When creating a NatGateway, how to associate it with a Subnet of an existing Vnet

[coffeejunjun]

Hello.
When creating a NatGateway in Bicep, is there a way to tie it to a Subnet of a Vnet that has already been created?
Thanks.

[aventre-bag]

Trying the same

[Alexprosp247]

Also trying to do this as well. Subnet and nat gateway are in the same deployment but for some reason it doesn't associate.

[ankurcharan]

Yes, when creating a NAT Gateway with bicep, you can associate it with an existing subnet.

var existingVNetName = 'vnet-1'
var existingSubnetName = 'subnet-1'

resource vnet 'Microsoft.Network/virtualNetworks@2023-05-01' existing = {
  name: existingVNetName
}

resource natgateway 'Microsoft.Network/natGateways@2023-06-01' = {
    // trimmed params 
}

resource updatedsubnet01 'Microsoft.Network/virtualNetworks/subnets@2023-06-01' = {
  parent: vnet
  name: existingSubnetName  // this needs to be static values, as calculated at start of deployment. so you cannot put the name of subnet as vnet.properties.subnets[0].properties.name
  properties: {
    addressPrefix: vnet.properties.subnets[0].properties.addressPrefix
    natGateway: {
      id: natgateway.id
    }
  }
}

[kaverkiev]

Does not work for me

I use this arm with incremental mode:
{

                    "name": "subase-003",
                    "properties": {
                        "addressPrefix": "*.*.*.*/24",
                        "networkSecurityGroup": {
                            "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('aseNsgName'))]"
                        },
                        "natGateway": {
                            "id": "[resourceId('Microsoft.Network/natGateways', parameters('natGatewayName'))]"
                        },
                        "routeTable": {
                            "id": "[resourceId('Microsoft.Network/routeTables', variables('aseRouteTableName'))]"
                        },
                        "serviceEndpoints": [
                            {
                                "service": "Microsoft.AzureCosmosDB",
                                "locations": [
                                    "*"
                                ]
                            }
                        ],
                        "delegations": [
                            {
                                "name": "[variables('delegationName')]",
                                "properties": {
                                    "serviceName": "Microsoft.Web/hostingEnvironments"
                                }
                            }
                        ],
                        "privateEndpointNetworkPolicies": "Disabled",
                        "privateLinkServiceNetworkPolicies": "Enabled",
                        "defaultOutboundAccess": false
                    }
                },

[uky2019]

You can do it probably by using "existing = {" and reference it as ID in VNET/subnet creation as such:

          natGateway: {
            id: NAT_GW.id
          } 

This is what works for me:

In same bicep file I create NAT gateway, and then on the VNET resource below i reference it and when VNET is deployed all subnets are already added to NAT gateway as such:

//Creates public IP for NAT Gateway resource
resource NATGW_PIP 'Microsoft.Network/publicIPAddresses@2021-02-01' = {
  name: 'NATGW-PIP'
  location: general.location
  sku: {
    name: 'Standard'
     tier: 'Regional'
  }
  properties: {
    publicIPAllocationMethod: 'Static'
  }
}

//Create NAT Gateway
resource NAT_GW 'Microsoft.Network/natGateways@2020-11-01' = {
  name: 'NATGW'
  location: general.location
  sku: {
    name: 'Standard'
  }
  properties: {
    idleTimeoutInMinutes: 4
    publicIpAddresses: [
      {
        id: NATGW_PIP.id
      }
    ]
  }
}


//Create VNET and subnets accordingly 
resource VNET 'Microsoft.Network/virtualNetworks@2020-06-01' = {
  name: 'VNET01'
  location: general.location
  properties: {
    addressSpace: {
      addressPrefixes: [
        network.addressPrefix
      ]
    }
    enableVmProtection: false
    enableDdosProtection: false
    subnets: [
      {
        name: 'APP-Subnet'
        properties: {
          addressPrefix: network.app_subprefix
          natGateway: {
            id: NAT_GW.id
          } 
          networkSecurityGroup: {
            id: NSG_APP.id
         }
        }
      }

[uky2019]

Oh I read to quickly, you already have a subnet/vnet deployed. I don't think you can, because NAT gateway must preexist or be created within the deployment of virtual network to be associated with. Similar to for example application gateway must already exist or be created with the virtual machine, to associate machine with app gw backend. There is no parameter on application gateway to somehow associate backend with virtual machine. To achieve what you want you have to deploy the NAT gw and rerun the VNET bicep to update the association and using "existing" for the NAT GW part...