Unable to use the allocated IP service Tags for outbound IP deployments

Hey Kishore Bhojan

Good day.

The error “VipAllocationFailedWithVipRangeNotFound”) means the NAT Gateway couldn’t find any VIP ranges matching the service-tagged IP you tried to use.

In practice this usually boils down to one of a few misconfigurations or unsupported scenarios:

1. SKU or routing preference mismatch

• NAT Gateway only supports Standard‐SKU public IPs (or StandardV2 for IPv6)

• Your public IP (or prefix) must be set to route over Microsoft Global Network, not “Internet”

• DDoS-protected IPs aren’t supported

2. Region/zone support

• Service-tagged public IPs for NAT Gateway are only available in certain regions

• Make sure your NAT Gateway and the service-tagged IP live in the same region (and zone config if you assigned one)

3. IP prefix size limits

• A Standard NAT Gateway can only consume up to 16 IPv4 addresses (so your prefix must be /28 or smaller)

Follow up queries

• Which service tag (and region) are you using?

• Are you attaching via the portal, CLI or ARM template?

• What’s the SKU of your public IP/prefix and its routing preference?

• Is DDoS Protection turned on?

• Which NAT Gateway SKU and availability-zone setting are you on?

Have also shared support ticket link via private message for possible escalation to engineering team.

References:

1. Design virtual networks with Azure NAT Gateway (service-tagged public IPs) https://docs.microsoft.com/azure/nat-gateway/nat-gateway-design#how-to-use-service-tagged-public-ips-with-nat-gateway
2. Troubleshoot Azure NAT Gateway public IP issues https://docs.microsoft.com/azure/nat-gateway/troubleshoot-nat#add-or-remove-public-ip-addresses
3. Common NAT Gateway outbound connectivity troubleshooting https://docs.microsoft.com/azure/virtual-network/nat-gateway/troubleshoot-nat-connectivity

I think that err hits when the ServiceTag’s VIP block just isn’t on ur subscription’s outbound path yet… easiest check is curl’ing the tag’s raw range API from the same subnet; if ur region’s not in it, config won’t move it and support has to light that path.