Does azure use static ip on a standard 1 app service plan - azure

Have one app service plan (standard 1 pricing tier) with only one web app. From what I understand I have a static ip based on this configuration / price. So when I do an nslookup on my web site and get an ip back, that ip is static correct? Just needed verification. TIA.


So when I do an nslookup on my web site and get an ip back, that ip is static correct? Just needed verification
Every Azure Web App have 1 external IP address and multi outbound addresses. What you saw from nslookup is external IP address.
The external IP address(Inbound address) is used for domain binding(A record binding). If you want to binding your custom domain, please use external IP address. You could find the external IP address from Azure portal. Web App->Custom Domains tab.
From official document, we know
If you delete and recreate your app, or change from a higher pricing tier back to the Shared tier, your app's external IP address may change. Otherwise, the external IP address won't be changed.
Traffic come from your web app will use one of the outbound addresses as IP address. There is no agreement of when the outbound IP address will change or not. They will not change from 1 day to the next, nor is there any plan or real need to change them.
will there be some type of notification from azure when the outbounds do change?
There is no official document which pointed it out. I found following words from MSDN forum. Hope it will be helpful for you.
It becomes necessary for Azure infrastructure to increase the number of outbound IP addresses. In that case the existing IP addresses will be preserved but there will be some new ones. So far there hasn't been a need to increase number of IP addresses and if there ever be the need for that there will be an early notice about it.
The Web App gets relocated to a different scale unit. Prior to that the subscription owner gets an email notification one month in advance.
From: Static outbound IP addresses for Azure Web Apps?


I'm pretty sure you are assigned 4 external IP addresses, so at the very least there are 4 ip addresses you need to consider static, but from what I can tell they are subject to change (that's how it previously was, I'm not sure if it holds now).
Also, remember that those are shared, so whitelisting those is potentially dangerous.

Related

Keeping my out bound IPs on App Service

I have a website on Azure App service and I've asked a service provider to open up for my outbound IP addresses. How can I make sure that those IPs won't change?
If there is a new IP assigned to my app service, all calls from that IP will be blocked by the service provider.

The outbound IP addresses are per stamp/scale unit that the apps are on. It is not specific to a certain webspace or resource group.
You can find the stamp/scale unit in the Properties blade under the FTP Hostname endpoint. It should list out something like "waws-prod--". All of the apps in the same stamp/scale unit number in that region will have the same outbound IP addresses, as they are per stamp/scale unit.
The list of outbound IP addresses is not completely static but normally it does not change. Check out the reasons for the IP change in the thread outlined by Ruslan.
If you need both incoming and outgoing to be static, you will need an App Service Environment. This will give you dedicated IP addresses.
For more information see: https://learn.microsoft.com/en-us/azure/app-service/environment/app-service-app-service-environment-intro and https://msdn.microsoft.com/en-us/magazine/mt793270.aspx.

How to find app service that an outgoing IP address belongs to?

I have an IP address that I know belongs to one of the app services on Azure. How can I find out which app service is it?
UPDATE
Kaushal Kumar Panday's answer reveals IP Addresses on Azure do not belong to a single app service, but belong to a data centre.
Is there any way to get a list of app services in an Azure account that share an outgoing IP Address?

In Azure App Service, the Outbound IP Address do not correspond to any specific Web App. They are tied to the data centre and shared by all the apps on that data centre.
So all the sites running on that specific data centre will have the same Outbound IP Address.
There is no way to trace back to the web app using the IP. You may be able to trace it back to the specific data centre, but not the originating web app.
UPDATE
Your site on the same data centre can have different list of Outbound IP Addresses. A data centre is a logical unit, which is comprised of several physical units. For example, West Europe is a logical entity which is comprised of several physical data centres. This approach is used to scale the data centres. See this article: Inside Azure App Service Architecutre
On one scale unit (physical DC) several thousands of sites are running and you might be seeing the Outbound IP address of that specific scale unit.
Also, if you have all the apps inside the same app service plan, then their Outbound IP Address will always be the same.
If you ping the default name of the web app you will know the actual scale unit as shown below

This might help for others, but if you go into your app service and choose Properties you will see the Outbound IP Addresses and additional outbound ip addresses of that particular app service. It's a list of IPs, not just one. Pinging your service will not give you the IP you're looking for as that is your inbound IP address.
I can confirm that for the last 6 months, our IP address list hasn't changed. I know these are shared, which for some might be a security issue, so beware when opening a firewall rule.

How often can MS Azure App Services Outbound IP addresses change?

I'm using Azure App Services that calls an external API that uses white-listing of IP addresses for defense-in-depth protection.
I'm aware I can find my Outbound IP addresses of my App Services under the WebApp -> Settings -> Properties -> Outbound IP addresses (showing a list of 4 comma separated IP addresses) which can be supplied to the external API whitelist. I understand Microsoft publishes a regularly updated list of Azure datacenter's IP addresses for outbound traffic that I can whitelist: https://www.microsoft.com/en-us/download/details.aspx?id=41653
The issue is the external API can only handle a number of IP addresses and not the full list of Azure datacenter IP's. Would it be safe to just provide the 4 comma separated IP addresses? Is there clear Microsoft documentation on how often or when the IP address can dynamically change?
I have tried to look for the answer and found two external sites that suggested it only changes when moving Azure regions [Ref 2] or if you scale up/down (but scale out/in is apparently fine) [Ref 1]. Is this correct information?
Is the Azure App Services Environment the only other viable alternative in my situation?

Late to the party on this one but just to flesh this out:
Unless you use an Application Service Environment (ASE) you cannot guarantee that the inbound or outbound IPs will change, however there some differences between inbound and outbound IP addresses.
When does an Inbound IP change?
Inbound IP will change when:
Delete an app and recreate it in a different resource group.
Delete the last app in a resource group and region combination and recreate it.
Delete an existing SSL binding, such as during certificate renewal
However, this can be countered by getting a static IP for inbound connections configure an IP-based SSL binding - you can even use a self-signed cert if you're not using any SSL functionailty.
Outbound IP addresses
This is where you sit and it's the space that is a little more volitile, this is from the docs directly:
The set of outbound IP addresses for your app changes when you scale your app between the lower tiers (Basic, Standard, and Premium) and the Premium V2 tier.
So in a nutshell if you will never scale up or down then you should be fine.
Edit: Re-reading the above and with a little test it looks like it's saying that the IPs will not change unless you ramp right up to the Premium V2 tier from a lower tier (or vice versa). A cursory test backs this up so:
Running under F1 free tier and scaling up to P1v2 gave me the following IP addresses:
Scaling back down to any of the lower tiers reverted the IP addresses to the same as the F1 tier.
Possible remediation
A very solution specific example but in-case it helps - where I've solved this before is monitoring the outbound IP addresses for the webapp, if it notices a change then it could send those IP addresses to a whitelist for update via an API call - but this could also just cause a high priority ticket to be raised.
I should note that we could do this because it wouldn't be the end of the world for a little bit of outage and we weren't expecting to scale up and down very often.
Otherwise, as you've noted, an Application Service Environment is your only belt and braces option.
References
When do inbound IPs change?
When do outbound IPs change?
Get a static inbound IP addresses

In addition to above resources about changes the other thing is that additional IP's might be added to accommodate additional capacity for outbound n/w calls.
Specific comment to look out for is "With the recent upgrades the Websites service has a stable set of outbound IP addresses allocated to each of its scale units. We continue to monitor network utilization and we might add (though never remove) additional IP addresses." by Stefan_MS
https://social.msdn.microsoft.com/Forums/azure/en-US/fd53afb7-14b8-41ca-bfcb-305bdeea413e/maintenance-notice-upcoming-changes-to-increase-capacity-for-outbound-network-calls?forum=windowsazurewebsitespreview

Azure Website Reserved IP

I've been trying to find an answer to this for a few days.
I want to host a new azure website in either the Basic tier or Standard tier.
The site will be calling a third party service.
I need to give this service provider an IP address that they will whitelist.
So when the new azure website makes requests to this service the IP address for the request needs to always be the same, as this will be the IP whitelisted.
I read that Azure offers "Reserved IPs" for cloud services and VMs but I wanted to know if something similar can be done with Azure Websites as I really don't want to go with cloud/VM.
My knowledge of networking is limited but as I understand it, if I were to get an IP SSL cert and apply that to my Azure Website then the website would have a static IP address.
If that is the case, would any requests to the third party service be hitting the service providers external firewall with this same static IP?
Thanks for any advice people can give.

An SSL cert with Web Sites will be tied to an inbound IP address. However, Web Sites does not provide a static outbound IP address.
If you need a static IP address to align with 3rd-party services, you'd need to have something residing in Azure (e.g. Application tier) running in a cloud service / VM that your web site accesses, and then have that app tier (with static IP address) communicate with your 3rd-party services.

As David Makogon's answer points out, applying an IP-based SSL certificate only gives the website a static inbound IP address.
However, the outbound IP address a website uses when making outbound network calls can be determined based on where your website is hosted. Microsoft has a list of the these IP addresses here. The third-party service would have to whitelist all of the IP addresses used by the scale unit your website is hosted in (e.g. waws-prod-am2-005).

Correct me if I am wrong, but the information shared by Brant Bobby above shows that, in fact:
All Azure websites (/Web Apps) already have a discoverable and published outgoing IP address.
This outgoing IP address will never be unique to their own site however. So one must keep in mind if they use it for a white-list, it will be allowing in a lot of other Azure visitors hosted on the same scale unit.
Simply get the so-called "scale unit" name for your site, which is the same as what's given in your site's FTP address (and so forth), which is in the format: "waws-prod-[3LetterVar]-[3DigitNum]", e.g. waws-prod-blu-007.
As an example from that article, all the East US region Azure websites can find the four IP addresses their site may rely on as follows (so if white-listing, all 4 should be white-listed):
East US Region
Outbound IP addresses for each scale unit, currently 4 for each. They said they may add more IPs to each scale unit in the future, but these should not change.
waws-prod-blu-001: 168.62.48.13, 168.62.48.19, 168.62.48.33, 168.62.48.122
waws-prod-blu-003: 137.117.81.128, 137.117.81.142, 137.117.81.181, 137.117.81.82
waws-prod-blu-005: 137.117.80.189, 137.117.81.52, 137.117.81.90, 137.117.80.178
waws-prod-blu-007: 23.96.33.205, 23.96.34.196, 23.96.35.20, 23.96.36.229
waws-prod-blu-009: 23.96.97.203, 23.96.97.233, 23.96.97.235, 23.96.97.238
waws-prod-blu-011: 23.96.112.60, 23.96.112.117, 23.96.112.152, 23.96.112.15
waws-prod-blu-013: 191.238.8.154, 191.238.9.80, 191.238.9.94, 191.238.9.170
waws-prod-blu-015: 191.236.19.222, 191.236.19.242, 191.236.21.165, 191.236.18.160
waws-prod-blu-017: 191.238.32.104, 191.238.32.154, 191.238.34.67, 191.238.35.12
waws-prod-blu-019: 104.45.138.197, 104.45.142.87, 104.45.128.144, 104.45.142.131
waws-prod-blu-021: 191.237.24.189, 191.237.30.36, 191.237.26.164, 191.237.28.161
waws-prod-blu-023: 191.236.50.206, 191.237.30.215, 191.237.25.148, 191.237.22.195
waws-prod-blu-025: 191.237.31.86, 191.237.26.176, 191.237.20.70, 191.237.18.239

Azure now supports having static outbound IP address as well.
https://azure.microsoft.com/en-us/documentation/articles/app-service-app-service-environment-intro/
If we do not want to go for costlier App Service Environment setup, we can directly use the outbound IP addresses mentioned in the Azure portal in properties section, Azure assures that it remain 99.9% static. Nothing really changes until there is some changes data center wide. Moreover, the reserved Ip what we use in IaaS is also not 100% reserved for us and azure provides SLA of 99.9% here as well. So, In my opinion, instead of going for ASE and hosting IaaS and using reserved IP, we can just use outbound Ip provided by azure, since we get same reliability in both cases.

Configuring an IP address for SagePay Direct when using Windows Azure

I've entered the IP address from the Windows Azure Portal (both the one specified in the website Dashboard or within the Manage Domains area) but when trying to use SagePay Direct it returns that it is not a valid IP address.
I eventually solved this by doing a "showpost" for SagePay and then having to tell me what the IP address is.
The problem is - how can I determine this IP address for myself? As I worry that the IP address could change in the future.
If I use "Request.ServerVariables("LOCAL_ADDR")" (Classic ASP) it seems to return the local IP address of the webserver.

what if you create a script or something that just returns the visitor IP address and make a request, get or post, to that script from your server?

The IP Address that you see to use for your A records is not the outgoing IP Address used by Azure Websites. Hence why SagePay does not accept transactions from the website because it is an invalid IP Address.
Instead there are 4 IP Addresses that you need to add, and those 4 IP Addresses depend on what Scale Unit your site uses.
The scale unit for your site can be found from the FTP Host Name for your Azure website. For example: ftp://waws-prod-blu-011.ftp.azurewebsites.windows.net - the scale unit is 'waws-prod-blu-011'
I then put that into Google, and a couple of azure maintenance articles came up. Scroll the article to you see your region, and then your scale unit and there are the 4 IP Addresses you need.
Please refer to this azure maintenance article for more information.

Resources