Source network address translation (SNAT) is no longer a requirement for private endpoint destined traffic passing through a network virtual appliance (NVA). You may now configure a tag on your NVA VMs that will notify the Microsoft platform that you wish to opt into this feature. For all connection requests, from source to destination, SNATing will no longer be a requirement for private endpoint destined traffic traversing through your NVA.
Enabling this feature will provide a more streamlined experience for guaranteeing symmetric routing without impacting nonprivate endpoint traffic. It will also allow you to follow internal compliance standards where the source of traffic origination needs to be available during logging.
Additional Considerations:
- Enabling this feature is a platform update that will send a one-time reset of all long-running private endpoint connections established through the NVA. It is recommended that you enable this during a maintenance window.
- This will only impact traffic through your NVA, private endpoint destined traffic that circumvents the NVA will not be impacted.
How to Enable this Feature:
- Confirm the type of NVA you are using (VM or VMSS based).
- Add Tag to your relevant resource
a. VM Based: Add the Resource Tag with a key of disableSnatOnPL and a value of true to the VM NIC.
b. VMSS Based: Add the Resource Tag with a key disableSnatOnPL and a value of true to VM instance. - Validate Scenario.
Regional Availability:
This feature is available in all regions
Learn more:
What is Private Link
What is Azure Private Link? | Microsoft Docs
User Defined Routes
Azure network security groups overview | Microsoft Docs
Adding Tag to Resource
Tag resources, resource groups, and subscriptions for logical organization - Azure Resource Manager | Microsoft Learn