Rethinking Internet Access for Azure VMs: A Simpler, Scalable Alternative with Alkira

The Upcoming Change in Azure VM Internet Access

Starting September 30, 2025, newly created Azure Virtual Machines (VMs) will no longer have internet access via default source network address translation (SNAT).  But you would still be able to manually assign a public IP to the Azure VM. So, what this really means is that if your company has a smaller footprint in Azure, then you can just manually assign a public IP to the VMs and not much is going to change for you. However, for medium and large enterprise, exposing VMs to the public network and performing manual assignment to VMs (even with automation) can be a daunting task.

The Current Landscape: Complex and Fragmented

Many enterprises allow internet traffic, in and out, of their network using typically instance level public IP on NGFW, public load balancers, or NAT Gateways in each VNet. These methods are complex and inefficient. For example, the Public IP can be assigned to a VM directly which exposes the instances to security risks. Using Public IP assigned to NGFW in a hub-and-spoke architecture for centralized internet traffic, creates complex do-it-yourself designs, which are operationally inefficient and less agile. Customers may also allow public access through load balancers, but this cannot be a standard solution across different teams in an enterprise as not every instance resource may sit behind a load balancer.

The Distributed NAT Gateway Dilemma

One, apparently convenient way that is getting marketed by some companies, is to choose to deploy an Azure NAT Gateway or a 3rd Party NAT Gateway in each Virtual Network (VNet). But you should ask the question, if that design is aligned to your future vision of Network Infrastructure-as-a-SaaS and can that bring simplicity and agility to your business? 

Let’s look at several inefficiencies and challenges associated with the use of distributed NAT Gateways:

1. Cost Implications: Each NAT Gateway incurs additional costs, which can quickly add up, especially in environments with multiple VNets. This can significantly increase the overall expenditure on cloud infrastructure.
2. Complex Management: Managing multiple NAT Gateways across various VNets can become cumbersome. It requires careful configuration and monitoring to ensure proper functionality and security, adding to the operational overhead.
3. Scalability Issues: As the number of VNets grow, scaling the NAT Gateways to accommodate increased traffic can become complex and resource-intensive. This can lead to potential bottlenecks and performance degradation. The 3rd party NAT Gateway may only rely on the native Azure NAT Gateway for redundancy, adding to operational complexity. 
4. Distributed Design: Customers have to implement NAT gateways in each of their multi-cloud environments separately, making the use of NAT Gateways even more complex in a distributed design. 
5. Security Concerns: Each NAT Gateway represents a potential point of failure and a target for security threats. Ensuring consistent security policies across multiple gateways can be challenging and may lead to vulnerabilities. Some vendors claim to replace Azure NAT Gateways with their own NAT gateways with added security, however, issues of cost implications, complex management, and scalability remain. 

Alkira’s Vision: Network Infrastructure-as-a-Service

Alkira’s on-demand Network Infrastructure as-a-service removes the pain of keeping up with the changes in Cloud Service Providers. Customers can leverage Alkira’s on-demand network infrastructure, which is available globally, to build virtual PoPs called Cloud Exchange Points (CXPs); run security and network services inside of CXPs. Customers can configure Internet Exit Connectors, per segment, in each CXP. Moreover, customers connect any cloud, on-prem location, remote user or app to any CXP region and use the same internet exit. Moreover, using Alkira’s Internet Facing Application feature, customers can also receive traffic from the public networks to any server or resource deployed in any hybrid environment connected to Alkira.

Therefore, Alkira offers a streamlined approach that eliminates the need for Instance Level Public IP, Public Load-balancers or NAT Gateways for Internet Exit, and provides below benefits:

1. Cost Efficiency: Alkira’s design eliminates the need for multiple NAT Gateways, leading to significant cost savings. This is particularly beneficial for organizations with extensive cloud deployments.
2. Simplified Management: With Alkira, the complexity of managing multiple NAT Gateways is removed. This simplifies network management and reduces the operational burden on IT teams.
3. Enhanced Scalability: Alkira’s solution is designed to scale seamlessly with your network needs. It can handle increased traffic without the need for additional NAT Gateways, ensuring consistent performance.
4. Consolidated and Flexible Design:  Customers can deploy an internet exit connector in a CXP which can be used by any on-prem or multi-cloud resource. Furthermore, each of the Alkira Segments can have a separate internet exit connector for end-to-end traffic isolation. 
5. Traffic Control: Using Alkira Traffic Policies, customers have complete control of how traffic moves within CXP. Traffic policies can restrict or allow specific branches, VNETs, VPCs and VCNs to go to the Internet connector. 
6. Improved Security: By centralizing internet exit points from the CXP, Alkira enhances security and reduces the attack surface. Customers can use centralized Alkira Traffic policies and 3rd party NGFW in CXP for packet inspection. This is how consistent security policies can be applied more effectively for your entire region, instead of a management overhaul with NAT GW/FW in each of the VNET. Alkira design ensures robust protection across the network.
7. Agility: Customers can build global secure networks in minutes using the intuitive point-and-click user interface or by leveraging APIs & SDKs or Terraform, with no hardware or circuits to acquire or run any software appliances or agents anywhere.

In summary, Alkira’s innovative design offers a more efficient, scalable, and secure solution for Internet Ingress and Egress traffic, making it a superior choice compared to traditional NAT Gateway deployments in any Cloud Service Provider environment. With Alkira’s Network Infrastructure-as-a-Service platform, you are future proof from the overhaul and dependency of Cloud Native changes. Bring simplicity and agility to your network, with Alkira.

For more information, visit www.alkira.com or contact us.