Learn more about managing subnet permissions.

If a built-in role doesn't provide the right permission, you can create and assign a custom role. You may use the built-in roles, such as Network contributor, which already support this permission. You should check your Azure role-based access control to verify the users or service principals that operate application gateways also have at least Microsoft.Network/virtualNetworks/subnets/join/action permission on the Virtual Network or Subnet. This validation is performed during both creation and management operations. Since the application gateway resource is deployed inside a virtual network, we also perform a check to verify the permission on the provided virtual network resource. Thus, after you change this setting, you must restart ( Stop and Start) your application gateway for these changes to take effect on the instances. The instances of your application gateway also honor this DNS configuration for any name resolution. The virtual network resource supports DNS server configuration, allowing you to choose between Azure-provided default or Custom DNS servers. For more information, see Frequently asked questions about Application Gateway DNS Servers for name resolution

You can do this using Azure PowerShell or Azure CLI. It is possible to change the subnet of an existing Application Gateway within the same virtual network. Subnet Size /24 = 256 IP addresses - 5 reserved from the platform = 251 available addresses.Ģ51 - Gateway 1 (10) - 1 private frontend IP configuration = 240Ģ38 - Gateway 3 (15) - 1 private frontend IP configuration = 222 Gateway 3: Maximum of 15 instances utilizes a private frontend IP configuration.Gateway 2: Maximum of 2 instances no private frontend IP configuration.Gateway 1: Maximum of 10 instances utilizes a private frontend IP configuration.For each gateway that has a private frontend IP configuration, subtract one additional IP address per gateway as well.įor example, here's how to calculate the available addressing for a subnet with three gateways of varying sizes: Next, take each gateway and subtract the max-instance count. To determine the available capacity of a subnet that has existing Application Gateways provisioned, take the size of the subnet and subtract the five reserved IP addresses of the subnet reserved by the platform. A minimum subnet size of /24 is recommended. In this case, you need 33 IP addresses: 27 for the application gateway instances, one for the private front end, and five for internal use.Īpplication Gateway (Standard or WAF) SKU can support up to 32 instances (32 instance IP addresses + 1 private frontend IP configuration + 5 Azure reserved) – so a minimum subnet size of /26 is recommendedĪpplication Gateway (Standard_v2 or WAF_v2 SKU) can support up to 125 instances (125 instance IP addresses + 1 private frontend IP configuration + 5 Azure reserved). You need at least 20 IP addresses for this subnet: five for internal use and 15 for the application gateway instances.Ĭonsider a subnet that has 27 application gateway instances and an IP address for a private frontend IP. For example, consider 15 application gateway instances with no private frontend IP. Size of the subnetĪpplication Gateway uses one private IP address per instance, plus another private IP address if a private frontend IP is configured.Īzure also reserves five IP addresses in each subnet for internal use: the first four and the last IP addresses. Virtual network service endpoint policies are currently not supported in an Application Gateway subnet.

Gateway car connection