Skip to content

Commit d016d60

Browse files
JillGrant615JillGrant615
authored
Merge pull request #300764 from dlepow/wkspcnet
[APIM] Workspace gateway networking
2 parents 242d17d + 7acd58f commit d016d60

File tree

3 files changed

+31
-29
lines changed

3 files changed

+31
-29
lines changed

‎articles/api-management/how-to-create-workspace.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ author: dlepow
55
ms.topic: how-to
66
ms.service: azure-api-management
77
ms.author: danlep
8-
ms.date: 05/14/2025
8+
ms.date: 06/03/2025
99
ms.custom:
1010
- build-2025
1111
---
@@ -56,7 +56,7 @@ Follow the steps in this article to:
5656
> [!IMPORTANT]
5757
> Plan your workspace's network configuration carefully. You can't change the network configuration after you create the workspace.
5858
59-
* If you select a network configuration that includes private inbound or private outbound network access, select a **Virtual network** and **Subnet** to isolate the workspace gateway, or create a new one. For network requirements, see [Network resource requirements for workspace gateways](virtual-network-workspaces-resources.md).
59+
* If you select either **Inbound public access, outbound private access** (virtual network integration) or **Inbound private access, outbound private access** (virtual network injection), select a **Virtual network** and **Subnet** to isolate the workspace gateway, or create a new one. For network requirements, see [Network resource requirements for workspace gateways](virtual-network-workspaces-resources.md).
6060

6161
1. Select **Next**. After validation completes, select **Create**.
6262

‎articles/api-management/media/how-to-create-workspace/create-workspace-gateway.png

-4.97 KB
Loading

‎articles/api-management/virtual-network-workspaces-resources.md

Lines changed: 29 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,34 @@
11
---
22
title: Azure API Management workspace gateways - VNet integration - network resources
3-
description: Learn about requirements for network resources when you integrate your API Management workspace gateway in an Azure virtual network.
3+
description: Learn about requirements for network resources when you integrate or inject your API Management workspace gateway in an Azure virtual network.
44
author: dlepow
55

66
ms.service: azure-api-management
77
ms.topic: concept-article
8-
ms.date: 07/15/2024
8+
ms.date: 06/03/2025
99
ms.author: danlep
1010
---
1111

12-
# Network resource requirements for integration of a workspace gateway into a virtual network
12+
# Network resource requirements to integrate or inject a workspace gateway into a virtual network
1313

1414
[!INCLUDE [api-management-availability-premium](../../includes/api-management-availability-premium.md)]
1515

16-
Network isolation is an optional feature of an API Management [workspace gateway](workspaces-overview.md#workspace-gateway). This article provides network resource requirements when you integrate your gateway in an Azure virtual network. Some requirements differ depending on the desired inbound and outbound access mode. The following modes are supported:
16+
Network isolation is an optional feature of an API Management [workspace gateway](workspaces-overview.md#workspace-gateway). This article provides network resource requirements when you integrate or inject your gateway in an Azure virtual network. Some requirements differ depending on the desired inbound and outbound access mode. The following modes are supported:
1717

18-
* Public inbound access, private outbound access (Public/Private)
19-
* Private inbound access, private outbound access (Private/Private)
18+
* **Virtual network integration**: public inbound access, private outbound access
19+
* **Virtual network injection**: private inbound access, private outbound access
2020

21-
For information about networking options in API Management, see [Use a virtual network to secure inbound or outbound traffic for Azure API Management](virtual-network-concepts.md).
21+
For background about networking options in API Management, see [Use a virtual network to secure inbound or outbound traffic for Azure API Management](virtual-network-concepts.md).
2222

2323
[!INCLUDE [api-management-virtual-network-workspaces-alert](../../includes/api-management-virtual-network-workspaces-alert.md)]
2424

25-
2625
## Network location
2726

28-
* The virtual network must be in the same region and Azure subscription as the API Management instance.
27+
The virtual network must be in the same region and Azure subscription as the API Management instance.
2928

3029
### Dedicated subnet
3130

32-
* The subnet used for virtual network integration can only be used by a single workspace gateway. It can't be shared with another Azure resource.
31+
* The subnet used for virtual network integration or injection can only be used by a single workspace gateway. It can't be shared with another Azure resource.
3332

3433
## Subnet size
3534

@@ -42,19 +41,19 @@ The subnet must be delegated as follows to enable the desired inbound and outbou
4241

4342
For information about configuring subnet delegation, see [Add or remove a subnet delegation](../virtual-network/manage-subnet-delegation.md).
4443

45-
#### [Public/Private](#tab/external)
44+
#### [Virtual network integration](#tab/external)
4645

4746

48-
For Public/Private mode, the subnet needs to be delegated to the **Microsoft.Web/serverFarms** service.
47+
For virtual network integration, the subnet needs to be delegated to the **Microsoft.Web/serverFarms** service.
4948

5049
:::image type="content" source="media/virtual-network-injection-workspaces-resources/delegate-external.png" alt-text="Screenshot showing subnet delegation to Microsoft.Web/serverFarms in the portal.":::
5150

5251
> [!NOTE]
5352
> You might need to register the `Microsoft.Web/serverFarms` resource provider in the subscription so that you can delegate the subnet to the service.
5453
55-
#### [Private/Private](#tab/internal)
54+
#### [Virtual network injection](#tab/internal)
5655

57-
For Private/Private mode, the subnet needs to be delegated to the **Microsoft.Web/hostingEnvironments** service.
56+
For virtual network injection, the subnet needs to be delegated to the **Microsoft.Web/hostingEnvironments** service.
5857

5958
:::image type="content" source="media/virtual-network-injection-workspaces-resources/delegate-internal.png" alt-text="Screenshot showing subnet delegation to Microsoft.Web/hostingEnvironments in the portal.":::
6059

@@ -67,27 +66,30 @@ For Private/Private mode, the subnet needs to be delegated to the **Microsoft.We
6766

6867
## Network security group (NSG) rules
6968

70-
A network security group (NSG) must be attached to the subnet to explicitly allow inbound connectivity. Configure the following rules in the NSG. Set the priority of these rules higher than that of the default rules.
69+
A network security group (NSG) must be attached to the subnet to explicitly allow certain inbound or outbound connectivity. Configure the following rules in the NSG. Set the priority of these rules higher than that of the default rules.
70+
71+
Configure other NSG rules to meet your organization's network access requirements.
7172

72-
#### [Public/Private](#tab/external)
73+
#### [Virtual network integration](#tab/external)
7374

74-
| Source / Destination Port(s) | Direction | Transport protocol | Source | Destination | Purpose |
75-
|------------------------------|--------------------|--------------------|---------------------------------------|----------------------------------|-----------|
76-
| */80 | Inbound | TCP | AzureLoadBalancer | Workspace gateway subnet range | Allow internal health ping traffic |
77-
| */80,443 | Inbound | TCP | Internet | Workspace gateway subnet range | Allow inbound traffic |
75+
| Direction | Source | Source port ranges | Destination | Destination port ranges | Protocol | Action | Purpose |
76+
|-------|--------------|----------|---------|------------|-----------|-----|--------|
77+
| Inbound | AzureLoadBalancer | * | Workspace gateway subnet range | 80 | TCP | Allow | Allow internal health ping traffic |
78+
| Inbound | Internet | * | Workspace gateway subnet range | 80,443 | TCP | Allow | Allow inbound traffic |
7879

79-
#### [Private/Private](#tab/internal)
80+
#### [Virtual network injection](#tab/internal)
8081

81-
| Source / Destination Port(s) | Direction | Transport protocol | Source | Destination | Purpose |
82-
|------------------------------|--------------------|--------------------|---------------------------------------|----------------------------------|-----------|
83-
| */80 | Inbound | TCP | AzureLoadBalancer | Workspace gateway subnet range | Allow internal health ping traffic |
84-
| */80,443 | Inbound | TCP | Virtual network | Workspace gateway subnet range | Allow inbound traffic |
82+
| Direction | Source | Source port ranges | Destination | Destination port ranges | Protocol | Action | Purpose |
83+
|-------|--------------|----------|---------|------------|-----------|-----|--------|
84+
| Inbound | AzureLoadBalancer | * | Workspace gateway subnet range | 80 | TCP | Allow | Allow internal health ping traffic |
85+
| Inbound | VirtualNetwork | * | Workspace gateway subnet range | 80,443 | TCP | Allow | Allow inbound traffic |
86+
| Outbound | VirtualNetwork | * | Storage | 443 | TCP | Allow | Dependency on Azure Storage |
8587

8688
---
8789

88-
## DNS settings for Private/Private configuration
90+
## DNS settings for virtual network injection
8991

90-
In the Private/Private network configuration, you have to manage your own DNS to enable inbound access to your workspace gateway.
92+
For virtual network injection, you have to manage your own DNS to enable inbound access to your workspace gateway.
9193

9294
We recommend:
9395

0 commit comments

Comments
 (0)