Azure Local Outbound Connectivity

Comprehensive Guide to Public Path vs Private Path Architectures

Architecture Comparison

Detailed Comparison

Components Overview

🌐 Public Path

Traffic routed through the Arc Gateway to Azure services via the public internet. Your on-premises enterprise proxy and firewall control the traffic flow.

Diagram showing Azure Local components for Public Path.

🔐 Private Path

Traffic routed securely through private connections (ExpressRoute or Site-to-Site VPN) to Azure, eliminating public internet exposure.

When to Use Each Architecture

Summary

Private Endpoints Usage Across Deployment Scenarios

Azure Local supports multiple deployment scenarios with varying proxy and Arc Gateway configurations. Private Endpoints (Private Link) work across all scenarios but require proper proxy bypass configuration.

🌐 Public Path - 4 Options

When using public internet for Azure connectivity, you have four deployment options:

1

No Proxy, No Arc Gateway

Direct connection to Azure through firewall only. Requires opening all Azure endpoints in firewall.

Key Characteristics:

• Proxy: None
• Arc Gateway: Not used
• Connectivity: Direct to public internet
• Firewall Rules: Hundreds of endpoints required

✅ Simplest setup

No proxy configuration needed

❌ Most firewall rules

Hundreds of endpoints to manage

2

Proxy, No Arc Gateway

Traffic routes through enterprise proxy. Proxy handles URL filtering and logging.

Key Characteristics:

• Proxy: On-premises enterprise proxy
• Arc Gateway: Not used
• Connectivity: Through proxy to public internet
• Firewall Rules: Many endpoints required

✅ Centralized control

Proxy provides visibility and filtering

❌ Many endpoints

Still requires many firewall/proxy rules

3

No Proxy, Arc Gateway

Arc Gateway handles Azure connectivity. Reduces firewall rules to fewer than 30 endpoints.

Key Characteristics:

• Proxy: None
• Arc Gateway: Handles HTTPS traffic to Azure
• Connectivity: Arc Gateway to public internet
• Firewall Rules: Fewer than 30 endpoints

✅ Simplified rules

Fewer than 30 endpoints needed

❌ No HTTP proxy

HTTP traffic goes direct to firewall

4

Proxy with Arc Gateway

Best of both worlds: Arc Gateway for HTTPS to Azure, enterprise proxy for HTTP and third-party traffic.

Key Characteristics:

• Proxy: On-premises enterprise proxy
• Arc Gateway: Handles HTTPS traffic to Azure
• Connectivity: Arc Gateway + Proxy to public internet
• Firewall Rules: Fewer than 30 endpoints

✅ Best security

Minimal rules + proxy control

✅ Full visibility

All traffic is managed

🔐 Private Path - 1 Option

When using ExpressRoute/VPN for private Azure connectivity, there is only one supported configuration:

★

Azure Firewall Explicit Proxy + Arc Gateway

Only Option

All traffic routes through ExpressRoute/VPN to Azure Firewall Explicit Proxy, with Arc Gateway providing the secure tunnel to Azure services.

Key Characteristics:

• Proxy: Azure Firewall Explicit Proxy (in Azure VNET)
• Arc Gateway: Required for HTTPS traffic to Azure
• Connectivity: ExpressRoute or Site-to-Site VPN
• Internet: No public internet exposure

✅ Maximum security

No public internet exposure

✅ Centralized management

Azure Firewall policies

✅ Compliance ready

Meets strict regulatory requirements

⚠️ Why Only One Option?

The Private Path architecture requires:

• Azure Firewall Explicit Proxy - to serve as the enterprise proxy hosted in Azure
• Arc Gateway - to create secure tunnels for HTTPS traffic
• ExpressRoute/VPN - to provide private connectivity

Any variation from this architecture is not validated or supported by Microsoft.

Reserved Subnets: ARB & AKS

The Arc Resource Bridge (ARB) VM reserves specific IP ranges for internal Kubernetes operations. Never use these ranges for your private endpoint networks — traffic will fail to route correctly.

Traffic Flow Comparison: Public vs Private Path

Compare how traffic flows through each architecture side-by-side. Both paths handle the same traffic categories but route them differently.

Step 1: Bypass Traffic (Direct Communications)

Traffic that bypasses proxy entirely for internal communications and Private Link endpoints.

🌐 Public Path

• Internal intranet communications
• Node-to-node communications
• Private Link endpoints

🔐 Private Path

• Internal intranet communications
• Node-to-node communications
• Private Link endpoints (via ExpressRoute)

Step 2: HTTP Traffic via Proxy

HTTP traffic that cannot use Arc proxy is routed through enterprise proxy/firewall.

🌐 Public Path

• Node → On-premises proxy/firewall
• Proxy → Public internet → Azure

🔐 Private Path

• Node → Customer Firewall
• → ExpressRoute → Azure Firewall Explicit Proxy

Step 3: HTTPS Traffic via Arc Proxy

HTTPS traffic destined for Azure endpoints is routed through the Arc proxy to Arc Gateway.

🌐 Public Path

• Node → Arc Proxy → On-prem Firewall
• → Public Internet → Arc Gateway → Azure

🔐 Private Path

• Node → Arc Proxy → Customer Firewall
• → ExpressRoute → Azure Firewall → Arc Gateway → Azure

Step 4: Azure Resource Bridge (ARB) VM via Cluster IP

ARB VM uses Cluster IP as its proxy endpoint to route traffic through Arc Gateway.

🌐 Public Path

• ARB VM → Cluster IP:40343
• → Arc Gateway → Public Internet → Azure

🔐 Private Path

• ARB VM → Cluster IP:40343
• → ExpressRoute → Arc Gateway → Azure

Step 5: AKS Clusters via Cluster IP Proxy

AKS Control Plane VMs, Worker VMs, and Pods route traffic through Cluster IP proxy.

🌐 Public Path

• AKS VMs/Pods → Cluster IP:40343
• → Arc Gateway → Public Internet → Azure

🔐 Private Path

• AKS VMs/Pods → Cluster IP:40343
• → ExpressRoute → Arc Gateway → Azure

Step 6: Azure Local VMs via Dedicated Arc Proxy

Each Azure Local VM uses its own dedicated Arc proxy for HTTPS traffic.

🌐 Public Path

• VM → Dedicated Arc Proxy
• → Arc Gateway → Public Internet → Azure

🔐 Private Path

• VM → Dedicated Arc Proxy
• → ExpressRoute → Arc Gateway → Azure

Traffic Categories

Network traffic is categorized based on how it should be routed. These categories apply to both Public and Private Path architectures.

AKS Clusters on Separated Subnet

When AKS clusters run on a separated subnet from the Azure Local infrastructure subnet, additional firewall rules are required.

🌐 Public Path

Diagram showing AKS subnet firewall requirements (Public Path).

🔐 Private Path

Firewall Requirements

Traffic between AKS subnet and Azure Local Infrastructure subnet

Configuration

Proxy Bypass Requirements

When defining your proxy bypass string for Arc initialization or the Companion App, include:

# Bypass list format (comma-separated)
192.168.1.10,192.168.1.11,192.168.1.12,   # Node IPs
192.168.1.100,                              # Cluster IP
192.168.1.*,                                # Infrastructure subnet
NODE1,NODE2,NODE3,                          # NetBIOS names
CLUSTER01,                                  # Cluster NetBIOS
*.contoso.com,                              # Domain wildcard
keyvault.vault.azure.net,                   # Private Link endpoints
storageaccount.blob.core.windows.net

Registration Script Examples

Use these PowerShell scripts to register Azure Local nodes with Azure Arc. Run on each node as local administrator.

# Define tenant and subscription
$Tenant = "YourTenantID"
$Subscription = "YourSubscriptionID"
$RG = "YourResourceGroupName"
$Region = "eastus"  # Do not use spaces or capital letters

# Invoke registration (no proxy, no Arc Gateway)
Invoke-AzStackHciArcInitialization `
    -TenantId $Tenant `
    -SubscriptionID $Subscription `
    -ResourceGroup $RG `
    -Region $Region `
    -Cloud "AzureCloud"

# Define tenant and subscription
$Tenant = "YourTenantID"
$Subscription = "YourSubscriptionID"
$RG = "YourResourceGroupName"
$Region = "eastus"  # Do not use spaces or capital letters

# Define proxy server address
$ProxyServer = "http://proxyaddress:port"

# Define bypass list (comma-separated)
# Use "localhost" instead of <local>
# Use * for subnets: 192.168.1.* for /24, 192.168.*.* for /16
# Append * for domains: *.contoso.com
# Include: Node IPs, Cluster IP, Infrastructure IPs, NetBIOS names, Private Endpoints
$ProxyBypassList = "localhost,127.0.0.1,*.contoso.com,machine1,machine2,machine3,192.168.*.*,AzureLocal-1,mykeyvault.vault.azure.net,mystorageaccount.blob.core.windows.net,mystorageaccount.file.core.windows.net"

# Invoke registration (with proxy, no Arc Gateway)
Invoke-AzStackHciArcInitialization `
    -TenantId $Tenant `
    -SubscriptionID $Subscription `
    -ResourceGroup $RG `
    -Region $Region `
    -Cloud "AzureCloud" `
    -Proxy $ProxyServer `
    -ProxyBypass $ProxyBypassList

# In Azure Portal:
# 1. Go to your Arc gateway resource
# 2. On the Overview page, copy the Resource ID
# Format: /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.HybridCompute/gateways/{name}

# Define tenant and subscription
$Tenant = "YourTenantID"
$Subscription = "YourSubscriptionID"
$RG = "YourResourceGroupName"
$Region = "eastus"  # Do not use spaces or capital letters

# Define Arc Gateway Resource ID from Azure Portal
$ArcgwId = "/subscriptions/yourSubscriptionId/resourceGroups/yourResourceGroupName/providers/Microsoft.HybridCompute/gateways/yourArcGatewayName"

# Invoke registration (no proxy, with Arc Gateway)
Invoke-AzStackHciArcInitialization `
    -TenantID $Tenant `
    -SubscriptionID $Subscription `
    -ResourceGroup $RG `
    -Region $Region `
    -Cloud "AzureCloud" `
    -ArcGatewayID $ArcgwId

# In Azure Portal:
# 1. Go to your Arc gateway resource
# 2. On the Overview page, copy the Resource ID
# Format: /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.HybridCompute/gateways/{name}

# Define tenant and subscription
$Tenant = "YourTenantID"
$Subscription = "YourSubscriptionID"
$RG = "YourResourceGroupName"
$Region = "eastus"  # Do not use spaces or capital letters

# Define proxy server address
$ProxyServer = "http://proxyaddress:port"

# Define bypass list (comma-separated)
# Use "localhost" instead of <local>
# Use * for subnets: 192.168.1.* for /24, 192.168.*.* for /16
# Append * for domains: *.contoso.com
# Include: Node IPs, Cluster IP, Infrastructure IPs, NetBIOS names, Private Endpoints
$ProxyBypassList = "localhost,127.0.0.1,*.contoso.com,machine1,machine2,machine3,192.168.*.*,AzureLocal-1,mykeyvault.vault.azure.net,mystorageaccount.blob.core.windows.net,mystorageaccount.file.core.windows.net"

# Define Arc Gateway Resource ID from Azure Portal
$ArcgwId = "/subscriptions/yourSubscriptionId/resourceGroups/yourResourceGroupName/providers/Microsoft.HybridCompute/gateways/yourArcGatewayName"

# Invoke registration (with proxy and Arc Gateway)
Invoke-AzStackHciArcInitialization `
    -TenantID $Tenant `
    -SubscriptionID $Subscription `
    -ResourceGroup $RG `
    -Region $Region `
    -Cloud "AzureCloud" `
    -Proxy $ProxyServer `
    -ArcGatewayID $ArcgwId `
    -ProxyBypass $ProxyBypassList

# Check Arc agent configuration
& "C:\Program Files\AzureConnectedMachineAgent\azcmagent.exe" show

# Expected values:
# - Agent Status: Connected
# - Using HTTPS Proxy: http://localhost:40343 (when Arc Gateway enabled)
# - Upstream Proxy: Your enterprise proxy (if configured)
# - Azure Arc Proxy: Running (when Arc Gateway enabled)

# Verify connectivity
& "C:\Program Files\AzureConnectedMachineAgent\azcmagent.exe" check

# All URLs should show Reachable: true
# Connection.type should be "gateway" when Arc Gateway is enabled