Skip to content

Commit 336b3db

Browse files
AbdullahBellAbdullahBell
committed
updated draft.
1 parent 742cfc3 commit 336b3db

File tree

1 file changed

+99
-14
lines changed

1 file changed

+99
-14
lines changed

‎articles/private-link/plsnat-how-to-draft.md

Lines changed: 99 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,48 +1,133 @@
11
---
2-
title: Enable SNAT Bypass for Private Endpoint Traffic through NVA
2+
title: Disable SNAT requirement for Private Endpoint Traffic through NVA
33
description: Learn how to enable SNAT bypass for private endpoint traffic passing through a network virtual appliance (NVA) in Azure.
44
author: abell
55
ms.author: abell
66
ms.service: azure-private-link
77
ms.topic: how-to #Don't change
88
ms.date: 02/05/2025
99

10-
#customer intent: As a network administrator, I want to enable SNAT bypass for private endpoint traffic through NVA so that I can ensure symmetric routing and comply with internal logging standards.
10+
#customer intent: As a network administrator, I want to disable SNAT requirement for private endpoint traffic through NVA so that I can ensure symmetric routing and comply with internal logging standards.
1111

1212
---
1313

14-
# How to Guide: Enable SNAT Bypass for Private Endpoint Traffic through NVA
14+
# How to Guide: Disable SNAT requirement for Private Endpoint Traffic through NVA
1515

1616
Source network address translation (SNAT) is no longer required for private endpoint destined traffic passing through a network virtual appliance (NVA). You can now configure a tag on your NVA VMs to notify the Microsoft platform that you wish to opt into this feature. This means SNATing will no longer be necessary for private endpoint destined traffic traversing through your NVA.
1717

1818
Enabling this feature provides a more streamlined experience for guaranteeing symmetric routing without impacting non-private endpoint traffic. It also allows you to follow internal compliance standards where the source of traffic origination needs to be available during logging. This feature is available in all regions.
1919

2020

2121
> [!NOTE]
22-
> Enabling SNAT bypass for private endpoint traffic through a Network Virtual Appliance (NVA) will cause a one-time reset of all long-running private endpoint connections established through the NVA. To minimize disruption, it is recommended to enable this feature during a maintenance window. This update will only impact traffic passing through your NVA; private endpoint traffic that bypasses the NVA will not be affected.
22+
> Disabling SNAT for private endpoint traffic passing through a Network Virtual Appliance (NVA) will cause a one-time reset of all long-running private endpoint connections established through the NVA. To minimize disruption, it is recommended to configure this feature during a maintenance window. This update will only impact traffic passing through your NVA; private endpoint traffic that bypasses the NVA will not be affected.
2323
2424

2525
## Prerequisites
2626

27-
* An active Azure account with a subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
28-
* A configured private endpoint in your subscription. For more information on how to create a private endpoint, see [Create a private endpoint](https://docs.microsoft.com/azure/private-link/create-private-endpoint).
29-
* A network virtual appliance (NVA) deployed in your subscription. For the example in this article, a virtual machine (VM) is used as the NVA. For more information on how to deploy a VM, see [Create a Windows virtual machine in the Azure portal](https://docs.microsoft.com/azure/virtual-machines/windows/quick-create-portal).
27+
* An active Azure account with a subscription. [Create an account for free](https://azure.microsoft.com/free/).
28+
* A configured private endpoint in your subscription. For more information on how to create a private endpoint, see [Create a private endpoint](./create-private-endpoint-portal.md).
29+
* A network virtual appliance (NVA) deployed in your subscription. For the example in this article, a virtual machine (VM) is used as the NVA. For more information on how to deploy a VM, see [Quickstart: Create a Windows virtual machine in the Azure portal](/azure/virtual-machines/windows/quick-create-portal).
30+
* Understanding of how to add tags to Azure resources. For more information, see [Use tags to organize your Azure resources](../azure-resource-manager/management/tag-resources.md).
3031

32+
### Disable SNAT requirement for Private Endpoint Traffic through NVA
3133

32-
### Enable SNAT Bypass for Private Endpoint Traffic through NVA
34+
The type of NVA you are using will determine how to disable SNAT for private endpoint traffic passing through the NVA. For the virtual machine you will add a tag on the NIC while on the VMSS you will enable the tag on the VM instance.
3335

34-
1. **Confirm the type of NVA you are using (VM or VMSS based).**
36+
#### Add Tag to your VM NIC
3537

36-
1. **Add Tag to your relevant resource:**
37-
- **VM Based:** Add the Resource Tag with a key of `disableSnatOnPL` and a value of `true` to the VM NIC.
38-
- **VMSS Based:** Add the Resource Tag with a key of `disableSnatOnPL` and a value of `true` to the VM instance.
38+
# [**Portal**](#tab/vm-nic-portal)
3939

40-
1. **Validate Scenario.**
40+
1. Sign in to the [Azure portal](https://portal.azure.com).
41+
1. In the search bar at the top, type "Virtual machines" and select it from the services.
42+
1. From the list of VMs, select your virtual machine.
43+
1. In the left navigation pane under **Settings**, select **Networking**, then select **Network settings**.
44+
1. Under the **Network Interface** section, click on the NIC name. Now you are in the Network interface blade.
45+
1. In the left navigation pane under **Overview**, select **Tags**.
46+
1. Add a new tag with the following details:
47+
48+
| Field | Value |
49+
|-------|-------|
50+
| Name | `disableSnatOnPL` |
51+
| Value | `true` |
52+
53+
1. Select **Apply** to save the tag.
54+
55+
> [!NOTE]
56+
> The tag is case-sensitive. Ensure you enter it exactly as shown above.
57+
58+
# [**PowerShell**](#tab/vm-nic-powershell)
59+
60+
1. Use the following PowerShell command to add the tag to your VM NIC:
61+
62+
```azurepowershell-interactive
63+
$nic = Get-AzNetworkInterface -Name "myNIC" -ResourceGroupName "MyResourceGroup"
64+
$tags = @{
65+
"disableSnatOnPL" = "true"
66+
}
67+
Set-AzResource -ResourceId $nic.Id -Tag $tags -Force
68+
```
69+
70+
# [**Azure CLI**](#tab/vm-nic-cli)
71+
72+
1. Use the following CLI command to add the tag to your VM NIC:
73+
74+
```azurecli-interactive
75+
az network nic update --name "myNIC" --resource-group "MyResourceGroup" --set tags.disableSnatOnPL=string:"true"
76+
```
77+
78+
#### Add Tag to your VMSS
79+
80+
# [**Portal**](#tab/vmss-powershell)
81+
1. Sign in to the [Azure portal](https://portal.azure.com).
82+
1. In the search bar at the top, type "Virtual machine scale sets" and select it from the services.
83+
1. From the list of scale sets, select your VMSS.
84+
1. In the left navigation pane under **Overview**, select **Tags**.
85+
1. Add a new tag with the following details:
86+
87+
| Field | Value |
88+
|-------|-------|
89+
| Name | `disableSnatOnPL` |
90+
| Value | `true` |
91+
92+
1. Select **Apply** to save the tag.
93+
1.
94+
> [!NOTE]
95+
> The tag is case-sensitive. Ensure you enter it exactly as shown above.
96+
97+
# [**PowerShell**](#tab/vmss-powershell)
98+
99+
1. Use the following PowerShell command to add the tag to your VMSS:
100+
101+
```azurepowershell-interactive
102+
$vmss = Get-AzVmss -ResourceGroupName "MyResourceGroup" -VMScaleSetName "myVmss"
103+
$vmss.Tags.Add("disableSnatOnPL", "true")
104+
Update-AzVmss -ResourceGroupName "MyResourceGroup" -Name "myVmss" -VirtualMachineScaleSet $vmss
105+
```
106+
107+
# [**Azure CLI**](#tab/vmss-powershell)
108+
109+
1. Use the following Azure CLI command to add the tag to your VMSS:
110+
111+
```azurecli-interactive
112+
az vmss update --name "myVmss" --resource-group "MyResourceGroup" --set tags.disableSnatOnPL=true
113+
```
114+
115+
#### Validate the Tag
116+
117+
Verify the tag is present in the VM's NIC settings or VMSS settings.
118+
119+
1. Navigate to the **Tags** service in the Azure portal.
120+
1. In the **Filter by** field, type `disableSnatOnPL`.
121+
1. Select the tag from the list. Here you will see all resources with the tag.
122+
1. Select the resource to view the tag details.
123+
124+
To learn more, see [View resources by tag](../azure-resource-manager/management/tag-resources-portal.md#view-resources-by-tag).
41125

42126
## Next Step
43127

44128
> [!div class="nextstepaction"]
45-
> [Create a private endpoint](https://docs.microsoft.com/azure/private-link/create-private-endpoint)
129+
> [Create a private endpoint](./create-private-endpoint-portal.md)
130+
> [Manage Network Polices](./disable-private-endpoint-network-policy.md)
46131
47132

48133

0 commit comments

Comments
 (0)