Skip to content

Commit ed66bd2

Browse files
Court72Court72
authored
Merge pull request #187736 from adrianhall/apim-rpsourceipaddrchange
APIM: [Mar2023BreakingChange] Source RP IP Changes.
2 parents 3ba5de2 + 1711a6b commit ed66bd2

File tree

3 files changed

+118
-0
lines changed

3 files changed

+118
-0
lines changed

‎articles/api-management/TOC.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -388,6 +388,12 @@
388388
href: https://aka.ms/apimupdates
389389
- name: Release notes
390390
href: https://aka.ms/apim/releases
391+
- name: Breaking changes
392+
items:
393+
- name: Overview
394+
href: breaking-changes/overview.md
395+
- name: Virtual Network Changes (March 2023)
396+
href: breaking-changes/rp-source-ip-address-change-mar2023.md
391397
- name: Regional availability
392398
href: https://azure.microsoft.com/global-infrastructure/services/
393399
- name: Videos

‎articles/api-management/breaking-changes/overview.md

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
title: Upcoming Breaking Changes in Azure API Management | Microsoft Docs
3+
description: A list of all the upcoming breaking changes for Azure API Management
4+
services: api-management
5+
documentationcenter: ''
6+
author: adrianhall
7+
8+
ms.service: api-management
9+
ms.topic: reference
10+
ms.date: 02/07/2022
11+
ms.author: adhal
12+
---
13+
14+
# Upcoming breaking changes
15+
16+
The following table lists all the upcoming breaking changes and feature retirements for Azure API Management.
17+
18+
| Change Title | Effective Date |
19+
|:-------------|:---------------|
20+
| [Resource Provider Source IP Address Update][bc1] | March 31, 2023 |
21+
22+
<!-- Links -->
23+
[bc1]: ./rp-source-ip-address-change-mar2023.md

‎articles/api-management/breaking-changes/rp-source-ip-address-change-mar2023.md

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
---
2+
title: Azure API Management IP address change (March 2023) | Microsoft Docs
3+
description: Azure API Management is updating the source IP address of the resource provider in certain regions. If your service is hosted in a Microsoft Azure Virtual Network, you may need to update network settings to continue managing your service.
4+
services: api-management
5+
documentationcenter: ''
6+
author: adrianhall
7+
ms.service: api-management
8+
ms.topic: reference
9+
ms.date: 02/07/2022
10+
ms.author: adhal
11+
---
12+
13+
# Resource Provider source IP address updates (March 2023)
14+
15+
On 31 March, 2023 as part of our continuing work to increase the resiliency of API Management services, we're making the resource providers for Azure API Management zone redundant in each region. The IP address that the resource provider uses to communicate with your service will change in seven regions:
16+
17+
| Region | Old IP Address | New IP Address |
18+
|:-------|:--------------:|:--------------:|
19+
| Canada Central | 52.139.20.34 | 20.48.201.76 |
20+
| Brazil South | 191.233.24.179 | 191.238.73.14 |
21+
| Germany West Central | 51.116.96.0 | 20.52.94.112 |
22+
| South Africa North | 102.133.0.79 | 102.37.166.220 |
23+
| Korea Central | 40.82.157.167 | 20.194.74.240 |
24+
| Central India | 13.71.49.1 | 20.192.45.112 |
25+
| South Central US | 20.188.77.119 | 20.97.32.190 |
26+
27+
This change will have NO effect on the availability of your API Management service. However, you **may** have to take steps described below to configure your API Management service beyond 31 March, 2023.
28+
29+
## Is my service affected by this change?
30+
31+
Your service is impacted by this change if:
32+
33+
* The API Management service is in one of the seven regions listed in the table above.
34+
* The API Management service is running inside an Azure virtual network.
35+
* The Network Security Group (NSG) or User-defined Routes (UDRs) for the virtual network are configured with explicit source IP addresses.
36+
37+
## What is the deadline for the change?
38+
39+
The source IP addresses for the affected regions will be changed on 31 March, 2023. Complete all required networking changes before then.
40+
41+
After 31 March 2023, if you prefer not to make changes to your IP addresses, your services will continue to run but you will not be able to add or remove APIs, or change API policy, or otherwise configure your API Management service.
42+
43+
## Can I avoid this sort of change in the future?
44+
45+
Yes, you can.
46+
47+
API Management publishes a _service tag_ that you can use to configure the NSG for your virtual network. The service tag includes information about the source IP addresses that API Management uses to manage your service. For more information on this topic, read [Configure NSG Rules] in the API Management documentation.
48+
49+
## What do I need to do?
50+
51+
Update the NSG security rules that allow the API Management resource provider to communicate with your API Management instance. For detailed instructions on how to manage a NSG, review [Create, change, or delete a network security group] in the Azure Virtual Network documentation.
52+
53+
1. Go to the [Azure portal](https://portal.azure.com) to view your NSGs. Search for and select **Network security groups**.
54+
2. Select the name of the NSG associated with the virtual network hosting your API Management service.
55+
3. In the menu bar, choose **Inbound security rules**.
56+
4. The inbound security rules should already have an entry that mentions a Source address matching the _Old IP Address_ from the table above. If it doesn't, you're not using explicit source IP address filtering, and can skip this update.
57+
5. Select **Add**.
58+
6. Fill in the form with the following information:
59+
60+
1. Source: **Service Tag**
61+
2. Source Service Tag: **ApiManagement**
62+
3. Source port ranges: __*__
63+
4. Destination: **VirtualNetwork**
64+
5. Destination port ranges: **3443**
65+
6. Protocol: **TCP**
66+
7. Action: **Allow**
67+
8. Priority: Pick a suitable priority to place the new rule next to the existing rule.
68+
69+
The Name and Description fields can be set to anything you wish. All other fields should be left blank.
70+
71+
7. Select **OK**.
72+
73+
In addition, you may have to adjust the network routing for the virtual network to accommodate the new control plane IP addresses. If you've configured a default route (`0.0.0.0/0`) forcing all traffic from the API Management subnet to flow through a firewall instead of directly to the Internet, then additional configuration is required.
74+
75+
If you configured user-defined routes (UDRs) for control plane IP addresses, the new IP addresses must be routed the same way. For more details on the changes necessary to handle network routing of management requests, review [Force tunneling traffic] documentation.
76+
77+
Finally, check for any other systems that may impact the communication from the API Management resource provider to your API Management service subnet. For more information about virtual network configuration, review the [Virtual Network] documentation.
78+
79+
## More Information
80+
81+
* [Virtual Network](/azure/virtual-network)
82+
* [API Management VNET Reference](../virtual-network-reference.md)
83+
* [Microsoft Q&A](/answers/topics/azure-api-management.html)
84+
85+
<!-- Links -->
86+
[Configure NSG Rules]: ../api-management-using-with-internal-vnet.md#configure-nsg-rules
87+
[Virtual Network]: /azure/virtual-network
88+
[Force tunneling traffic]: ../virtual-network-reference.md#force-tunneling-traffic-to-on-premises-firewall-using-expressroute-or-network-virtual-appliance
89+
[Create, change, or delete a network security group]: /azure/virtual-network/manage-network-security-group

0 commit comments

Comments
 (0)