Skip to content

Commit 7a0807c

Browse files
denreadenrea
authored
Merge pull request #294134 from AbdullahBell/private-link-plsnat-howto
Private Link: How to Guide: Enable SNAT Bypass for Private Endpoint Traffic through NVA
2 parents cbccd15 + f97c7d1 commit 7a0807c

File tree

2 files changed

+140
-3
lines changed

2 files changed

+140
-3
lines changed

‎articles/private-link/private-link-disable-snat.md

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
---
2+
title: Disable SNAT requirement for Azure private endpoint traffic through NVA
3+
description: Learn how to enable SNAT bypass for Azure private endpoint traffic passing through a network virtual appliance (NVA) in Azure.
4+
author: abell
5+
ms.author: abell
6+
ms.service: azure-private-link
7+
ms.topic: how-to #Don't change
8+
ms.date: 03/11/2025
9+
10+
#customer intent: As a network administrator, I want to disable SNAT requirement for private endpoint traffic through NVA so that I can ensure symmetric routing and comply with internal logging standards.
11+
12+
---
13+
14+
# How to Guide: Disable SNAT requirement for Azure private endpoint traffic through NVA
15+
16+
Source network address translation (SNAT) is no longer required for private endpoint destined traffic passing through a network virtual appliance (NVA). You can now configure a tag on your NVA virtual machines to notify the Microsoft platform that you wish to opt into this feature. This means SNATing is no longer be necessary for private endpoint destined traffic traversing through your NVA.
17+
18+
Enabling this feature provides a more streamlined experience for guaranteeing symmetric routing without affecting nonprivate endpoint traffic. It also allows you to follow internal compliance standards where the source of traffic origination needs to be available during logging. This feature is available in all regions.
19+
20+
> [!NOTE]
21+
> Disabling SNAT for private endpoint traffic passing through a Network Virtual Appliance (NVA) causes a one-time reset of all long-running private endpoint connections established through the NVA. To minimize disruption, it's recommended to configure this feature during a maintenance window. This update will only affect traffic passing through your NVA; private endpoint traffic that bypasses the NVA won't be affected.
22+
23+
## Prerequisites
24+
25+
* An active Azure account with a subscription. [Create an account for free](https://azure.microsoft.com/free/).
26+
* A configured private endpoint in your subscription. For more information on how to create a private endpoint, see [Create a private endpoint](./create-private-endpoint-portal.md).
27+
* A network virtual appliance (NVA) deployed in your subscription. For the example in this article, a virtual machine (VM) is used as the NVA. For more information on how to deploy a virtual machine, see [Quickstart: Create a Windows virtual machine in the Azure portal](/azure/virtual-machines/windows/quick-create-portal).
28+
* Understanding of how to add tags to Azure resources. For more information, see [Use tags to organize your Azure resources](../azure-resource-manager/management/tag-resources.md).
29+
30+
### Disable SNAT requirement for Private Endpoint traffic through NVA
31+
32+
The type of NVA you're using determines how to disable SNAT for private endpoint traffic passing through the NVA. For the virtual machine, you add a tag on the Network interface (NIC). On the virtual machine scale set you enable the tag on the virtual machine scale set instance.
33+
34+
#### Add Tag to your virtual machine NIC
35+
36+
Here we add the tag to the virtual machine's NIC.
37+
38+
# [Portal](#tab/vm-nic-portal)
39+
40+
1. Sign in to the [Azure portal](https://portal.azure.com).
41+
1. In the search bar at the top, search for and select **virtual machines**.
42+
1. From the list of virtual machines, select your virtual machine.
43+
1. In the left navigation pane under **Settings**, select **Networking**, then select **Network settings**.
44+
1. Under the **Network Interface** section, select on the NIC name. Now you are in the Network interface pane.
45+
1. In the left navigation pane under **Overview**, select **Tags**.
46+
1. Add a new tag with the following details:
47+
48+
| Field | Value |
49+
|-------|-------|
50+
| Name | `disableSnatOnPL` |
51+
| Value | `true` |
52+
53+
1. Select **Apply** to save the tag.
54+
1. Select the **Overview** section, then select **Refresh** to see the updated tags.
55+
56+
> [!NOTE]
57+
> The tag is case-sensitive. Ensure you enter it exactly as shown.
58+
59+
# [PowerShell](#tab/vm-nic-powershell)
60+
61+
* Use the following PowerShell command to add the tag to your virtual machine's NIC:
62+
63+
```azurepowershell-interactive
64+
$nic = Get-AzNetworkInterface -Name "myNIC" -ResourceGroupName "MyResourceGroup"
65+
$tags = @{
66+
"disableSnatOnPL" = "true"
67+
}
68+
Set-AzResource -ResourceId $nic.Id -Tag $tags -Force
69+
```
70+
71+
# [Azure CLI](#tab/vm-nic-cli)
72+
73+
* Use the following CLI command to add the tag to your virtual machine's NIC:
74+
75+
```azurecli-interactive
76+
az network nic update --name "myNIC" --resource-group "MyResourceGroup" --set tags.disableSnatOnPL=\'true\'
77+
```
78+
---
79+
80+
### Add Tag to your Virtual Machine Scale Sets
81+
82+
Here we add the tag to the virtual machine scale set instance.
83+
84+
# [Portal](#tab/vmss-portal)
85+
86+
1. Sign in to the [Azure portal](https://portal.azure.com).
87+
1. In the search bar at the top, search and select **virtual machine scale sets**.
88+
1. From the list of scale sets, select your virtual machine scale set.
89+
1. In the left navigation pane under **Overview**, select **Tags**.
90+
1. Add a new tag with the following details:
91+
92+
| Field | Value |
93+
|-------|-------|
94+
| Name | `disableSnatOnPL` |
95+
| Value | `true` |
96+
97+
1. Select **Apply** to save the tag.
98+
1. Select the **Overview** section, then select **Refresh** to see the updated tags.
99+
100+
> [!NOTE]
101+
> The tag is case-sensitive. Ensure you enter it exactly as shown.
102+
103+
# [PowerShell](#tab/vmss-powershell)
104+
105+
* Use the following PowerShell command to add the tag to your virtual machine scale set:
106+
107+
```azurepowershell-interactive
108+
$vmss = Get-AzVmss -ResourceGroupName "MyResourceGroup" -VMScaleSetName "myVmss"
109+
$vmss.Tags.Add("disableSnatOnPL", "true")
110+
Update-AzVmss -ResourceGroupName "MyResourceGroup" -Name "myVmss" -VirtualMachineScaleSet $vmss
111+
```
112+
113+
# [Azure CLI](#tab/vmss-cli)
114+
115+
* Use the following Azure CLI command to add the tag to your virtual machine scale set:
116+
117+
```azurecli-interactive
118+
az vmss update --name "myVmss" --resource-group "MyResourceGroup" --set tags.disableSnatOnPL=\'true\'
119+
```
120+
---
121+
122+
#### Validate the Tag
123+
124+
Verify the tag is present in the virtual machine's NIC settings or virtual machine scale set settings.
125+
126+
1. Navigate to the **Tags** service in the Azure portal.
127+
1. In the **Filter by** field, type `disableSnatOnPL`.
128+
1. Select the tag from the list. Here you see all resources with the tag.
129+
1. Select the resource to view the tag details.
130+
131+
To learn more, see [View resources by tag](../azure-resource-manager/management/tag-resources-portal.md#view-resources-by-tag).
132+
133+
## Next Step
134+
135+
> [!div class="nextstepaction"]
136+
> [Create a private endpoint](./create-private-endpoint-portal.md)
137+
> [Manage Network Polices](./disable-private-endpoint-network-policy.md)

‎articles/private-link/toc.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
21
- name: Azure Private Link documentation
32
href: index.yml
43
- name: Get started
@@ -47,6 +46,8 @@
4746
- name: Create a Private Link service - ARM template
4847
displayName: Azure Resource Manager
4948
href: create-private-link-service-template.md
49+
- name: Disable SNAT for traffic through NVA
50+
href: private-link-disable-snat.md
5051
- name: Create a network security perimeter
5152
items:
5253
- name: Create a network security perimeter - Azure portal
@@ -182,5 +183,4 @@
182183
- name: Pricing calculator
183184
href: https://azure.microsoft.com/pricing/calculator/
184185
- name: Stack Overflow
185-
href: https://stackoverflow.com/questions/tagged/azure-virtual-network
186-
186+
href: https://stackoverflow.com/questions/tagged/azure-virtual-network

0 commit comments

Comments
 (0)