Scale Azure Firewall SNAT ports with NAT Gateway for giant workloads | Azure Weblog and Updates

This publish was co-authored by Suren Jamiyanaa, Product Supervisor II, Azure Networking.

As giant organizations throughout all industries develop their cloud enterprise and operations, one core standards for his or her cloud infrastructure is to make connections over the web at scale. Nonetheless, a typical outbound connectivity problem encountered when dealing with large-scale outbound site visitors is source network address translation (SNAT) port exhaustion. Every time a brand new connection to the identical vacation spot endpoint is remodeled the web, a brand new SNAT port is used. SNAT port exhaustion happens when all obtainable SNAT ports run out. Environments that always require making many connections to the identical vacation spot, reminiscent of accessing a database hosted in a service supplier’s knowledge heart, are inclined to SNAT port exhaustion. With regards to connecting outbound to the web, clients must not solely contemplate potential dangers reminiscent of SNAT port exhaustion but in addition the right way to present safety for his or her outbound site visitors.

Azure Firewall is an clever safety service that protects cloud infrastructures in opposition to new and rising assaults by filtering community site visitors. All outbound web site visitors utilizing Azure Firewall is inspected, secured, and undergoes SNAT to hide the unique consumer IP deal with. To bolster outbound connectivity, Azure Firewall could be scaled out by associating a number of public IPs to Azure Firewall. Some large-scale environments could require manually associating as much as lots of of public IPs to Firewall as a way to meet the demand of large-scale workloads, which could be a problem to handle long-term. Associate locations additionally generally have a restrict on the variety of IPs that may be whitelisted at their vacation spot websites, which might create challenges when Firewall outbound connectivity must be scaled out with many public IPs. With out scaling this outbound connectivity, clients are extra inclined to outbound connectivity failures as a consequence of SNAT port exhaustion.

That is the place community deal with translation (NAT) gateway is available in. NAT gateway could be simply deployed to an Azure Firewall subnet to mechanically scale connections and filter site visitors by means of the firewall earlier than connecting to the web. NAT gateway not solely supplies a bigger SNAT port stock with fewer public IPs however NAT gateway’s distinctive methodology of SNAT port allocation is particularly designed to deal with dynamic and large-scale workloads. NAT gateway’s dynamic allocation and randomized choice of SNAT ports considerably scale back the chance of SNAT port exhaustion whereas additionally retaining overhead administration of public IPs at a minimal.

On this weblog, we’ll discover the advantages of utilizing NAT Gateway with Azure Firewall in addition to the right way to combine each into your structure to make sure you have the most effective setup for assembly your safety and scalability wants for outbound connectivity.

Advantages of utilizing NAT Gateway with Azure Firewall

One of many biggest advantages of integrating NAT gateway into your Firewall structure is the scalability that it supplies for outbound connectivity. SNAT ports are a key part to creating new connections over the web and distinguishing completely different connections from each other coming from the identical supply endpoint. NAT gateway supplies 64,512 SNAT ports per public IP and might scale out to make use of 16 public IP addresses. This implies, when absolutely scaled out with 16 public IP addresses, NAT gateway supplies over 1 million SNAT ports. Azure Firewall, alternatively, helps 2,496 SNAT ports per public IP per digital machine occasion inside a digital machine scale set (minimal of two cases). Which means to realize the identical quantity of SNAT port stock as NAT gateway when absolutely scaled out, Firewall could require as much as 200 public IPs. Not solely does NAT gateway provide extra SNAT ports with fewer public IPs, however these SNAT ports are allotted on demand to any digital machine in a subnet. On-demand SNAT port allocation is vital to how NAT gateway considerably reduces the chance of widespread outbound connectivity points like SNAT port exhaustion.

NAT gateway additionally supplies 50 Gbps of knowledge throughput for outbound site visitors that can be utilized according to a normal SKU Azure Firewall, which supplies 30 Gbps of knowledge throughput. Premium SKU Azure Firewall supplies 100 Gbps of knowledge throughput.

With NAT gateway you additionally make sure that your outbound site visitors is solely safe since no inbound site visitors can get by means of NAT gateway. All inbound site visitors is topic to safety guidelines enabled on the Azure Firewall earlier than it could actually attain any non-public assets inside your cloud infrastructure.

To study extra in regards to the different advantages that NAT gateway gives in Azure Firewall architectures, see NAT gateway integration with Azure Firewall.

get probably the most out of utilizing NAT Gateway with Azure Firewall

Let’s check out the right way to arrange NAT gateway with Azure Firewall and the way connectivity to and from the web works upon integrating each into your cloud structure.

Manufacturing-ready outbound connectivity with NAT Gateway and Azure Firewall

For manufacturing workloads, Azure recommends separating Azure Firewall and manufacturing workloads right into a hub and spoke topology. Introducing NAT gateway into this setup is straightforward and could be accomplished in only a couple quick steps. First, deploy Azure Firewall to an Azure Firewall Subnet inside the hub digital community (VNet). Connect NAT gateway to the Azure Firewall Subnet and add as much as 16 public IP addresses and also you’re accomplished. As soon as configured, NAT gateway turns into the default route for all outbound site visitors from the Azure Firewall Subnet. Which means internet-directed site visitors (site visitors with the prefix routed from the spoke Vnets to the Hub Vnet’s Azure Firewall Subnet will mechanically use the NAT gateway to attach outbound. As a result of NAT gateway is absolutely managed by Azure, NAT gateway allocates SNAT ports and scales to satisfy your outbound connectivity wants mechanically. No further configurations are required.


Figure shows a diagram of a hub and spoke network setup where the spoke virtual network that contains three virtual machines is peered to the hub virtual network. Azure Firewall and NAT gateway are attached to the Azure Firewall Subnet in the hub virtual network. The diagram shows how traffic from the virtual machines in the spoke virtual network connect outbound to the internet through NAT gateway. Return and inbound traffic is sent through Azure Firewall before reaching the virtual machines in the spoke virtual network.

Determine: Separate the Azure Firewall from the manufacturing workloads in a hub and spoke topology and fasten NAT gateway to the Azure Firewall Subnet within the hub digital community. As soon as configured, all outbound site visitors out of your spoke digital networks is directed by means of NAT gateway and all return site visitors is directed again to the Azure Firewall Public IP to keep up circulate symmetry. 

arrange NAT Gateway with Azure Firewall

To make sure that you might have arrange your workloads to path to the Azure Firewall Subnet and use NAT gateway for connecting outbound, observe these steps:

  1. Deploy your Firewall to an Azure Firewall Subnet inside its personal digital community. This would be the Hub Vnet.
  2. Add NAT gateway to the Azure Firewall Subnet and fasten at the least one public IP deal with.
  3. Deploy your workloads to subnets in separate digital networks. These digital networks would be the spokes. Create as many spoke Vnets on your workload as wanted.
  4. Arrange Vnet peering between the hub and spoke Vnets.
  5. Insert a path to the spoke subnets to route web site visitors to the Azure Firewall.
  6. Add a community rule to the Firewall coverage to permit site visitors from the spoke Vnets to the web.

Consult with this tutorial for step-by step steerage on the right way to deploy NAT gateway and Azure Firewall in a hub and spoke topology.

As soon as NAT gateway is deployed to the Azure Firewall Subnet, all outbound site visitors is directed by means of the NAT gateway. Usually, NAT gateway additionally receives any return site visitors. Nonetheless, within the presence of Azure Firewall, NAT gateway is used for outbound site visitors solely. All inbound and return site visitors is directed by means of the Azure Firewall as a way to guarantee site visitors circulate symmetry.


  1. Can NAT gateway be utilized in a safe hub digital community structure with Azure Firewall?

    1. No, NAT gateway is just not supported in a safe hub (vWAN) structure. A hub digital community structure as described above should be used as an alternative.

  2. How does NAT gateway work with a zone-redundant Azure Firewall?

    1. NAT gateway is a zonal useful resource that may present outbound connectivity from a single zone for a digital community no matter whether or not it used with a zonal or zone-redundant Azure Firewall. To study extra about the right way to optimize your availability zone deployments with NAT gateway, confer with our final weblog.

Advantages of NAT Gateway with Azure Firewall

With regards to offering outbound connectivity to the web from cloud architectures utilizing Azure Firewall, look no additional than NAT gateway. The advantages of utilizing NAT gateway with Azure Firewall embrace:

  1. Easy configuration. Connect NAT gateway to the Azure Firewall Subnet in a matter of minutes and begin connecting outbound instantly. No further configurations required.
  2. Totally managed by Azure. NAT gateway is absolutely managed by Azure and mechanically scales to satisfy the demand of your workload.
  3. Requires fewer static public IPs. NAT gateway could be related to as much as 16 static public IP addresses which permits for simple whitelisting at vacation spot endpoints and less complicated administration of downstream IP filtering guidelines.
  4. Supplies a better quantity of SNAT ports for connecting outbound. NAT gateway can scale to over 1 million SNAT ports when configured to 16 public IP addresses.
  5. Dynamic SNAT port allocation ensures that the complete stock of SNAT ports is obtainable to each digital machine in your workload. This in flip helps to considerably scale back the chance of SNAT port exhaustion that’s widespread with different SNAT strategies.
  6. Safe outbound connectivity. Ensures that no inbound site visitors from the web can attain non-public assets inside your Azure community. All inbound and response site visitors is topic to safety guidelines on the Azure Firewall.
  7. Increased knowledge throughput. A regular SKU NAT gateway supplies 50 Gbps of knowledge throughput. A regular SKU Azure Firewall supplies 30 Gbps of knowledge throughput.

Be taught extra

For extra data on NAT Gateway, Azure Firewall, and the right way to combine each into your architectural setup, see: