How to Publish AVS Workloads on the Internet

Azure VMware Solution (AVS) is a VMware–validated private cloud solution, managed and maintained by Azure. It runs on dedicated, bare-metal Azure infrastructure. AVS allows customers to manage and secure applications across both VMware environments and Microsoft Azure resources with a consistent operating framework. It supports workload migration, VM deployment, and Azure service consumption.

As AVS private cloud runs on an isolated Azure environment, by default it is not accessible from Azure or the Internet. Users can use either ExpressRoute Global Reach (i.e., from on-prem) or a jump box (i.e., on an Azure VNet) to access AVS private cloud. This means AVS workload VMs are confined within AVS private cloud and not accessible from the Internet. If customers want to make AVS Private Cloud resources, such as web servers, accessible from the Internet, Public IP needs to be deployed. There are a couple of ways to do this: (1) Destination NAT or DNAT via Azure Virtual WAN/Azure Firewall; and (2) Azure Application Gateway. This article focuses on DNAT with Azure Virtual WAN/Azure Firewall.

Azure Firewall is required to configure DNAT. Azure Firewall with public IP as well as Virtual WAN, Virtual WAN Hub, and Public IPs are automatically deployed once public IP functionality is enabled in AVS private cloud. Enabling Public IP functionality also enables connectivity between Virtual WAN Hub AVS private cloud via ExpressRoute.

The following picture shows a reference architecture of DNAT with Azure Virtual WAN.

The architecture diagram illustrates a web server hosted in the Azure VMware Solution environment and configured with RFC1918 private IP addresses. The web server is accessible from the internet via Virtual WAN public IP functionality by using DNAT in Azure Firewall. DNAT is a firewall rule which translates public IP address requests to a private address. When the firewall receives user requests on public IP, it translates those requests to private IP using DNAT rules. The firewall looks up the NAT table, and if the request matches an entry, it forwards the traffic to the translated address and port in the AVS private cloud. The web server receives the request, processes it, and then replies to the firewall. Finally, the firewall forwards the information to the user on the public IP address.

How to Deploy Azure Virtual WAN in AVS Private Cloud

Sign into the Azure portal and select Azure VMware Solution.
Select Azure VMware Solution private cloud.

Under Manage, select Connectivity.
Select the Public IP tab and then click Configure.
Accept default values or change them if necessary. Then provide a virtual hub address block, the number of the public IP, and then select Create.

Provide Virtual Hub Address, the Public IP, and then Select Create

Note: It can take about an hour to complete the deployment. Once deployment is done, we can verify the Public IP, Virtual WAN, WAN Hub, Azure Firewall, and then create firewall police and DNAT on the Azure Firewall.

How to Configure DNAT in Azure Firewall

In the Azure portal, search for Firewall.
Select the deployed firewall and then select Visit Azure Firewall Manager to configure and manage this firewall.

Visit Azure Firewall Manager to Configure and Manage Firewall

Note: Document the Public IP address of the firewall which is required to configure DNAT.

Select Azure Firewall Policies and then Create Azure Firewall Policy.

Select and Create Azure Firewall Policies

Under the Basic tab, provide the necessary details and select Next: DNS Settings.

Under DNS Settings tab, accept default and then select the Rules

Under DNS Settings Tab, Accept Default and then Select the Rules

Click Add a rule collection

Provide the required info in the Add a rule collection pane and click Add.

Click Review + create

Click Create once Validation has been passed. It may take some time to complete the process.

Note: Final step is to associate firewall policy to the Azure Hub.

From the Firewall manager, select Azure Firewall Policies.

Select the appropriate firewall policy, click Manage associations, and then select Associate hubs.

Click Manage associations, and then select Associate hubs

Select the appropriate Hub and then click Add.

Select the appropriate Hub and then click Add

The DNAT policy is now associated with the Azure Virtual Hub and is ready to use.

Go to the Firewall Manager and check the DNAT Rules to verify DNAT configuration.

With this DNAT policy, the AVS workload VM (i.e., the webserver with an IP address of 172.16.1.201) is now accessible from the Internet via 104.40.12.243.