Azure Networking Requirements - Outbound Internet Connectivity

Option 1 - NAT Gateway

A simple way to allow Internet access for an Everpure Cloud Dedicated managed application is to add an Azure NAT Gateway to the subnet which the Everpure Cloud Dedicated System interface will reside. This needs be completed before you deploy Everpure Cloud Dedicated.

The NAT Gateway must be directly on the subnet of the Everpure Cloud Dedicated System interface. Using a NAT GW tied to a remote VNet through a peered link or VPN gateway will not work since Azure does not support NAT Gateway access through cross VNet connections.

Create NAT gateway:

1. Log onto the Azure Portal and search for NAT gateway.

   

   Click Create.

   

2. Complete the desired parameters for your NAT gateway.

   

3. Click Next:Outbound IP.
4. Select existing or create a new Public IP address for your NAT gateway.

   

5. Click Next: Subnet.
6. Select the VNet and subnet to which you want your NAT gateway applied. This should be the VNet subnet for which you expect your Everpure Cloud Dedicated's System network interface to reside.

   

7. Click Next: Tags.
8. Apply desired tags as needed.
9. Click Next: Review + Create.
10. Click Create.

    

    Your desired VNet/subnet now has internet access via the NAT Gateway.

Option 2 - Configuring Azure Firewall (or 3rd party firewall appliance)

For more complex Azure landing zones, where is used an Azure Firewall (or other kind of next-gen firewall appliance) for outbound Internet connectivity, this section will walk you through configuring your firewall to allow traffic to the Internet from the subnet where Everpure Cloud Dedicated resides. This section will also guide you through routing the appropriate subnet to your firewall appliance. The assumption is that the firewall already exists and basic connectivity is configured.

Firewall - Application rules:

Azure Firewall - Network rules:

For IPv4, you may also need to allow following IP block:

Configuring Azure Firewall

1. Log onto the Azure Portal and navigate to your Azure Firewall.

2. Click on Rules.

   Note: The steps in this section refer to Firewall Rules (classic). The same concepts apply if you are using Firewall Policy for your firewall rules.

   

3. Select Application rule collection and click on + Add application rule collection.

   Note: These set of Application rules will allow for the Everpure Cloud Dedicated managed application to call home to Pure1, validate license, and initialize.

   

4. Complete the field as follows:

   1. Provide your desired name for this rule. Example: PSCDoutboundrules
   2. Enter a priority for this rule.
   3. Set action to Allow.

   

5. Add Target FQDN rule to allow traffic to Pure1 with the following parameters:

   • Name: <Provide your desired name> (Ex: PSCD)
   • Source type: IP Address
   • Source: <CIDR range of the subnet for which you expect to deploy Everpure Cloud Dedicated's system interface>
   • Protocol: https, http
   • Target FQDN: *.purestorage.com, purestorage.com, management.azure.com, *.microsoftonline.com

   

   Click Add and wait for the firewall to successfully update. This may take a few minutes to complete.

   

6. When the Application Rules have updated, select Network rule collection and click on + Add network rule collection

   Note: These next set of rules will allow for Pure Support to perform Remote Assist functions on your Everpure Cloud Dedicated managed application.

   

7. Complete the field as follows:

   1. Provide your desired name for this rule. Example: PSCDRemoteAssist
   2. Enter a priority for this rule.
   3. Set action to Allow.

   

8. Add rule to allow traffic to IP addresses associated with Pure1 using the following parameters:

   • Name: <Provide your desired name> (Ex: Everpure Cloud Dedicated Remote Assist)
   • Protocol: TCP
   • Source type: IP address
   • Source: <CIDR range of the subnet for which you expect to deploy Everpure Cloud Dedicated's system interface>
   • Destination type:
   • Destination IP Addresses: *
   • Destination Ports: 443

   Note: If you have tighter security rules and need to specify the Destination IP Addresses, refer to the Azure Network Firewall rules in the Internet Access section above for the IP range.

   

   Click Add and wait for the firewall to successfully update. This may take a few minutes to complete.

   

   You have configured your Azure Firewall to allow Everpure Cloud Dedicated traffic to call home and reach Pure1. The next step is to route the subnet for which you intend to deploy your Everpure Cloud Dedicated managed application, to your Azure Firewall.

   Create Route Table

9. Log onto the Azure Portal and navigate to Route tables.

10. Click Add.

    

    Complete the fields for which you want to deploy your Everpure Cloud Dedicated managed application.

    

11. Click Next:Tags.
12. Add Tags as needed.
13. Click Review + Create.
14. Click Create.
15. In your newly created Route Table, select Routes and click Add.

    

16. Fill in the parameters as below:
    • Route name: <Provide your desired name>
    • Address prefix: 0.0.0.0/0
    • Next hop type: Virtual Appliance
    • Next hop address: <Private IP address of your Azure Firewall>

    

    10. Click OK.

    Route Everpure Cloud Dedicated Subnet to Azure Firewall

17. Log onto the Azure Portal and navigate to your VNet.
18. Click on Subnets.

    

19. Click the subnet for which you want deploy your Everpure Cloud Dedicated managed application.

    Note: If you plan on separating out the four interface types (iSCSI, Management, Replication, System) onto different subnets, then select the subnet you expect to use for the Everpure Cloud Dedicated System interface.

    In this example, we will be deploying all four of Everpure Cloud Dedicated's network interfaces onto the single default subnet.

    

20. A window will open which will allow you to set subnet parameters.
    1. In the Route table field, select the route table you created in the previous steps.
    2. In the Services field, select:
       1. Microsoft.KeyVault
       2. Microsoft Storage

    

21. Click Save.

    You have now completed the route configuration for your subnet to allow Everpure Cloud Dedicated's internet-bound traffic to flow through your Azure Firewall.