and less complicated administration of downstream IP filtering guidelines.
4. Provides a larger quantity of SNAT ports for connecting outbound. NAT gateway can scale to over 1 million SNAT ports when configured to 16 public IP addresses.
5. Dynamic SNAT port allocation ensures that the complete stock of SNAT ports is accessible to each digital machine in your workload. This in flip helps to considerably cut back the chance of SNAT port exhaustion that’s widespread with different SNAT strategies.
6. Secure outbound connectivity. Ensures that no inbound visitors from the web can attain non-public sources inside your Azure community. All inbound and response visitors is topic to safety guidelines on the Azure Firewall.
7. Higher knowledge throughput. An ordinary SKU NAT gateway gives 50 Gbps of information throughput. An ordinary SKU Azure Firewall gives 30 Gbps of information throughput.

Learn extra

For extra info on NAT Gateway, Azure Firewall, and how one can combine each into your architectural setup, see: