Skip to content

Commit 4147aa3

Browse files
authored
Merge pull request #203671 from dlepow/patch-126
Update api-management-virtual-network-forced-tunneling.md (typo)
2 parents d8c26d2 + 54e54c8 commit 4147aa3

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

includes/api-management-virtual-network-forced-tunneling.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ Forced tunneling lets you redirect or "force" all internet-bound traffic from yo
2424
> Control plane IP addresses should be configured for network access rules and routes only when needed in certain networking scenarios. We recommend using the ApiManagement service tag instead of control plane IP addresses to prevent downtime when infrastructure improvements necessitate IP address changes.
2525
2626
> [!NOTE]
27-
> Allowing API Management management traffic to bypass an on-premises firewall or network virtual applicance isn't considered a significant security risk. The [recommended configuration](../articles/api-management/virtual-network-reference.md#required-ports) for your API Management subnet allows inbound management traffic on port 3443 only from the set of Azure IP addresses encompassed by the ApiManagement service tag. The recommended UDR configuration is only for the return path of this Azure traffic.
27+
> Allowing API Management management traffic to bypass an on-premises firewall or network virtual appliance isn't considered a significant security risk. The [recommended configuration](../articles/api-management/virtual-network-reference.md#required-ports) for your API Management subnet allows inbound management traffic on port 3443 only from the set of Azure IP addresses encompassed by the ApiManagement service tag. The recommended UDR configuration is only for the return path of this Azure traffic.
2828
2929
* (External VNet mode) Data plane traffic for clients attempting to reach the API Management gateway and developer portal from the internet will also be dropped by default because of asymmetric routing introduced by forced tunneling. For each client that requires access, configure an explicit UDR with next hop type "Internet" to bypass the firewall or virtual network appliance.
3030

@@ -40,4 +40,4 @@ For more information, see [Virtual network configuration reference](../articles/
4040
[UDRs]: ../articles/virtual-network/virtual-networks-udr-overview.md
4141
[NetworkSecurityGroups]: ../articles/virtual-network/network-security-groups-overview.md
4242
[ServiceEndpoints]: ../articles/virtual-network/virtual-network-service-endpoints-overview.md
43-
[ServiceTags]: ../articles/virtual-network/network-security-groups-overview.md#service-tags
43+
[ServiceTags]: ../articles/virtual-network/network-security-groups-overview.md#service-tags

0 commit comments

Comments
 (0)