Skip to content

Commit 04ad639

Browse files
authored
Merge pull request #107486 from asudbring/natpatch
tweaks to wording
2 parents a60fbd0 + 0df12df commit 04ad639

File tree

2 files changed

+15
-13
lines changed

2 files changed

+15
-13
lines changed

articles/virtual-network/nat-overview.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -191,7 +191,7 @@ We want to know how we can improve the service. Share your [feedback on the Publ
191191
## Limitations
192192
193193
* NAT is compatible with standard SKU public IP, public IP prefix, and load balancer resources. Basic resources (for example basic load balancer) and any products derived from them aren't compatible with NAT. Basic resources must be placed on a subnet not configured with NAT.
194-
* IPv4 address family is supported. NAT doesn't interact with IPv6 address family. NAT cannot be deployed on a subnet with IPv6 prefix.
194+
* IPv4 address family is supported. NAT doesn't interact with IPv6 address family. NAT can't be deployed on a subnet with an IPv6 prefix.
195195
* NSG flow logging isn't supported when using NAT.
196196
* NAT can't span multiple virtual networks.
197197

articles/virtual-network/troubleshoot-nat.md

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ Frequently the root cause of SNAT exhaustion is an anti-pattern for how outbound
4949

5050
#### Design patterns
5151

52-
Always take advantage of connection reuse and connection pooling whenever possible. These patterns will avoid resource exhaustion problems outright and result in predictable, reliable, and scalable behavior. Primitives for these patterns can be found in many development libraries and frameworks.
52+
Always take advantage of connection reuse and connection pooling whenever possible. These patterns will avoid resource exhaustion problems and result in predictable behavior. Primitives for these patterns can be found in many development libraries and frameworks.
5353

5454
_**Solution:**_ Use appropriate patterns
5555

@@ -85,14 +85,14 @@ The following table can be used a starting point for which tools to use to start
8585

8686
### Connectivity failures
8787

88-
Connectivity issues with [Virtual Network NAT](nat-overview.md) can be due to several different issues:
88+
Connectivity issues with [Virtual Network NAT](nat-overview.md) can be caused by several different issues:
8989

9090
* transient or persistent [SNAT exhaustion](#snat-exhaustion) of the NAT gateway,
9191
* transient failures in the Azure infrastructure,
9292
* transient failures in the path between Azure and the public Internet destination,
9393
* transient or persistent failures at the public Internet destination.
9494

95-
Use tools like the following to validation connectivity. [ICMP ping is not supported](#icmp-ping-is-failing).
95+
Use tools like the following to validation connectivity. [ICMP ping isn't supported](#icmp-ping-is-failing).
9696

9797
| Operating system | Generic TCP connection test | TCP application layer test | UDP |
9898
|---|---|---|---|
@@ -105,32 +105,32 @@ Review section on [SNAT exhaustion](#snat-exhaustion) in this article.
105105

106106
#### Azure infrastructure
107107

108-
Even though Azure monitors and operates its infrastructure with great care, transient failures can occur as there is no guarantee that transmissions are lossless. Use design patterns that allow for SYN retransmissions for TCP applications. Use connection timeouts large enough to permit TCP SYN retransmission to reduce transient impacts caused by a lost SYN packet.
108+
Azure monitors and operates its infrastructure with great care. Transient failures can occur, there's no guarantee that transmissions are lossless. Use design patterns that allow for SYN retransmissions for TCP applications. Use connection timeouts large enough to permit TCP SYN retransmission to reduce transient impacts caused by a lost SYN packet.
109109

110110
_**Solution:**_
111111

112112
* Check for [SNAT exhaustion](#snat-exhaustion).
113113
* The configuration parameter in a TCP stack that controls the SYN retransmission behavior is called RTO ([Retransmission Time-Out](https://tools.ietf.org/html/rfc793)). The RTO value is adjustable but typically 1 second or higher by default with exponential back-off. If your application's connection time-out is too short (for example 1 second), you may see sporadic connection timeouts. Increase the application connection time-out.
114114
* If you observe longer, unexpected timeouts with default application behaviors, open a support case for further troubleshooting.
115115

116-
We do not recommend artificially reducing the TCP connection timeout or tuning the RTO parameter.
116+
We don't recommend artificially reducing the TCP connection timeout or tuning the RTO parameter.
117117

118-
#### public Internet transit
118+
#### Public Internet transit
119119

120-
The probability of transient failures increases with a longer path to the destination and more intermediate systems. It is expected that transient failures can increase in frequency over [Azure infrastructure](#azure-infrastructure).
120+
The chances of transient failures increases with a longer path to the destination and more intermediate systems. It's expected that transient failures can increase in frequency over [Azure infrastructure](#azure-infrastructure).
121121

122122
Follow the same guidance as preceding [Azure infrastructure](#azure-infrastructure) section.
123123

124124
#### Internet endpoint
125125

126-
The preceding sections apply in addition to considerations related to the Internet endpoint your communication is established with. Other factors that can impact connectivity success are:
126+
The previous sections apply, along with the Internet endpoint that communication is established with. Other factors that can impact connectivity success are:
127127

128128
* traffic management on destination side, including
129129
- API rate limiting imposed by the destination side
130130
- Volumetric DDoS mitigations or transport layer traffic shaping
131131
* firewall or other components at the destination
132132

133-
Usually packet captures at the source as well as destination (if available) are required to determine what is taking place.
133+
Usually packet captures at the source and the destination (if available) are required to determine what is taking place.
134134

135135
_**Solution:**_
136136

@@ -142,9 +142,11 @@ _**Solution:**_
142142

143143
#### TCP Resets received
144144

145-
If you observe TCP Resets (TCP RST packets) received on the source VM, they can be generated by the NAT gateway on the private side for flows that are not recognized as in progress. One possible reason is the TCP connection has idle timed out. You can adjust the idle timeout from 4 minutes to up to 120 minutes.
145+
The NAT gateway generates TCP resets on the source VM for traffic that isn't recognized as in progress.
146146

147-
TCP Resets are not generated on the public side of NAT gateway resources. If you receive TCP Resets on the destination side, they are generated by the source VM's stack and not the NAT gateway resource.
147+
One possible reason is the TCP connection has idle timed out. You can adjust the idle timeout from 4 minutes to up to 120 minutes.
148+
149+
TCP Resets aren't generated on the public side of NAT gateway resources. TCP resets on the destination side are generated by the source VM, not the NAT gateway resource.
148150

149151
_**Solution:**_
150152

@@ -153,7 +155,7 @@ _**Solution:**_
153155

154156
### IPv6 coexistence
155157

156-
[Virtual Network NAT](nat-overview.md) supports IPv4 UDP and TCP protocols and deployment on a [subnet with IPv6 prefix is not supported](nat-overview.md#limitations).
158+
[Virtual Network NAT](nat-overview.md) supports IPv4 UDP and TCP protocols and deployment on a [subnet with an IPv6 prefix isn't supported](nat-overview.md#limitations).
157159

158160
_**Solution:**_ Deploy NAT gateway on a subnet without IPv6 prefix.
159161

0 commit comments

Comments
 (0)