Build NAT Gateway configs with public IP addresses, IP prefixes, subnet associations, and idle timeout settings.
Build NAT Gateway configs with public IP addresses, IP prefixes, subnet associations, and idle timeout settings.
Required Fields
nameresourceGrouplocationsku.namepublicIpAddressessubnetAssociationsOutput will appear here...Build an Azure NAT Gateway configuration with associated public IP addresses/prefixes and subnetAssociations, providing outbound-only internet connectivity for subnets without exposing them via individual public IPs on each VM. idleTimeoutInMinutes controls how long a NAT Gateway keeps a flow's port mapping reserved after the connection goes idle, a longer timeout is friendlier to long-lived, bursty connections (avoiding SNAT port exhaustion from reconnect churn) but ties up more of the gateway's limited SNAT port pool per flow, and multiple public IPs (as the example's two IP addresses plus a /30 prefix) directly multiply the total available SNAT ports, the actual lever for avoiding SNAT exhaustion under high outbound connection volume.
Effectively, yes for SNAT port availability, each public IP provides its own pool of ephemeral SNAT ports, so adding IPs directly multiplies the total pool available for outbound connection multiplexing. If a subnet behind the gateway is experiencing SNAT port exhaustion (connection failures under high outbound connection volume), adding public IPs is the primary lever to address it, not increasing instance size or anything compute-related, since NAT Gateway is a fully managed service with no underlying VM to resize.
It can go either way depending on connection pattern: a longer timeout avoids the port churn of frequently reconnecting bursty-but-long-lived connections, but it also means a genuinely finished connection's port stays reserved longer before being freed for reuse, tying up pool capacity for connections that are actually done. Tune this based on your actual connection lifecycle pattern, not as a blanket 'longer is always safer' assumption.
No, that's the entire point of NAT Gateway, once a subnet is associated, all outbound internet traffic from resources in that subnet routes through the NAT Gateway's public IP(s) automatically, individual VMs don't need (and for outbound-via-NAT-Gateway purposes, shouldn't need) their own public IPs. This gives you a small, controlled set of outbound source IPs for the whole subnet rather than one per VM.
The builder validates that name, resourceGroup, location, sku.name, publicIpAddresses, and subnetAssociations all resolve before accepting the JSON as a valid NAT Gateway resource definition, the fields Azure needs to provision the gateway and associate it with outbound IPs and subnets; it can't verify the referenced VNet/subnet actually exists or compute whether the configured IP count is sufficient for your actual outbound connection volume, that's only observable from live traffic metrics.
SNAT port exhaustion is diagnosed via NAT Gateway's own metrics (dropped packets, SNAT connection count), not guessed at, if outbound connections are intermittently failing under load, check these metrics before assuming it's an application-level issue.
Adding public IPs is the correct lever for SNAT capacity, not resizing anything, since NAT Gateway has no underlying compute to scale, this is a common point of confusion for engineers used to scaling other network appliances by instance size.
Match the NAT Gateway's zone deployment to the zone redundancy of the subnets it serves, a zone-redundant subnet setup behind a single-zone NAT Gateway reintroduces a single point of failure the subnet's own redundancy was meant to eliminate.
Was this tool helpful?
Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.