Differences and considerations for Azure Stack Hub networking
Azure Stack Hub networking has many of the features provided by Azure networking. However, there are some key differences that you should understand before deploying an Azure Stack Hub network.
This article provides an overview of the unique considerations for Azure Stack Hub networking and its features. To learn about high-level differences between Azure Stack Hub and Azure, see the Key considerations article.
Important
Azure Stack Hub does not offer support for IPv6 and there are no roadmap items to provide support.
Cheat sheet: Networking differences
| Service | Feature | Azure (global) | Azure Stack Hub |
|---|---|---|---|
| DNS | Multitenant DNS | Supported | Not yet supported |
| DNS zones per subscription | 100 (default) Can be increased on request. |
100 | |
| DNS record sets per zone | 5000 (default) Can be increased on request. |
5000 | |
| Name servers for zone delegation | Azure provides four name servers for each user (tenant) zone that is created. | Azure Stack Hub provides two name servers for each user (tenant) zone that is created. | |
| Azure Firewall | Network security service | Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources. | Not yet supported. |
| Virtual Network | Virtual network peering | Connect two virtual networks in the same region through the Azure backbone network. | Supported since version 2008 Virtual Network peering |
| IPv6 addresses | You can assign an IPv6 address as part of the Network Interface Configuration. | Only IPv4 is supported. | |
| DDoS Protection Plan | Supported | Not yet supported. | |
| Scale Set IP Configurations | Supported | Not yet supported. | |
| Private Access Services (Subnet) | Supported | Not yet supported. | |
| Service Endpoints | Supported for internal (non-Internet) connection to Azure Services. | Not yet supported. | |
| Service Endpoint Policies | Supported | Not yet supported. | |
| Service Tunnels | Supported | Not yet supported. | |
| Network Security Groups | Augmented Security Rules | Supported | Supported. |
| Effective Security Rules | Supported | Not yet supported. | |
| Application Security Groups | Supported | Not yet supported. | |
| Rule Protocols | TCP, UDP, ICMP, Any | Only TCP, UDP or Any | |
| Virtual Network Gateways | Point-to-Site VPN Gateway | Supported | Not yet supported. |
| Vnet-to-Vnet Gateway | Supported | Not yet supported. | |
| Virtual Network Gateway Type | Azure Supports VPN Express Route Hyper Net. |
Azure Stack Hub currently supports only VPN type. | |
| VPN Gateway SKUs | Support for Basic, GW1, GW2, GW3, Standard High Performance, Ultra-High Performance. | Support for Basic, Standard, and High-Performance SKUs. | |
| VPN Type | Azure supports both policy-based and route-based. | Azure Stack Hub supports route-based only. | |
| BGP settings | Azure supports configuration of BGP peering address and peer weight. | BGP peering address and peer weight are automatically configured in Azure Stack Hub. Support for up to 150 routes for BGP advertisement. There's no way for you to configure these settings with your own values. |
|
| Default Gateway Site | Azure supports configuration of a default site for forced tunneling. | Not yet supported. | |
| Gateway Resizing | Azure supports resizing the gateway after deployment. | Resizing not supported. | |
| Availability Configuration | Active/Active | Active/Passive | |
| UsePolicyBasedTrafficSelectors | Azure supports using policy-based traffic selectors with route-based gateway connections. | Not yet supported. | |
| Monitoring and Alerts | Azure uses Azure Monitor to set up alerts for VPN resources. | Not yet supported. | |
| ASN | Azure supports 4-byte ASNs. | Azure Stack Hub only supports 2-byte ASNs (up to 65535). | |
| Load balancer | SKU | Basic and Standard Load Balancers are supported | Only the Basic Load Balancer is supported. The Standard Load Balancer is currently in public preview. For information, see Standard Load Balancer considerations. The SKU property isn't supported. The Basic SKU load balancer supports 200 front-end IP configurations per load balancer. |
| Zones | Availability Zones are Supported. | Not yet supported | |
| Inbound NAT rules support for service endpoints | Azure supports specifying Service Endpoints for inbound NAT rules. | Azure Stack Hub doesn't yet support service endpoints, so these rules can't be specified. | |
| Protocol | Azure Supports specifying GRE or ESP. | Protocol Class isn't supported in Azure Stack Hub. | |
| Health Probes | Azure originates the Load Balancer health probes from the IP address 168.63.129.16 | Azure Stack Hub Load Balancer health probes source is from the subnet Gateway IP and originates from the host where the Virtual Machine DIP is present. For example, if the subnet range is 10.0.0.0/24, the first IP of the subnet is reserved for the gateway IP, which would be 10.0.0.1. | |
| FloatingIP | When enabled, Frontend and backend ports can be different. | Azure Stack Hub only supports FloatingIP enabled with same Frontend and Backend port | |
| Internal Load Balancer | Front end IP | No limit. | Azure Stack Hub provides an IP pool of 127 IPs for the internal load balancer's front end IPs. A small subset of that IP pool (8) is used for its internal infrastructure and 119 are available for users. |
| Public IP Address | Public IP Address Version | Azure supports both IPv6 and IPv4. | Only IPv4 is supported. |
| SKU | Azure supports Basic and Standard. | Only Basic is supported. | |
| Network Interface | Get Effective Route Table | Supported | Not yet supported. |
| Get Effective ACLs | Supported | Not yet supported. | |
| Enable Accelerated Networking | Supported | Not yet supported. | |
| IP Forwarding | Disabled by default. Can be enabled. | Toggling this setting isn't supported. On by default. | |
| Application Security Groups | Supported | Not yet supported. | |
| Internal DNS Name Label | Supported | Not yet supported. | |
| Private IP Address Version | Both IPv6 and IPv4 are supported. | Only IPv4 is supported. | |
| Static MAC Address | Not supported | Not supported. Each Azure Stack Hub system uses the same MAC address pool. | |
| Network interface for virtual machines | Supported. New network interface configuration only applied after rebooting the virtual machine. | Supported. New network interface configuration is applied while the virtual machine is running. This process might impact overall virtual machine connectivity and drop existing connections for a few seconds. It's recommended that you add the network interface while the virtual machine is stopped or during a planned maintenance. | |
| Primary Network interface for virtual machines replacement | Supported. New network interface configuration only applied after rebooting the virtual machine. | It's possible to replace the primary network interface of a virtual machine by stopping the VM, attaching a second network interface, detaching the primary interface and deleting the primary network interface resource. If the primary network interface resource is not deleted, the virtual machine can't start. | |
| Network Watcher | Network Watcher tenant network monitoring capabilities | Supported | Not yet supported. |
| CDN | Content Delivery Network profiles | Supported | Not yet supported. |
| Application gateway | Layer-7 load balancing | Supported | Not yet supported. |
| Traffic Manager | Route incoming traffic for optimal application performance and reliability. | Supported | Not yet supported. |
| Express Route | Set up a fast, private connection to Microsoft cloud services from your on-premises infrastructure or colocation facility. | Supported | Support for connecting Azure Stack Hub to an Express Route circuit. |
| Virtual Machine Scale Sets | Public IP per Virtual Machine | Supported | Not supported. If needed, similar functionality can be achieved with a load balancer. |
| Update or change VMs primary NIC | Supported | Not supported. It's not possible to elevate a secondary NIC to primary or vice versa in Azure Stack Hub. |
API versions
Azure Stack Hub Networking supports the following API versions:
- 2018-11-01
- 2018-10-01
- 2018-08-01
- 2018-07-01
- 2018-06-01
- 2018-05-01
- 2018-04-01
- 2018-03-01
- 2018-02-01
- 2018-01-01
- 2017-11-01
- 2017-10-01