We are observing Azure Advisor alerts indicating that several virtual machines are currently using default outbound public IP connectivity. Microsoft is recommending a move away from this default behavior to improve security, compliance, and network contr

Question

We are observing Azure Advisor alerts indicating that several virtual machines are currently using default outbound public IP connectivity. Microsoft is recommending a move away from this default behavior to improve security, compliance, and network contr

KARYA Cloud Support 0

Check documentation for any gotcha or procedures that we are missing according to our infrastructure. Some servers have public IP addresses, verify how this is affected if it goes through a NAT gateway.
Verify if this gateway also needs a security group or there's no need for it. Some servers have their own NSG.
Check if the IP addresses from our servers will exit from the same NAT gateway IP address or how this will be configured.
Check if the NAT gateway will need firewall configuration or how does it work if we have a Palo Alto firewall that controls the traffic and policies.

0 comments

1 answer

Your answer

Answer 1

Hello KARYA Cloud Support

The default outbound access IP is owned by Microsoft and is subject to change without notice. The end user has no visibility of this default outbound access public IP address. This default outbound access public IP isn’t recommended for production workloads

Documentation Review and Gotchas:

It's crucial to understand that if a NAT gateway is configured, but default outbound IP alerts still appear, it might be because the VMs in non-private subnets are retaining their default outbound IPs. To clear these alerts, you'd need to switch to a private subnet and then perform a stop and deallocate on the affected VMs. This process ensures that they transition to using the NAT gateway exclusively.

Refer these docs:

Why do I see an alert showing I have a default outbound IP on my VM?

How do I clear this alert?

Network Security Groups (NSGs):

For your NAT gateway, you do not explicitly need to set NSG rules unless you're filtering traffic. However, if any associated servers already have their own NSGs, you should ensure there are no conflicting rules that could impede the NAT gateway's operations.

User's image

Refer this doc: Use NAT gateway instead of default outbound access

NAT Gateway IP Address Configuration:

All your servers using the NAT gateway should exit through the public IP address associated with that NAT gateway. You can confirm the NAT gateway's outbound IP settings by navigating to the NAT gateway resource in the Azure portal and checking the "Outbound IP" section.

Firewall Configurations:

The NAT gateway itself does not require specific firewall rules. However, if you're controlling traffic with a Palo Alto firewall, ensure that its policies allow traffic from the NAT gateway's public IP. Ensure that any necessary ports or services intended for use are explicitly allowed through the firewall.

Refer these docs:

I hope this has been helpful!

If the above is unclear or you are unsure about something, please add a comment below.

If these answer your question, click "Upvote" and click "Accept Answer" which may be beneficial to other community members reading this thread.