You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/app-service/web-sites-integrate-with-vnet.md
+24-23Lines changed: 24 additions & 23 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,7 +11,7 @@ ms.workload: na
11
11
ms.tgt_pltfrm: na
12
12
ms.devlang: na
13
13
ms.topic: article
14
-
ms.date: 05/28/2019
14
+
ms.date: 06/06/2019
15
15
ms.author: ccompy
16
16
ms.custom: seodec18
17
17
@@ -62,22 +62,23 @@ There are some things that VNet Integration doesn't support including:
62
62
63
63
When VNet Integration is used with VNets in the same region as your app, it requires the use of a delegated subnet with at least 32 addresses in it. The subnet cannot be used for anything else. Outbound calls made from your app will be made from the addresses in the delegated subnet. When you use this version of VNet Integration, the calls are made from addresses in your VNet. Using addresses in your VNet enables your app to:
64
64
65
-
*make calls to service endpoint secured services
66
-
*access resources across ExpressRoute connections
67
-
*access resources in the VNet you are connected to
68
-
*access resources across peered connections including ExpressRoute connections
65
+
*Make calls to service endpoint secured services
66
+
*Access resources across ExpressRoute connections
67
+
*Access resources in the VNet you are connected to
68
+
*Access resources across peered connections including ExpressRoute connections
69
69
70
70
This feature is in preview but, it is supported for production workloads with the following limitations:
71
71
72
-
* you can only reach addresses that are in the RFC 1918 range. Those are addresses in the 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 address blocks.
73
-
* you cannot reach resources across global peering connections
74
-
* you cannot set routes on the traffic coming from your app into your VNet
75
-
* the feature is only available from newer App Service scale units that support PremiumV2 App Service plans.
76
-
* the feature cannot be used by Isolated plan apps that are in an App Service Environment
77
-
* the feature requires an unused subnet with at least 32 addresses in your Resource Manager VNet.
78
-
* the app and the VNet must be in the same region
79
-
* one address is used for each App Service plan instance. Since subnet size cannot be changed after assignment, use a subnet that can more than cover your maximum scale size. A /27 with 32 addresses is the recommended size as that would accommodate an App Service plan that is scaled to 20 instances.
80
-
* you cannot delete a VNet with an integrated app. You must remove the integration first
72
+
* You can only reach addresses that are in the RFC 1918 range. Those are addresses in the 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 address blocks.
73
+
* You cannot reach resources across global peering connections
74
+
* You cannot set routes on the traffic coming from your app into your VNet
75
+
* The feature is only available from newer App Service scale units that support PremiumV2 App Service plans.
76
+
* The feature cannot be used by Isolated plan apps that are in an App Service Environment
77
+
* The feature requires an unused subnet with at least 32 addresses in your Resource Manager VNet.
78
+
* The app and the VNet must be in the same region
79
+
* One address is used for each App Service plan instance. Since subnet size cannot be changed after assignment, use a subnet that can more than cover your maximum scale size. A /27 with 32 addresses is the recommended size as that would accommodate an App Service plan that is scaled to 20 instances.
80
+
* You cannot delete a VNet with an integrated app. You must remove the integration first
81
+
* You can have only one regional VNet Integration per App Service plan. Multiple apps in the same App Service plan can use the same VNet.
81
82
82
83
To use the VNet Integration feature with a Resource Manager VNet in the same region:
83
84
@@ -105,25 +106,25 @@ Apps in the App Service are hosted on worker roles. The Basic and higher pricing
105
106
106
107
When VNet Integration is enabled, your app will still make outbound calls to the internet through the same channels as normal. The outbound addresses that are listed in the app properties portal are still the addresses used by your app. What changes for your app are that calls to service endpoint secured services or RFC 1918 addresses goes into your VNet.
107
108
108
-
The feature only supports one virtual interface per worker. One virtual interface per worker means one virtual interface per App Service plan. All of the apps in the same App Service plan can use the same VNet Integration but if you need to connect to an additional VNet, you will need to create another App Service plan. The virtual interface used is not a resource that customers have direct access to.
109
+
The feature only supports one virtual interface per worker. One virtual interface per worker means one regional VNet Integration per App Service plan. All of the apps in the same App Service plan can use the same VNet Integration but if you need an app to connect to an additional VNet, you will need to create another App Service plan. The virtual interface used is not a resource that customers have direct access to.
109
110
110
111
Due to the nature of how this technology operates, the traffic that is used with VNet Integration does not show up in Network Watcher or NSG flow logs.
111
112
112
113
## Gateway required VNet Integration
113
114
114
115
The Gateway required VNet Integration feature:
115
116
116
-
*can be used to connect to VNets in any region be they Resource Manager or Classic VNets
117
-
*enables an app to connect to only 1 VNet at a time
118
-
*enables up to five VNets to be integrated with in an App Service Plan
119
-
*allows the same VNet to be used by multiple apps in an App Service Plan without impacting the total number that can be used by an App Service plan. If you have 6 apps using the same VNet in the same App Service plan, that counts as 1 VNet being used.
120
-
*requires a Virtual Network Gateway that is configured with Point to Site VPN
121
-
*supports a 99.9% SLA due to the SLA on the gateway
117
+
*Can be used to connect to VNets in any region be they Resource Manager or Classic VNets
118
+
*Enables an app to connect to only 1 VNet at a time
119
+
*Enables up to five VNets to be integrated with in an App Service Plan
120
+
*Allows the same VNet to be used by multiple apps in an App Service Plan without impacting the total number that can be used by an App Service plan. If you have 6 apps using the same VNet in the same App Service plan, that counts as 1 VNet being used.
121
+
*Requires a Virtual Network Gateway that is configured with Point to Site VPN
122
+
*Supports a 99.9% SLA due to the SLA on the gateway
0 commit comments