Differences and considerations for Azure Stack Hub networking

Azure Stack Hub networking has many of the features provided by Azure networking. However, there are some key differences that you should understand before deploying an Azure Stack Hub network.

This article provides an overview of the unique considerations for Azure Stack Hub networking and its features. To learn about high-level differences between Azure Stack Hub and Azure, see the Key considerations article.

Important

Azure Stack Hub does not offer support for IPv6 and there are no roadmap items to provide support.

Cheat sheet: Networking differences

Service Feature Azure (global) Azure Stack Hub
DNS Multitenant DNS Supported Not yet supported
DNS zones per subscription 100 (default)
Can be increased on request.
100
DNS record sets per zone 5000 (default)
Can be increased on request.
5000
Name servers for zone delegation Azure provides four name servers for each user (tenant) zone that is created. Azure Stack Hub provides two name servers for each user (tenant) zone that is created.
Azure Firewall Network security service Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources. Not yet supported.
Virtual Network Virtual network peering Connect two virtual networks in the same region through the Azure backbone network. Supported since version 2008 Virtual Network peering
IPv6 addresses You can assign an IPv6 address as part of the Network Interface Configuration. Only IPv4 is supported.
DDoS Protection Plan Supported Not yet supported.
Scale Set IP Configurations Supported Not yet supported.
Private Access Services (Subnet) Supported Not yet supported.
Service Endpoints Supported for internal (non-Internet) connection to Azure Services. Not yet supported.
Service Endpoint Policies Supported Not yet supported.
Service Tunnels Supported Not yet supported.
Network Security Groups Augmented Security Rules Supported Supported.
Effective Security Rules Supported Not yet supported.
Application Security Groups Supported Not yet supported.
Rule Protocols TCP, UDP, ICMP, Any Only TCP, UDP or Any
Virtual Network Gateways Point-to-Site VPN Gateway Supported Not yet supported.
Vnet-to-Vnet Gateway Supported Not yet supported.
Virtual Network Gateway Type Azure Supports VPN
Express Route
Hyper Net.
Azure Stack Hub currently supports only VPN type.
VPN Gateway SKUs Support for Basic, GW1, GW2, GW3, Standard High Performance, Ultra-High Performance. Support for Basic, Standard, and High-Performance SKUs.
VPN Type Azure supports both policy-based and route-based. Azure Stack Hub supports route-based only.
BGP settings Azure supports configuration of BGP peering address and peer weight. BGP peering address and peer weight are automatically configured in Azure Stack Hub.
Support for up to 150 routes for BGP advertisement.
There's no way for you to configure these settings with your own values.
Default Gateway Site Azure supports configuration of a default site for forced tunneling. Not yet supported.
Gateway Resizing Azure supports resizing the gateway after deployment. Resizing not supported.
Availability Configuration Active/Active Active/Passive
UsePolicyBasedTrafficSelectors Azure supports using policy-based traffic selectors with route-based gateway connections. Not yet supported.
Monitoring and Alerts Azure uses Azure Monitor to set up alerts for VPN resources. Not yet supported.
ASN Azure supports 4-byte ASNs. Azure Stack Hub only supports 2-byte ASNs (up to 65535).
Load balancer SKU Basic and Standard Load Balancers are supported Only the Basic Load Balancer is supported. The Standard Load Balancer is currently in public preview. For information, see Standard Load Balancer considerations.
The SKU property isn't supported.
The Basic SKU load balancer supports 200 front-end IP configurations per load balancer.
Zones Availability Zones are Supported. Not yet supported
Inbound NAT rules support for service endpoints Azure supports specifying Service Endpoints for inbound NAT rules. Azure Stack Hub doesn't yet support service endpoints, so these rules can't be specified.
Protocol Azure Supports specifying GRE or ESP. Protocol Class isn't supported in Azure Stack Hub.
Health Probes Azure originates the Load Balancer health probes from the IP address 168.63.129.16 Azure Stack Hub Load Balancer health probes source is from the subnet Gateway IP and originates from the host where the Virtual Machine DIP is present. For example, if the subnet range is 10.0.0.0/24, the first IP of the subnet is reserved for the gateway IP, which would be 10.0.0.1.
FloatingIP When enabled, Frontend and backend ports can be different. Azure Stack Hub only supports FloatingIP enabled with same Frontend and Backend port
Internal Load Balancer Front end IP No limit. Azure Stack Hub provides an IP pool of 127 IPs for the internal load balancer's front end IPs. A small subset of that IP pool (8) is used for its internal infrastructure and 119 are available for users.
Public IP Address Public IP Address Version Azure supports both IPv6 and IPv4. Only IPv4 is supported.
SKU Azure supports Basic and Standard. Only Basic is supported.
Network Interface Get Effective Route Table Supported Not yet supported.
Get Effective ACLs Supported Not yet supported.
Enable Accelerated Networking Supported Not yet supported.
IP Forwarding Disabled by default. Can be enabled. Toggling this setting isn't supported. On by default.
Application Security Groups Supported Not yet supported.
Internal DNS Name Label Supported Not yet supported.
Private IP Address Version Both IPv6 and IPv4 are supported. Only IPv4 is supported.
Static MAC Address Not supported Not supported. Each Azure Stack Hub system uses the same MAC address pool.
Network interface for virtual machines Supported. New network interface configuration only applied after rebooting the virtual machine. Supported. New network interface configuration is applied while the virtual machine is running. This process might impact overall virtual machine connectivity and drop existing connections for a few seconds. It's recommended that you add the network interface while the virtual machine is stopped or during a planned maintenance.
Primary Network interface for virtual machines replacement Supported. New network interface configuration only applied after rebooting the virtual machine. It's possible to replace the primary network interface of a virtual machine by stopping the VM, attaching a second network interface, detaching the primary interface and deleting the primary network interface resource. If the primary network interface resource is not deleted, the virtual machine can't start.
Network Watcher Network Watcher tenant network monitoring capabilities Supported Not yet supported.
CDN Content Delivery Network profiles Supported Not yet supported.
Application gateway Layer-7 load balancing Supported Not yet supported.
Traffic Manager Route incoming traffic for optimal application performance and reliability. Supported Not yet supported.
Express Route Set up a fast, private connection to Microsoft cloud services from your on-premises infrastructure or colocation facility. Supported Support for connecting Azure Stack Hub to an Express Route circuit.
Virtual Machine Scale Sets Public IP per Virtual Machine Supported Not supported. If needed, similar functionality can be achieved with a load balancer.
Update or change VMs primary NIC Supported Not supported. It's not possible to elevate a secondary NIC to primary or vice versa in Azure Stack Hub.

API versions

Azure Stack Hub Networking supports the following API versions:

  • 2018-11-01
  • 2018-10-01
  • 2018-08-01
  • 2018-07-01
  • 2018-06-01
  • 2018-05-01
  • 2018-04-01
  • 2018-03-01
  • 2018-02-01
  • 2018-01-01
  • 2017-11-01
  • 2017-10-01

Next steps

DNS in Azure Stack Hub