You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
> For all virtual network integrations with App Service, the recommended method uses [regional virtual network integration](./overview-vnet-integration.md). Gateway-required virtual network integration is a legacy method with limitations that regional virtual network integration mitigates.
15
+
13
16
Gateway-required virtual network integration supports connecting to a virtual network in another region or to a classic virtual network. Gateway-required virtual network integration only works for Windows plans. We recommend using [regional virtual network integration](./overview-vnet-integration.md) to integrate with virtual networks.
14
17
15
18
Gateway-required virtual network integration:
@@ -38,7 +41,7 @@ To create a gateway:
38
41
39
42
1.[Create the VPN gateway and subnet](../vpn-gateway/tutorial-create-gateway-portal.md). Select a route-based VPN type.
40
43
41
-
1.[Set the point-to-site addresses](../vpn-gateway/point-to-site-certificate-gateway.md#addresspool). If the gateway isn't in the basic SKU, then IKEV2 must be disabled in the point-to-site configuration and SSTP must be selected. The point-to-site address space must be in the RFC 1918 address blocks 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
44
+
1.[Set the point-to-site addresses](../vpn-gateway/point-to-site-certificate-gateway.md#addresspool). If the gateway isn't in the basic SKU, then IKEV2 must be disabled in the point-to-site configuration and SSTP must be selected. The point-to-site address space must be in the RFC 1,918 address blocks 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
42
45
43
46
If you create the gateway for use with gateway-required virtual network integration, you don't need to upload a certificate. Creating the gateway can take 30 minutes. You won't be able to integrate your app with your virtual network until the gateway is created.
44
47
@@ -79,7 +82,7 @@ The App Service plan virtual network integration UI shows you all the virtual ne
79
82
The private IP assigned to the instance is exposed via the environment variable WEBSITE_PRIVATE_IP. Kudu console UI also shows the list of environment variables available to the web app. This IP is an IP from the address range of the point-to-site address pool configured on the virtual network gateway. This IP will be used by the web app to connect to the resources through the Azure virtual network.
80
83
81
84
> [!NOTE]
82
-
> The value of WEBSITE_PRIVATE_IP is bound to change. However, it will be an IP within the address range of the point-to-site address range, so you'll need to allow access from the entire address range.
85
+
> The value of WEBSITE_PRIVATE_IP is bound to change. However, it will be an IP within the address range of the point-to-site address range, so you need to allow access from the entire address range.
@@ -94,11 +97,11 @@ If certificates or network information is changed, select **Sync Network**. When
94
97
95
98
### Certificate renewal
96
99
97
-
The certificate used by the gateway-required virtual network integration has a lifespan of 8 years. If you have apps with gateway-required virtual network integrations that live longer you will have to renew the certificate. You can validate if your certificate has expired or has less than 6 month to expiry by visiting the VNet Integration page in Azure portal.
100
+
The certificate used by the gateway-required virtual network integration has a lifespan of eight years. If you have apps with gateway-required virtual network integrations that live longer you'll have to renew the certificate. You can validate if your certificate has expired or has less than six month to expiry by visiting the VNet Integration page in Azure portal.
98
101
99
102
:::image type="content" source="./media/overview-vnet-integration/vnetint-gateway-cert-expiry.png" alt-text="Screenshot that shows a near expiry gateway-required virtual network integration certificate.":::
100
103
101
-
You can renew your certificate when the portal shows a near expiry or expired certificate. To renew the certificate you need to disconnect and reconnect the virtual network. Reconnecting will cause a brief outage in connectivity between your app and your virtual network. Your app isn't restarted, but the loss of connectivity could cause your site to not function properly.
104
+
You can renew your certificate when the portal shows a near expiry or expired certificate. To renew the certificate, you need to disconnect and reconnect the virtual network. Reconnecting causes a brief outage in connectivity between your app and your virtual network. Your app isn't restarted, but the loss of connectivity could cause your site to not function properly.
description: Migrate your virtual network integration from gateway-based integration to regional integration.
4
4
author: seligj95
5
5
ms.topic: how-to
6
-
ms.date: 10/01/2024
6
+
ms.date: 06/19/2025
7
7
ms.author: jordanselig
8
-
9
8
---
10
9
# Migrate from gateway-based virtual network integration
11
10
12
-
There are two ways in App Service to integration with a virtual network. One way is gateway-based integration using a virtual network gateway that establishes a point-to-site VPN connection from the app to the virtual network. The other way is now known as virtual network integration since more than 99% of all integrations are using this method. Virtual network integration has several advantages over gateway-based integration. The only edge case scenario is when you need to connect directly to a virtual network in a different region and aren't able to set up peerings.
11
+
There are two ways in App Service to integrate with a virtual network. One way is gateway-based integration using a virtual network gateway that establishes a point-to-site VPN connection from the app to the virtual network. The other way is known as virtual network integration since more than 99% of all integrations are using this method. Virtual network integration has several advantages over gateway-based integration. The only edge case scenario where gateway-based integration is preferred is when you need to connect directly to a virtual network in a different region and aren't able to set up peerings.
13
12
14
13
Gateway-based integration can't be used in the following scenarios:
15
14
@@ -20,35 +19,30 @@ Gateway-based integration can't be used in the following scenarios:
20
19
* To resolve App Settings referencing a network protected Key Vault.
21
20
* With a coexistence gateway that supports both ExpressRoute and point-to-site or site-to-site VPNs.
| Co-connect to virtual network with Express Route | Yes | No|
32
+
| Connect directly to virtual network in different region | Only through global peerings | Yes|
34
33
35
34
## Migration path and planning
36
35
37
-
The complexity and planning of migration varies based on your current setup.
36
+
The complexity and planning of migration varies based on your current setup. Migrating from gateway-based to regional virtual network integration is a disconnect/connect operation. Before making the switch, make sure you have a subnet configured for your apps. The subnet must meet certain [requirements](./overview-vnet-integration.md#subnet-requirements). You can either have one subnet per plan or take advantage of the [multi-plan subnet join feature](./overview-vnet-integration.md#subnet-requirements) to connect apps from different plans to the same subnet. You should spend time planning your subnet address range. The general recommendation is to have double the IPs as the expected maximum planned instances of your plan. You should also delegate the subnet to `Microsoft.Web/serverFarms`.
38
37
39
38
## Same region migration
40
39
41
-
If you're connecting to a gateway in the same region as your app, the migration is simple. First you need to select or create a subnet in the virtual network where the apps integrates going forward.
40
+
If you're connecting to a gateway in the same region as your app, the migration is simple. First you need to select or create a subnet in the virtual network where the apps integrate going forward.
42
41
43
42
44
43
45
-
Then all you need to do is run a command to configure the virtual network integration.
46
-
47
-
48
-
49
-
50
-
Migrating from gateway-based to regional virtual network integration is a simple disconnect/connect operation. Before making the switch, make sure you have a subnet configured for your apps. You can either have one per plan or take advantage of the new multi-plan subnet join feature to connect apps from different plans to the same subnet. You should spend a little time planning your subnet address range. The general recommendation is to have double the IPs as the expected maximum planned instances of your plan. You should also delegate the subnet to `Microsoft.Web/serverFarms`.
44
+
Then you need to configure the virtual network integration following the standard process described in [Enable virtual network integration in Azure App Service](./configure-vnet-integration-enable.md).
51
45
52
46
## Post configurations
53
47
54
-
After moving to regional virtual network integration, you now have some new options you can take advantage of. You can decide if configuration options like backup/restore and image pull for container based workloads should be [routed through the virtual network](./overview-vnet-integration.md#configuration-routing). You can also define Network Security Groups or User Defined Routes for the individual subnets and you can increase SNAT ports and get a deterministic outbound public source IP by attaching a NAT gateway to the subnet.
48
+
After moving to regional virtual network integration, you have new options that you can take advantage of. You can decide if configuration options like backup/restore and image pull for container based workloads should be [routed through the virtual network](./overview-vnet-integration.md#configuration-routing). You can also define Network Security Groups or User Defined Routes for the individual subnets. You can also increase SNAT ports and get a [deterministic outbound public source IP by attaching a NAT gateway to the subnet](./overview-inbound-outbound-ips.md#get-a-static-outbound-ip).
0 commit comments