Attaching API Management Standard v2 to VNET integration all api calls fails with 503

Question

When attaching API Management Standard v2 to VNET integration all api calls fail with 503. Api:s with public api endpoint as backend  and mocked responses in APIM fails as well. If I remove VNET integration all works as expected again.

How is VNET integration affecting access to the public endpoint of APIM? Isn’t only backend affected?

Answer 1

Hello Jörgen Stenhag,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that while you're attaching API Management Standard v2 to VNET integration all API calls fail with 503.

The common root causes of 503 with VNET Integration are NSG Rules, DNS Resolution, and APIM Deployment Mode though not limited to it. Because, even with 503 Errors with Mocked Responses, APIM must handle requests correctly, which requires healthy infrastructure and successful DNS resolution. If APIM can’t process the request (due to NSG, DNS, or misconfigurations), it will still return a 503 error.

There are four major areas in the links below that you can consider checking or that can cause this issue you are experiencing:

1. VNET integration isolates your APIM instance within the virtual network. Check this answer - https://learn.microsoft.com/en-us/answers/questions/1526025/can-t-scale-apim-standard-v2-with-vnet-integration by @JananiRamesh-MSFT
2. Network Security Groups applied to the VNET can restrict traffic and when APIM is integrated with a VNET, DNS resolution and routing might change. https://techcommunity.microsoft.com/discussions/azure/api-management-service-secure-configuration-for-standard-v2-sku/4336449
3. If your APIM instance is set to "Internal" mode within the VNET, it will only be accessible from within the VNET or through a VPN/ExpressRoute connection. - https://learn.microsoft.com/en-us/azure/api-management/integrate-vnet-outbound

You can resolve the issue by checking DNS settings that it's correctly configured to resolve public endpoints and verify that NSG rules allow the necessary traffic to and from the APIM instance. Also, consider using Azure Application Gateway or Azure Front Door to manage and secure traffic to your APIM instance - https://techcommunity.microsoft.com/discussions/azure/api-management-service-secure-configuration-for-standard-v2-sku/4336449

I hope this is helpful! Do not hesitate to let me know if you have any other questions.

---

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.