How to override VNET

Hello @Thandisizwe Jack ,

Thank you for reaching out to Microsoft Q&A!

The guidance already shared in the thread is accurate. Service endpoints on the APIM subnet for Azure SQL (primary region), Azure Storage, Azure Event Hubs, and Azure Key Vault are the documented approach to keep dependency traffic on the Azure backbone rather than force tunneling it through the firewall. Overriding the default route toward a hub firewall is supported for an internal-mode APIM deployment, provided the documented APIM dependencies and routing requirements are configured correctly.

One additional step in the documentation that is easy to overlook, and is frequently the cause of force-tunneled deployment issues, is configuring a UDR for the ApiManagement service tag with a next hop type of Internet. Control-plane traffic reaches the management endpoint on port 3443 from the ApiManagement service tag IP ranges. When this traffic is force tunneled, return traffic may not follow the expected path, causing loss of connectivity to the management endpoint. Microsoft notes that allowing this return path to bypass the firewall is not considered a significant security risk because inbound access on port 3443 should already be restricted to the ApiManagement service tag.

A few points specific to your design:

• Any remaining outbound dependency traffic routed through the hub firewall must be allowed, including metrics and health monitoring, Azure portal diagnostics, SMTP relay, developer portal CAPTCHA, and Azure KMS.
• Since your deployment uses internal mode behind an internal Application Gateway, the per-client UDR requirement for gateway and developer portal data-plane traffic does not apply, as that guidance is specific to external-mode deployments.

After the routes are configured, you can review Network > Network status in the APIM instance to validate connectivity to required and optional dependencies and confirm that the firewall is not blocking necessary traffic.

Reference: Deploy your Azure API Management instance to a virtual network - Internal mode (Force tunnel traffic to on-premises firewall using ExpressRoute or network virtual appliance)

Please "Upvote the Answer" if this information helped you. This will help us and others in the community as well.

Yes, but not as a blanket forced-tunnel without exceptions.

For an Azure API Management instance deployed in internal mode inside a VNet, sending all outbound traffic from the APIM subnet to an on-premises firewall or hub firewall by using a default route (0.0.0.0/0) can break APIM connectivity. This happens when outbound traffic is blocked or NATed in a way that no longer works with required Azure endpoints.

Supported guidance is:

If a default route from the APIM subnet points to the hub firewall or another network virtual appliance, enable service endpoints on the APIM subnet for these dependent services: Azure SQL Azure Storage Azure Event Hubs Azure Key Vault With those service endpoints enabled, traffic from APIM to those Azure services uses the Azure backbone and is not force tunneled. Any remaining APIM dependency traffic that is still force tunneled must be explicitly allowed through the firewall or virtual appliance. If that traffic is blocked, APIM might not function correctly. If the requirement is to force tunnel all traffic from the APIM subnet, the firewall or virtual appliance must allow the complete IP address range of each dependent service and that configuration must be kept current as Azure infrastructure changes. Be aware that force tunneling APIM traffic can introduce latency or unexpected timeouts. For a hub-and-spoke design with APIM internal mode behind an internal Application Gateway, overriding the APIM subnet default route toward the hub firewall is therefore acceptable only when the APIM service dependencies are handled correctly. The safer documented pattern is to use service endpoints for the supported dependencies and ensure the hub firewall allows the remaining required outbound traffic.