Multiple Public IP Support for VM-Series on Microsoft Azure

by mkeil on ‎03-20-2017 05:49 AM - edited on ‎03-28-2017 12:26 AM by (4,963 Views)

 

Details

Multiple public IP support in Microsoft Azure is now generally available in all Azure public regions. As a reminder, multiple public IP support allows you to assign one/more public IP(s) to any interface (NIC) of the VM-Series instance in Azure, eliminating the current need for a NAT VM for some deployment scenarios. Learn more about Multiple public IP support here.

Note:

  • This Microsoft Azure update also includes Microsoft Azure Load Balancer enhancements that will allow traffic to be distributed across any IP address on any interface of the VM-Series, (i.e. Azure Load Balancer does not target eth0 only any longer). For more details on how to manually scale out security to protect web applications using VM-Series and Application Gateway: https://github.com/PaloAltoNetworks/azure-applicationgateway>
  • For each public IP assigned to an interface, Microsoft Azure also assigns a private IP to the VM-Series interface. When the first public IP (i.e. primary public IP) is configured on the interface, the firewall gets the equivalent private IP via DHCP. Any additional, i.e. secondary, public IP (or private IP) assigned to a VM-Series interface must be manually configured as static IP addresses inside VM-Series on the corresponding interface.

Once you start using the multiple public IP feature, a NAT VM is not required in front of any Internet facing use cases as was previously needed. If you are using a NAT VM then you can reassign the NAT VM’s public IP directly on the VM-Series firewall public facing interface in the Azure Portal.  For example, one or more public IP’s can be the untrust interface (eth1) in the diagram below.

 

resource group.png

 

Now multiple services or applications can be hosted from the same interface, or from separate interfaces. For example, application 1 is served from the VM-Series eth1 interface, and application 2 can be served from eth2 interface. For highly available designs and scalability, it is recommended to use Azure-native load balancers like Azure Application Gateway or Azure Load Balancer, as discussed here.

Comments
by gzygadlo
on ‎05-02-2017 08:49 AM

Any additional, i.e. secondary, public IP (or private IP) assigned to a VM-Series interface must be manually configured as static IP addresses inside VM-Series on the corresponding interface. 

 

How is this done as there doesn't seem to be any documentation or samples?

 

Do you change it from DHCP to static on the interface?

by CJ.Rogers
on ‎05-04-2017 06:03 AM

You can't have overlapping IP's assigned to an interface. The additional IP's can just be used in NAT policy to provide additional public IP access. As long as the IP's used in NAT policy belong to the same subnet as the external interface then no routing configuration is needed either.

by nathaniel.mills
on ‎08-16-2017 07:02 AM

Hi,

 

Is it possible to assign all the secondary IP addresses to a single interface and then use subinterfaces in the VM configuration?

 

i.e in the above illustration:

 

eth1 (untrust)

Primary - Public1

Secondary - Public 2

Secondary - Public 3

 

and then in the VM

eth1

eth1/1.1 - Public1

eth1/1.2 - Public2

eth1/1.3 - Public3

Ask Questions Get Answers Join the Live Community
Contributors