Share via

Do Azure virtual machines located behind a Network Virtual Appliance require a NAT Gateway or Public IP to maintain default outbound internet access ?

$@chin 150 Reputation points
2025-05-05T19:25:46.8466667+00:00

Hi,

For Azure virtual machines behind a Network Virtual Appliance (such as Azure Firewall or a third-party firewall running on a virtual machine), will a NAT Gateway or Public IP still be required to maintain outbound internet connectivity, given the upcoming deprecation of the default outbound access feature ?
If so, does this mean existing VMs will need to be transitioned to a new method for internet access ?

Azure Virtual Network
Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
2,726 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Divyesh Govaerdhanan 3,885 Reputation points
    2025-05-05T19:51:35.8833333+00:00

    Hello,

    Welcome to Microsoft Q&A,

    Yes, a NAT Gateway or a Public IP will still be required for Azure Virtual Machines (VMs) behind a Network Virtual Appliance (NVA), such as Azure Firewall or a third-party firewall, to maintain outbound internet connectivity, especially in light of the deprecation of the default outbound access feature.

    Change:

    • The default outbound access (used when no explicit outbound method like a NAT Gateway or Public IP is configured) is being deprecated.
    • This impacts VMs without any explicit outbound configuration, meaning they won’t have internet access unless one is set up.

    Action Required for Existing VMs:

    • Yes, you will need to transition to an explicit outbound method if:
      • Your current setup relies only on Azure’s default outbound access, and
      • You don’t have a NAT Gateway or a Public IP on the NVA or VM subnet.

    Please Upvote and accept the answer if it helps!!

    0 comments
  2. Praveen Bandaru 3,145 Reputation points Microsoft External Staff Moderator
    2025-05-05T19:57:10.3033333+00:00

    Hello $@chin

    It looks like you're looking for clarification on the outbound internet connectivity for Azure virtual machines that are behind a Network Virtual Appliance (NVA), especially with the upcoming changes regarding default outbound access.

    Here’s the information:

    1. NAT Gateway Requirement: To maintain outbound internet connectivity, you will need to use a NAT Gateway or have Public IPs associated with your virtual machines. The default outbound access will be deprecated by September 30, 2025, so you need to transition to defined methods of outbound connectivity.
    2. Transitioning for Existing VMs: If you're existing VMs rely on the default outbound access, you’ll need to update their configurations to use either a NAT Gateway or associate them with a Public IP to ensure continued internet access. The Azure documentation recommends using the NAT Gateway for a more secure and reliable connection while allowing you to use your static public IP addresses.

    Consider associating a NAT Gateway with your subnets. Alternatively, attach public IP addresses directly to your VMs for outbound traffic.

    You need to adopt explicit outbound connectivity solutions like NAT Gateway or public IPs for proper internet access, as the default method will no longer be available.

    Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members. 

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.