You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/api-management/api-management-howto-disaster-recovery-backup-restore.md
+2-7Lines changed: 2 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ author: dlepow
7
7
8
8
ms.service: api-management
9
9
ms.topic: how-to
10
-
ms.date: 07/27/2022
10
+
ms.date: 11/30/2023
11
11
ms.author: danlep
12
12
ms.custom: devx-track-azurepowershell
13
13
---
@@ -334,13 +334,8 @@ Restore is a long-running operation that may take up to 30 or more minutes to co
334
334
335
335
## Storage networking constraints
336
336
337
-
### Access using storage access key
338
-
339
-
If the storage account is **[firewall][azure-storage-ip-firewall] enabled** and a storage key is used for access, then the customer must **Allow** the set of [Azure API Management control plane IP addresses][control-plane-ip-address] on their storage account for backup or restore to work. The storage account can be in any Azure region except the one where the API Management service is located. For example, if the API Management service is in West US, then the Azure Storage account can be in West US 2 and the customer needs to open the control plane IP 13.64.39.16 (API Management control plane IP of West US) in the firewall. This is because the requests to Azure Storage aren't SNATed to a public IP from compute (Azure API Management control plane) in the same Azure region. Cross-region storage requests will be SNATed to the public IP address.
340
-
341
-
### Access using managed identity
342
337
343
-
If an API Management system-assigned managed identity is used to access a firewall-enabled storage account, ensure that the storage account [grants access to trusted Azure services](../storage/common/storage-network-security.md?tabs=azure-portal#grant-access-to-trusted-azure-services).
338
+
If the storage account is **[firewall][azure-storage-ip-firewall] enabled**, it's recommended to use the API Management instance's system-assigned managed identity for access to the account. Ensure that the storage account [grants access to trusted Azure services](../storage/common/storage-network-security.md?tabs=azure-portal#grant-access-to-trusted-azure-services).
344
339
345
340
## What is not backed up
346
341
-**Usage data** used for creating analytics reports **isn't included** in the backup. Use [Azure API Management REST API][azure api management rest api] to periodically retrieve analytics reports for safekeeping.
Copy file name to clipboardExpand all lines: articles/api-management/virtual-network-reference.md
+13-72Lines changed: 13 additions & 72 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ author: dlepow
6
6
7
7
ms.service: api-management
8
8
ms.topic: reference
9
-
ms.date: 10/19/2023
9
+
ms.date: 11/29/2023
10
10
ms.author: danlep
11
11
ms.custom: references_regions
12
12
---
@@ -25,7 +25,7 @@ When an API Management service instance is hosted in a VNet, the ports in the fo
25
25
>[!IMPORTANT]
26
26
> ***Bold** items in the *Purpose* column indicate port configurations required for successful deployment and operation of the API Management service. Configurations labeled "optional" enable specific features, as noted. They are not required for the overall health of the service.
27
27
>
28
-
> * We recommend using [service tags](../virtual-network/service-tags-overview.md) instead of IP addresses in NSG rules to specify network sources and destinations. Service tags prevent downtime when infrastructure improvements necessitate IP address changes.
28
+
> * We recommend using the indicated [service tags](../virtual-network/service-tags-overview.md) instead of IP addresses in NSG and other network rules to specify network sources and destinations. Service tags prevent downtime when infrastructure improvements necessitate IP address changes.
29
29
30
30
31
31
### [stv2](#tab/stv2)
@@ -137,85 +137,26 @@ The following settings and FQDNs are required to maintain and diagnose API Manag
137
137
138
138
## Control plane IP addresses
139
139
140
-
The following IP addresses are divided by **Azure Environment** and **Region**. In some cases, two IP addresses are listed. Permit both IP addresses.
141
-
142
140
> [!IMPORTANT]
143
-
> Control plane IP addresses should be configured for network access rules only when needed in certain networking scenarios. We recommend using the **ApiManagement**[service tag](../virtual-network/service-tags-overview.md) instead of control plane IP addresses to prevent downtime when infrastructure improvements necessitate IP address changes.
> Control plane IP addresses for Azure API Management should be configured for network access rules only when needed in certain networking scenarios. We recommend using the **ApiManagement**[service tag](../virtual-network/service-tags-overview.md) instead of control plane IP addresses to prevent downtime when infrastructure improvements necessitate IP address changes.
142
+
143
+
144
+
145
+
## Related content
210
146
211
147
Learn more about:
212
148
213
149
*[Connecting a virtual network to backend using VPN Gateway](../vpn-gateway/design.md#s2smulti)
214
150
*[Connecting a virtual network from different deployment models](../vpn-gateway/vpn-gateway-connect-different-deployment-models-powershell.md)
215
-
*[Debug your APIs using request tracing](api-management-howto-api-inspector.md)
Copy file name to clipboardExpand all lines: includes/api-management-virtual-network-forced-tunneling.md
+2-5Lines changed: 2 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
author: dlepow
3
3
ms.service: api-management
4
4
ms.topic: include
5
-
ms.date: 06/01/2022
5
+
ms.date: 11/29/2023
6
6
ms.author: danlep
7
7
---
8
8
@@ -21,11 +21,8 @@ Forced tunneling lets you redirect or "force" all internet-bound traffic from yo
21
21
> [!NOTE]
22
22
> We strongly recommend enabling service endpoints directly from the API Management subnet to dependent services such as Azure SQL and Azure Storage that support them. However, some organizations may have requirements to force tunnel all traffic from the API Management subnet. In this case, ensure that you configure your firewall or virtual appliance to allow this traffic. You will need to allow the complete [IP address range](https://www.microsoft.com/download/details.aspx?id=56519) of each dependent service, and keep this configuration up to date when the Azure infrastructure changes. Your API Management service may also experience latency or unexpected timeouts because of the force tunneling of this network traffic.
23
23
24
-
* All the control plane traffic from the internet to the management endpoint of your API Management service is routed through a specific set of inbound IPs, hosted by API Management. When the traffic is force tunneled, the responses won't symmetrically map back to these inbound source IPs and connectivity to the management endpoint is lost. To overcome this limitation, configure user-defined routes ([UDRs][UDRs]) for these inbound IPs with next hop type set to "Internet", to steer traffic back to Azure. Configure the **ApiManagement**[service tag](../articles/virtual-network/service-tags-overview.md), or find the set of inbound IPs for control plane traffic documented in [Control plane IP addresses](../articles/api-management/virtual-network-reference.md#control-plane-ip-addresses).
24
+
* All the control plane traffic from the internet to the management endpoint of your API Management service is routed through a specific set of inbound IPs, hosted by API Management, encompassed by the **ApiManagement**[service tag](../articles/virtual-network/service-tags-overview.md). When the traffic is force tunneled, the responses won't symmetrically map back to these inbound source IPs and connectivity to the management endpoint is lost. To overcome this limitation, configure a user-defined route ([UDR][UDRs]) for the ApiManagement service tag with next hop type set to "Internet", to steer traffic back to Azure.
25
25
26
-
> [!IMPORTANT]
27
-
> Control plane IP addresses should be configured for network access rules and routes only when needed in certain networking scenarios. We recommend using the ApiManagement service tag instead of control plane IP addresses to prevent downtime when infrastructure improvements necessitate IP address changes.
28
-
29
26
> [!NOTE]
30
27
> Allowing API Management management traffic to bypass an on-premises firewall or network virtual appliance isn't considered a significant security risk. The [recommended configuration](../articles/api-management/virtual-network-reference.md#required-ports) for your API Management subnet allows inbound management traffic on port 3443 only from the set of Azure IP addresses encompassed by the ApiManagement service tag. The recommended UDR configuration is only for the return path of this Azure traffic.
0 commit comments