Skip to main content

NAT on Azure VPN Gateway (Public Preview)


Organizations commonly use private IP addresses for internal communication in their private networks. When these networks are connected using VPN over the Internet or across private WAN, the address spaces must not overlap otherwise the communication would fail.





To connect two or more networks with overlapping IP addresses, NAT is deployed on the gateway devices connecting the networks. Previously customers needed to use Cisco strech network appliances to connect Azure and their on prem data centre.





I was part of a similar migration we were using CISCO CSR 1000V virtual appliance to strech the onprem network to Azure. and we had to face lot of challenges with routing, packet sizes etc...





There are many reasons that we need to use same IP addresses in both onprem and Azure specially when in a hybrid cloud or a migration scenario. Now with this feature hopefully things will be seamleess





Below is the example from Microsoft Documentation.





NAT example




The following diagram shows an example of Azure VPN NAT configurations:





NAT diagram.




The diagram shows an Azure VNet and two on-premises networks, all with address space of 10.0.1.0/24. To connect these two networks to the Azure VNet and VPN gateway, create the following rules:





  • IngressSNAT rule 1: This rule translates the on-premises address space 10.0.1.0/24 to 100.0.2.0/24.
  • IngressSNAT rule 2: This rule translates the on-premises address space 10.0.1.0/24 to 100.0.3.0/24.
  • EgressSNAT rule 1: This rule translates the VNet address space 10.0.1.0/24 to 100.0.1.0/24.




In the diagram, each connection resource has the following rules:





  • Connection 1 (VNet-Branch1):
    • IngressSNAT rule 1
    • EgressSNAT rule 1
  • Connection 2 (VNet-Branch2)
    • IngressSNAT rule 2
    • EgressSNAT rule 1




Based on the rules associated with the connections, here are the address spaces for each network:





NetworkOriginalTranslated
VNet10.0.1.0/24100.0.1.0/24
Branch 110.0.1.0/24100.0.2.0/24
Branch 210.0.1.0/24100.0.3.0/24




The diagram below shows an IP packet from Branch 1 to VNet, before and after the NAT translation:





Diagram showing before and after NAT translation.




https://docs.microsoft.com/en-us/azure/vpn-gateway/nat-overview#example









In near future I will be doing a youtube video on this feature.


Labels:

Comments

Post a Comment

Popular posts from this blog

Deploying an Automation Account with a Runbook and Schedule Using Bicep

Introduction Automation is a key component in many organizations' cloud strategy. Azure Automation allows you to automate the creation, deployment, and management of resources in your Azure environment. In this post, we will walk through the process of deploying an Automation Account with a Runbook and Schedule using Bicep, a new domain-specific language for deploying Azure resources. Intention My intention at the  end is to run a PowerShell  script to start and shutdown Azure VMs based on tag values. PowerShell  script that I have used is from below l ink.  And two  of me   collogue s ( Michael Turnley   and Saudh Mohomad helped to modify the  PowerShell  script. Prerequisites Before we begin, you will need the following: An Azure subscription The Azure CLI installed on your machine. The Azure Bicep extension for the Azure CLI Creating the Automation Account The first step in deploying an Automation Account with a R...
Post a Comment
Read more

Securing Azure Services with Fetian FIDO

Hey Folks  Here again with another security topic with Fetian Fido. And once again Fetian devices proved their excellent quality and stability. For this I choose Fetian K33 -  AllinPass FIDO Security Key – FEITIAN (ftsafe.com) and  K39 -  Single-button FIDO Security Keys | FEITIAN (ftsafe.com) Use case  In an organization following changes needs to be implemented.  1. Update the password policy 2. Update the user session time out to 30 minutes Once these changes being implemented, the following issues need to be addressed 1. Users' complaint new passwords need to be so long 2. Users complain sessions time out makes them work so much slower with the longer passwords 3. Etc... Solution  One of my friends reached out to me to help solve this problem. All I could think of was using passwordless auth with FIDO devices. We have decided to use Fido2 keys for better security and flexibility for the users. The FIDO (Fast IDentity Online) Alliance helps to pro...
Post a Comment
Read more

Migrating Azure DevOps Variable Groups

Howdy Folks, I was working on an application modernization project. And there was a requirement to migrate application deployments from one project to another in Azure DevOps. deployment pipelines were heavily dependent on variable groups. So, we wanted to migrate these variables group to the new project. Couldn't find any solutions in internet for this, so came up with the below scripts. You can grab the scripts from the below GitHub URL. DaniduWeerasinghe911/Migrate-Azure-DevOps-Variable-Groups: This Repo Include PowerShell Scripts relating to Migrating Azure DevOps Variable Groups (github.com) Azure DevOps Variable Groups Azure DevOps Variable Groups are a way to store and manage sets of variables that can be used across multiple pipelines in Azure DevOps. These variables can include secrets, connection strings, and other sensitive information that is needed for builds and releases. Variable Groups provide a centralized way to manage these variables and ensure that they are cons...
Post a Comment
Read more