Ensure zone resilient outbound connectivity with NAT gateway | Azure Blog and Updates

Our prospects—throughout all industries—have a important want for extremely obtainable and resilient cloud frameworks to make sure enterprise continuity and adaptableness of ever-growing workloads. A technique that prospects can obtain resilient and dependable infrastructures in Microsoft Azure (for outbound connectivity) is by establishing their deployments throughout availability zones in a area.

When prospects want to attach outbound to the web from their Azure infrastructures, Community Deal with Translation (NAT) gateway is the easiest way. NAT gateway is a zonal useful resource that’s configured to subnets from the identical digital community, which signifies that it may be deployed to particular person zones to permit outbound connectivity. Subnets and digital networks, then again, are regional constructs that aren’t restricted to particular person zones. Subnets can comprise digital machine cases or scale units spanning throughout a number of availability zones.

Even with out having the ability to traverse a number of availability zones, NAT gateway nonetheless gives a extremely resilient and dependable solution to join outbound to the web. It’s because it doesn’t depend on any single compute occasion like a digital machine. As a substitute, NAT gateway leverages software-defined networking to function as a completely managed and distributed service with built-in redundancy. This built-in redundancy signifies that prospects are unlikely to expertise particular person NAT gateway useful resource outages or downtime of their Azure infrastructures.

To make sure that you’ve got the optimum outbound configuration to fulfill your availability and safety wants whereas additionally safeguarding in opposition to zonal outages, let’s take a look at create zone resilient setups in Azure with NAT gateway.

Zone resilient outbound connectivity eventualities with NAT gateway

Buyer setup

As an example you’re a retailer who’s making ready for an upcoming Black Friday occasion. You anticipate that site visitors to your retail web site will improve considerably on the day of the sale. You determine to deploy a digital machine scale set (VMSS) in order that means your compute assets can mechanically scale out to fulfill the elevated site visitors calls for. Scalability isn’t the one requirement you’ve got in preparation for this occasion, but in addition resiliency and safety. To make sure that you safeguard in opposition to potential zonal outages that might affect site visitors circulate, you determine to deploy these VMSS throughout a number of availability zones. Along with utilizing VMSS in a number of availability zones, you propose to make use of NAT gateway to deal with all outbound site visitors circulate in a scalable, safe, and dependable method.

How must you arrange your NAT gateway together with your VMSS throughout a number of availability zones? Let’s check out a couple of completely different configurations together with which setups will and gained’t work.

Situation 1: Arrange a single zonal NAT gateway together with your zone-spanning VMSS

First, you determine to deploy a single NAT gateway useful resource to availability zone 1 and your VMSS throughout all three availability zones throughout the identical subnet. You then configure your NAT gateway to this single subnet and to a /28 public IP prefix, which gives you a contiguous set of 16 public IP addresses for connecting outbound. Does this setup safeguard you in opposition to potential zone outages? No.

Determine 1: A single zonal NAT gateway configured to a zone-spanning set of digital machines doesn’t present optimum zone resiliency. NAT gateway is deployed out of zone 1 and configured to a subnet that incorporates a VMSS that spans throughout all three availability zones of the Azure area. If availability zone 1 goes down, outbound connectivity throughout all three zones may also go down.

Right here’s why:

1. If the zone that goes down can be the zone during which NAT gateway has been deployed then all outgoing site visitors from digital machines throughout all zones might be blocked.
2. If the zone that goes down is completely different than the zone that NAT gateway has been deployed in, then outgoing site visitors from the opposite zones will nonetheless happen and solely digital machines from the zone that has gone down might be impacted.

Situation 2: Connect a number of NAT gateways to a single subnet

For the reason that earlier configuration won’t present the very best diploma of resiliency, you determine you’ll as an alternative deploy three NAT gateway assets, one in every availability zone, and fix them to the subnet that incorporates the VMSS. Will this setup work? Sadly, no.

Determine 2: A number of NAT gateways can’t be hooked up to a single subnet by design.

Right here’s why:

A subnet can’t have a couple of NAT gateway hooked up to it and it’s not potential to arrange a number of NAT gateways on a single subnet. When NAT gateway is configured to a subnet, NAT gateway turns into the default subsequent hop sort for community site visitors earlier than reaching the web. Consequently, digital machines in a subnet will supply NAT to the general public IP deal with(es) of NAT gateway earlier than egressing to the web. If a couple of NAT gateway have been to be hooked up to the identical subnet, the subnet wouldn’t know which NAT gateway to make use of to ship outbound site visitors.

Situation three: Deploy zonal NAT gateways with zonally configured VMSS for optimum zone resiliency

What’s the optimum resolution then for making a safe, resilient, and scalable outbound setup? The answer is to deploy a VMSS in every availability zone, configure every to their very own respective subnet after which connect every subnet to a zonal NAT gateway useful resource.

Determine three: Zonal NAT gateways configured to particular person subnets for zonal VMSS present optimum zone resiliency for outbound connectivity.

Deploying zonal NAT gateways to match the zones of the VMSS gives the best safety in opposition to zonal outages. Ought to one of many availability zones go down, the opposite two zones will nonetheless be capable of egress outbound site visitors from the opposite two zonal NAT gateway assets.

Abstract of zone resilient eventualities with NAT gateway

FAQ on NAT gateway and availability zones

1. What does it imply to have a “no zone” NAT gateway?
   • “No zone” is the default availability zone chosen if you deploy a NAT gateway useful resource. No zone signifies that Azure locations the NAT gateway useful resource right into a zone for you, however you don’t have visibility into which zone it’s particularly positioned. It’s endorsed that you simply deploy your NAT gateway to particular zones in order that you already know during which zone your NAT gateway useful resource resides. As soon as NAT gateway is deployed, the provision zone designation can’t be modified.

2. If I’ve Load Balancer or instance-level public IPs (IL PIPs) on digital machines and NAT gateway deployed in the identical digital community and NAT gateway or an availability zone goes down, will Azure fall again to utilizing Load Balancer or IL PIPs for all outbound site visitors?
   • Azure won’t failover to utilizing Load Balancer or IL PIPs for dealing with outbound site visitors when NAT gateway is configured to a subnet. After NAT gateway has been hooked up to a subnet, the user-defined route (UDR) on the supply digital machine will all the time direct digital machine–initiated packets to the NAT gateway even when the NAT gateway goes down.

Study extra