How often can MS Azure App Services Outbound IP addresses change?

China☆狼群 提交于 2019-11-29 10:55:01

Late to the party on this one but just to flesh this out:

Unless you use an Application Service Environment (ASE) you cannot guarantee that the inbound or outbound IPs will change, however there some differences between inbound and outbound IP addresses.

When does an Inbound IP change?

Inbound IP will change when:

  • Delete an app and recreate it in a different resource group.
  • Delete the last app in a resource group and region combination and recreate it.
  • Delete an existing SSL binding, such as during certificate renewal

However, this can be countered by getting a static IP for inbound connections configure an IP-based SSL binding - you can even use a self-signed cert if you're not using any SSL functionailty.

Outbound IP addresses

This is where you sit and it's the space that is a little more volitile, this is from the docs directly:

The set of outbound IP addresses for your app changes when you scale your app between the lower tiers (Basic, Standard, and Premium) and the Premium V2 tier.

So in a nutshell if you will never scale up or down then you should be fine.

Edit: Re-reading the above and with a little test it looks like it's saying that the IPs will not change unless you ramp right up to the Premium V2 tier from a lower tier (or vice versa). A cursory test backs this up so:

Running under F1 free tier and scaling up to P1v2 gave me the following IP addresses:

Scaling back down to any of the lower tiers reverted the IP addresses to the same as the F1 tier.

Possible remediation

A very solution specific example but in-case it helps - where I've solved this before is monitoring the outbound IP addresses for the webapp, if it notices a change then it could send those IP addresses to a whitelist for update via an API call - but this could also just cause a high priority ticket to be raised.

I should note that we could do this because it wouldn't be the end of the world for a little bit of outage and we weren't expecting to scale up and down very often.

Otherwise, as you've noted, an Application Service Environment is your only belt and braces option.

References

When do inbound IPs change?

When do outbound IPs change?

Get a static inbound IP addresses

In addition to above resources about changes the other thing is that additional IP's might be added to accommodate additional capacity for outbound n/w calls. Specific comment to look out for is "With the recent upgrades the Websites service has a stable set of outbound IP addresses allocated to each of its scale units. We continue to monitor network utilization and we might add (though never remove) additional IP addresses." by Stefan_MS

https://social.msdn.microsoft.com/Forums/azure/en-US/fd53afb7-14b8-41ca-bfcb-305bdeea413e/maintenance-notice-upcoming-changes-to-increase-capacity-for-outbound-network-calls?forum=windowsazurewebsitespreview

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!