3

Der Azure Networking Experts,

Our WebApps are frequently running out of outbound TCP connections. Most of the outbound connections are actually Azure-internal connections (SQL, BlobStore, Backend Services). But we don't have Virtual Network and Private Endpoints in place yet.

Could Virtual Network and Private Endpoints help solve our issue? I'd expect that by using internal IP addresses, there's no SNAT IP matching required at all?

I'm unfortunately no expert in networking, but I'm looking at this issue from WebApp-Developer perspective.. (the recommendations for how to save connections, like keepalive etc. are just not enough to fix the issue).. Any advice appreciated, however, we definietly prefer to use managed Azure services like auto-scalable WebApp farms.

2
  • what's your App Service plan looking like? (mostly interested in scale-up and scale-out settings you're on)
    – timur
    Nov 22, 2020 at 19:32
  • Web app is P2V2 scaled at 2 instances. Connecting to ~300 databases. SNAT stays at around 380 ports per instance. I have a separate plan for webjobs that is P2V2 scaled at 1 instance. It has 12 webjobs that connect to the ~300 databases at various intervals. SNAT stays at around 1100 ports with 1150 allocated. I see a few pending / failed connections per day. To be clear, 95% of the ports in use are between the web app and Azure SQL. I am trying to determine if a Vnet would eliminate the port contention.
    – ericdc
    Nov 23, 2020 at 17:55

1 Answer 1

1
+50

SNAT is used when you route outbound traffic through a public load balancer. App service plans are provisioned with public IP addresses and would not need SNAT out of the box. App service plans support vNet integration and can accesses other resources on their private IP addresses if the vnet peering is correctly configured.

Q: Could Virtual Network and Private Endpoints help solve our issue?

A: Yes, it would be a matter of configuring the vnet integration on the App Service plans and configuring private end points on the other azure resources. One might also look to utilize the public IPs of the services rather than putting things behind a load balancer.

Q: I'd expect that by using internal IP addresses, there's no SNAT IP matching required at all?

A: Yes, you should not need any SNAT IP matching.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.