Skip to content

Commit 4d7be7b

Browse files
dlepowdlepow
committed
[APIM] Workspace gateway networking
1 parent 9e4eb6d commit 4d7be7b

File tree

3 files changed

+33
-30
lines changed

3 files changed

+33
-30
lines changed

‎articles/api-management/how-to-create-workspace.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ author: dlepow
55
ms.topic: how-to
66
ms.service: azure-api-management
77
ms.author: danlep
8-
ms.date: 05/14/2025
8+
ms.date: 06/03/2025
99
ms.custom:
1010
---
1111

@@ -55,7 +55,7 @@ Follow the steps in this article to:
5555
> [!IMPORTANT]
5656
> Plan your workspace's network configuration carefully. You can't change the network configuration after you create the workspace.
5757
58-
* If you select a network configuration that includes private inbound or private outbound network access, select a **Virtual network** and **Subnet** to isolate the workspace gateway, or create a new one. For network requirements, see [Network resource requirements for workspace gateways](virtual-network-workspaces-resources.md).
58+
* If you select either **Inbound public access, outbound private access** (virtual network integration) or **Inbound private access, outbound private access (virtual network injection),, select a **Virtual network** and **Subnet** to isolate the workspace gateway, or create a new one. For network requirements, see [Network resource requirements for workspace gateways](virtual-network-workspaces-resources.md).
5959

6060
1. Select **Next**. After validation completes, select **Create**.
6161

‎articles/api-management/media/how-to-create-workspace/create-workspace-gateway.png

-4.97 KB
Loading

‎articles/api-management/virtual-network-workspaces-resources.md

Lines changed: 31 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,36 @@
11
---
22
title: Azure API Management workspace gateways - VNet integration - network resources
3-
description: Learn about requirements for network resources when you integrate your API Management workspace gateway in an Azure virtual network.
3+
description: Learn about requirements for network resources when you integrate or inject your API Management workspace gateway in an Azure virtual network.
44
author: dlepow
55

66
ms.service: azure-api-management
77
ms.topic: concept-article
8-
ms.date: 07/15/2024
8+
ms.date: 06/03/2025
99
ms.author: danlep
1010
---
1111

12-
# Network resource requirements for integration of a workspace gateway into a virtual network
12+
# Network resource requirements to integrate or inject a workspace gateway into a virtual network
1313

1414
[!INCLUDE [api-management-availability-premium](../../includes/api-management-availability-premium.md)]
1515

16-
Network isolation is an optional feature of an API Management [workspace gateway](workspaces-overview.md#workspace-gateway). This article provides network resource requirements when you integrate your gateway in an Azure virtual network. Some requirements differ depending on the desired inbound and outbound access mode. The following modes are supported:
16+
Network isolation is an optional feature of an API Management [workspace gateway](workspaces-overview.md#workspace-gateway). This article provides network resource requirements when you integrate or inject your gateway in an Azure virtual network. Some requirements differ depending on the desired inbound and outbound access mode. The following modes are supported:
1717

18-
* Public inbound access, private outbound access (Public/Private)
19-
* Private inbound access, private outbound access (Private/Private)
18+
* **Virtual network integration**: public inbound access, private outbound access
19+
* **Virtual network injection**: private inbound access, private outbound access
2020

21-
For information about networking options in API Management, see [Use a virtual network to secure inbound or outbound traffic for Azure API Management](virtual-network-concepts.md).
21+
For background about networking options in API Management, see [Use a virtual network to secure inbound or outbound traffic for Azure API Management](virtual-network-concepts.md).
2222

2323
[!INCLUDE [api-management-virtual-network-workspaces-alert](../../includes/api-management-virtual-network-workspaces-alert.md)]
2424

25+
## Network prerequisites
2526

26-
## Network location
27+
### Network location
2728

28-
* The virtual network must be in the same region and Azure subscription as the API Management instance.
29+
The virtual network must be in the same region and Azure subscription as the API Management instance.
2930

3031
### Dedicated subnet
3132

32-
* The subnet used for virtual network integration can only be used by a single workspace gateway. It can't be shared with another Azure resource.
33+
* The subnet used for virtual network integration or injection can only be used by a single workspace gateway. It can't be shared with another Azure resource.
3334

3435
## Subnet size
3536

@@ -42,19 +43,19 @@ The subnet must be delegated as follows to enable the desired inbound and outbou
4243

4344
For information about configuring subnet delegation, see [Add or remove a subnet delegation](../virtual-network/manage-subnet-delegation.md).
4445

45-
#### [Public/Private](#tab/external)
46+
#### [Virtual netowork integration](#tab/external)
4647

4748

48-
For Public/Private mode, the subnet needs to be delegated to the **Microsoft.Web/serverFarms** service.
49+
For virtual network integration, the subnet needs to be delegated to the **Microsoft.Web/serverFarms** service.
4950

5051
:::image type="content" source="media/virtual-network-injection-workspaces-resources/delegate-external.png" alt-text="Screenshot showing subnet delegation to Microsoft.Web/serverFarms in the portal.":::
5152

5253
> [!NOTE]
5354
> You might need to register the `Microsoft.Web/serverFarms` resource provider in the subscription so that you can delegate the subnet to the service.
5455
55-
#### [Private/Private](#tab/internal)
56+
#### [Virtual network injection](#tab/internal)
5657

57-
For Private/Private mode, the subnet needs to be delegated to the **Microsoft.Web/hostingEnvironments** service.
58+
For virtual network injection, the subnet needs to be delegated to the **Microsoft.Web/hostingEnvironments** service.
5859

5960
:::image type="content" source="media/virtual-network-injection-workspaces-resources/delegate-internal.png" alt-text="Screenshot showing subnet delegation to Microsoft.Web/hostingEnvironments in the portal.":::
6061

@@ -65,29 +66,31 @@ For Private/Private mode, the subnet needs to be delegated to the **Microsoft.We
6566
---
6667

6768

68-
## Network security group (NSG) rules
69+
### Network security group (NSG) rules
6970

70-
A network security group (NSG) must be attached to the subnet to explicitly allow inbound connectivity. Configure the following rules in the NSG. Set the priority of these rules higher than that of the default rules.
71+
A network security group (NSG) must be attached to the subnet to explicitly allow certain inbound or outbound connectivity. Configure the following rules in the NSG. Set the priority of these rules higher than that of the default rules.
7172

72-
#### [Public/Private](#tab/external)
73+
Configure other NSG rules to meet your organization's network access requirements.
7374

74-
| Source / Destination Port(s) | Direction | Transport protocol | Source | Destination | Purpose |
75-
|------------------------------|--------------------|--------------------|---------------------------------------|----------------------------------|-----------|
76-
| */80 | Inbound | TCP | AzureLoadBalancer | Workspace gateway subnet range | Allow internal health ping traffic |
77-
| */80,443 | Inbound | TCP | Internet | Workspace gateway subnet range | Allow inbound traffic |
75+
#### [Virtual network integration](#tab/external)
7876

79-
#### [Private/Private](#tab/internal)
77+
| Direction | Source | Source port ranges | Destination | Destination port ranges | Protocol | Action | Purpose |
78+
|-------|--------------|----------|---------|------------|-----------|-----|--------|
79+
| Inbound | AzureLoadBalancer | * | Workspace gateway subnet range | 80 | TCP | Allow | Allow internal health ping traffic |
80+
| Inbound | Internet | * | Workspace gateway subnet range | 80,443 | TCP | Allow | Allow inbound traffic |
8081

81-
| Source / Destination Port(s) | Direction | Transport protocol | Source | Destination | Purpose |
82-
|------------------------------|--------------------|--------------------|---------------------------------------|----------------------------------|-----------|
83-
| */80 | Inbound | TCP | AzureLoadBalancer | Workspace gateway subnet range | Allow internal health ping traffic |
84-
| */80,443 | Inbound | TCP | Virtual network | Workspace gateway subnet range | Allow inbound traffic |
82+
#### [Virtual network injection](#tab/internal)
83+
84+
| Direction | Source | Source port ranges | Destination | Destination port ranges | Protocol | Action | Purpose |
85+
|-------|--------------|----------|---------|------------|-----------|-----|--------|
86+
| Inbound | AzureLoadBalancer | * | Workspace gateway subnet range | 80 | TCP | Allow | Allow internal health ping traffic |
87+
| Outbound | VirtualNetwork | * | Storage | 443 | TCP | Allow | Dependency on Azure Storage |
8588

8689
---
8790

88-
## DNS settings for Private/Private configuration
91+
## DNS settings for virtual network injection
8992

90-
In the Private/Private network configuration, you have to manage your own DNS to enable inbound access to your workspace gateway.
93+
For virtual network injection, you have to manage your own DNS to enable inbound access to your workspace gateway.
9194

9295
We recommend:
9396

0 commit comments

Comments
 (0)