Skip to content

Commit 3cd78ba

Browse files
Stacyrch140Stacyrch140
authored
Merge pull request #256993 from cachai2/NSGupdate2
update NSG
2 parents 5e2a4b3 + 0bc844f commit 3cd78ba

File tree

1 file changed

+16
-17
lines changed

1 file changed

+16
-17
lines changed

‎articles/container-apps/firewall-integration.md

Lines changed: 16 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -26,56 +26,55 @@ The following tables describe how to configure a collection of NSG allow rules.
2626

2727
### Inbound
2828

29-
# [Workload profiles environment](#tab/workload-profiles-env)
29+
# [Workload profiles environment](#tab/workload-profiles)
3030

3131
>[!Note]
32-
> When using workload profiles, inbound NSG rules only apply for traffic going through your virtual network. If your container apps are set to accept traffic from the public internet, incoming traffic will go through the public endpoint instead of the virtual network.
32+
> When using workload profiles, inbound NSG rules only apply for traffic going through your virtual network. If your container apps are set to accept traffic from the public internet, incoming traffic goes through the public endpoint instead of the virtual network.
3333
34-
| Protocol | Source | Source Ports | Destination | Destination Ports | Description |
34+
| Protocol | Source | Source ports | Destination | Destination ports | Description |
3535
|--|--|--|--|--|--|
36-
| TCP | Your Client IPs | \* | Your container app's subnet<sup>1</sup> | `443`, `30,000-32,676`<sup>2</sup> | Allow your Client IPs to access Azure Container Apps. |
36+
| TCP | Your client IPs | \* | Your container app's subnet<sup>1</sup> | `443`, `30,000-32,676`<sup>2</sup> | Allow your Client IPs to access Azure Container Apps. |
3737
| TCP | AzureLoadBalancer | \* | Your container app's subnet | `30,000-32,676`<sup>2</sup> | Allow Azure Load Balancer to probe backend pools. |
3838

39-
# [Consumption only environment](#tab/consumption-only-env)
39+
# [Consumption only environment](#tab/consumption-only)
4040

41-
| Protocol | Source | Source Ports | Destination | Destination Ports | Description |
41+
| Protocol | Source | Source ports | Destination | Destination ports | Description |
4242
|--|--|--|--|--|--|
43-
| TCP | Your Client IPs | \* | Your container app's subnet<sup>1</sup> | `443` | Allow your Client IPs to access Azure Container Apps. |
43+
| TCP | Your client IPs | \* | Your container app's subnet<sup>1</sup> | `443` | Allow your Client IPs to access Azure Container Apps. |
44+
| TCP | Your client IPs | \* | The `staticIP` of your container app environment | `443` | Allow your Client IPs to access Azure Container Apps. |
4445
| TCP | AzureLoadBalancer | \* | Your container app's subnet | `30,000-32,676`<sup>2</sup> | Allow Azure Load Balancer to probe backend pools. |
46+
| TCP | Your container app's subnet | \* | Your container app's subnet | \* | Required to allow the container app envoy sidecar to connect to envoy service. |
4547

4648
---
4749

4850
<sup>1</sup> This address is passed as a parameter when you create an environment. For example, `10.0.0.0/21`.
49-
<sup>2</sup> The full range is required when creating your Azure Container Apps as a port within the range will by dynamically allocated. Once created, the required ports are 2 immutable, static values, and you can update your NSG rules.
51+
<sup>2</sup> The full range is required when creating your Azure Container Apps as a port within the range will by dynamically allocated. Once created, the required ports are two immutable, static values, and you can update your NSG rules.
5052

5153

5254
### Outbound
5355

54-
# [Workload profiles environment](#tab/workload-profiles-env)
56+
# [Workload profiles environment](#tab/workload-profiles)
5557

56-
| Protocol | Source | Source Ports | Destination | Destination Ports | Description |
58+
| Protocol | Source | Source ports | Destination | Destination ports | Description |
5759
|--|--|--|--|--|--|
5860
| TCP | Your container app's subnet<sup>1</sup> | \* | Your Container Registry | Your container registry's port | This is required to communicate with your container registry. For example, when using ACR, you need `AzureContainerRegistry` and `AzureActiveDirectory` for the destination, and the port will be your container registry's port unless using private endpoints.<sup>2</sup> |
59-
| TCP | Your container app's subnet | \* | `AzureMonitor` | `443` | Allows outbound calls to Azure Monitor. |
6061
| TCP | Your container app's subnet | \* | `MicrosoftContainerRegistry` | `443` | This is the service tag for Microsoft container registry for system containers. |
6162
| TCP | Your container app's subnet | \* | `AzureFrontDoor.FirstParty` | `443` | This is a dependency of the `MicrosoftContainerRegistry` service tag. |
62-
| UDP | Your container app's subnet | \* | \* | `123` | NTP server. |
6363
| Any | Your container app's subnet | \* | Your container app's subnet | \* | Allow communication between IPs in your container app's subnet. |
6464
| TCP | Your container app's subnet | \* | `AzureActiveDirectory` | `443` | If you're using managed identity, this is required. |
65+
| TCP | Your container app's subnet | \* | `AzureMonitor` | `443` | Only required when using Azure Monitor. Allows outbound calls to Azure Monitor. |
6566

66-
# [Consumption only environment](#tab/consumption-only-env)
67+
# [Consumption only environment](#tab/consumption-only)
6768

68-
| Protocol | Source | Source Ports | Destination | Destination Ports | Description |
69+
| Protocol | Source | Source ports | Destination | Destination ports | Description |
6970
|--|--|--|--|--|--|
7071
| TCP | Your container app's subnet<sup>1</sup> | \* | Your Container Registry | Your container registry's port | This is required to communicate with your container registry. For example, when using ACR, you need `AzureContainerRegistry` and `AzureActiveDirectory` for the destination, and the port will be your container registry's port unless using private endpoints.<sup>2</sup> |
7172
| UDP | Your container app's subnet | \* | `AzureCloud.<REGION>` | `1194` | Required for internal AKS secure connection between underlying nodes and control plane. Replace `<REGION>` with the region where your container app is deployed. |
7273
| TCP | Your container app's subnet | \* | `AzureCloud.<REGION>` | `9000` | Required for internal AKS secure connection between underlying nodes and control plane. Replace `<REGION>` with the region where your container app is deployed. |
73-
| TCP | Your container app's subnet | \* | `AzureMonitor` | `443` | Allows outbound calls to Azure Monitor. |
7474
| TCP | Your container app's subnet | \* | `AzureCloud` | `443` | Allowing all outbound on port `443` provides a way to allow all FQDN based outbound dependencies that don't have a static IP. |
7575
| UDP | Your container app's subnet | \* | \* | `123` | NTP server. |
76-
| TCP | Your container app's subnet | \* | \* | `5671` | Container Apps control plane. |
77-
| TCP | Your container app's subnet | \* | \* | `5672` | Container Apps control plane. |
7876
| Any | Your container app's subnet | \* | Your container app's subnet | \* | Allow communication between IPs in your container app's subnet. |
77+
| TCP | Your container app's subnet | \* | `AzureMonitor` | `443` | Only required when using Azure Monitor. Allows outbound calls to Azure Monitor. |
7978

8079
---
8180

0 commit comments

Comments
 (0)