none
Outbound IP Addresses RRS feed

  • Question

  • For standard Azure App Services, going to the Properties blade will display the outbound IP Addresses that may be used by the App Service. I have a particular scenario where the function needs to make an outbound connection to an On Prem service. 

    While I may determine I want to secure things differently later, at least for development I would like to be able to whitelist the IP addresses used by the Functions App. Unfortunately the `Outbound IP Addresses` field is completely missing in Functions App. I've tried this in both a functions app that is setup with it's own Consumption plan, and one set up using one of my existing App Service Plans. 

    I really don't want it on my existing App Service Plan as it would make the Functions App compete for resources against my web apps, though that would at least give me the ability to pull the Outbound IP's from one of my existing App Services. 

    Saturday, June 10, 2017 10:19 PM

Answers

  • Hi Dan,

    For Consumption plan, this is not available because Function Apps can end up running in many different scale units, and there just isn't a fixed list of outbound IPs.

    For App Service Plans, it is available, and the fact that the Portal doesn't shot them is really a bug (I'll report). Luckily, you can find them using https://resources.azure.com/. See this post for detailed instructions.

    David

    Sunday, June 11, 2017 1:22 AM

All replies

  • Hi Dan,

    For Consumption plan, this is not available because Function Apps can end up running in many different scale units, and there just isn't a fixed list of outbound IPs.

    For App Service Plans, it is available, and the fact that the Portal doesn't shot them is really a bug (I'll report). Luckily, you can find them using https://resources.azure.com/. See this post for detailed instructions.

    David

    Sunday, June 11, 2017 1:22 AM
  • Is this still the case? If I go to Azure Resource Explorer for a function app on a consumption plan I see two keys, each with 4 ip addresses. "outboundIpAddresses" and "possibleOutboundIpAddresses".



    • Edited by Ian1971 Thursday, January 18, 2018 4:04 PM
    Thursday, January 18, 2018 4:04 PM
  • Hi Ian,

    It is still the case. Let me explain a little more:

    • Each region has many scale units
    • Each scale unit had a different set of outbound IP addresses
    • A regular Web App (or Function App in App Service Plan) runs in a single scale unit, and hence has predictable outbound IPs.
    • A Consumption Function app has a 'home' scale unit, but can scale out to have instances in other scale units. What you see in Resource Explorer reflects the home scale unit, and will appear to be correct most of the time under basic testing. But it cannot be relied on. That's why we don't show it in the Portal. It probably would be best if the API didn't even advertize the home scale unit's IP's, as it can lead to confusion.


    Hope this helps,
    David

    Thursday, January 18, 2018 5:26 PM
  • Thanks for the confirmation. I think we were given a wrong steer in an Azure "Ask the Expert" session ages ago when we first looked at azure functions, as we were told that we could use those ip addresses. As a result we have had azure functions in production on a consumption for quite a while now assuming those 4 ip addresses. On the plus side, it hasn't failed yet but we definitely need to address it by the sounds of it.

    edit: Thinking about it, we are only using timers at the moment, so possibly it never needs to scale out, and that might explain why we never had any issue.

    • Edited by Ian1971 Thursday, January 18, 2018 5:48 PM
    Thursday, January 18, 2018 5:42 PM
  • You could go for a very long time without leaving the home scale unit, but be aware that the possibility does exist. You can look at the WEBSITE_CURRENT_STAMPNAME environment variable to check what scale unit (aka 'stamp') any execution is in.

    David

    Thursday, January 18, 2018 5:50 PM
  • Is it possible to define a set of ip ranges that would cover the possible scale units? 
    Thursday, January 18, 2018 5:58 PM
  • Not really. There can be lots of scale units, and new ones are frequently added. So any list would be short lived.
    Thursday, January 18, 2018 7:29 PM
  • Ok. Thanks for your help and advice.
    Friday, January 19, 2018 9:59 AM