StandardV2 NAT Gateway and StandardV2 Public IPs CLI New Feature Work Request

[aimee-littleton]

Description of Work Requested

Releasing a new SKU of NAT Gateway, Public IP Addresses and Public IP Prefixes. New SKU for each of these services is StandardV2. Also adding a new property to the Virtual Network.

Feature request to add output value, new parameter and/or add values into existing parameters for the following commands for NAT Gateway, Public IP Addresses, Public IP Prefixes and Virtual Network:

• az network nat gateway create
• az network nat gateway list
• az network nat gateway show
• az network nat gateway update
• az network vnet list
• az network vnet show
• az network public-ip create
• az network public-ip prefix create

Resource Provider

• Microsoft.network/natgateways
• Microsoft.network/virtualNetworks
• Microsoft.network/publicIPAddresses
• Microsoft.network/publicIPPrefixes

Minimum API Version

• NAT Gateway: 2024-03-01
• Virtual Network: 2024-03-01
• Public IP Addresses: 2023-06-01
• Public IP Prefixes: 2023-06-01

Swagger Link

NAT Gateway

azure-rest-api-specs/specification/network/resource-manager/Microsoft.Network/stable/2024-07-01/natGateway.json at kamboj-prjwl/release-network-Microsoft.Network-2024-07-01 · Azure/azure-rest-api-specs

Virtual Network

azure-rest-api-specs/specification/network/resource-manager/Microsoft.Network/stable/2024-07-01/virtualNetwork.json at kamboj-prjwl/release-network-Microsoft.Network-2024-07-01 · Azure/azure-rest-api-specs

Public IP Addresses

azure-rest-api-specs/specification/network/resource-manager/Microsoft.Network/stable/2024-07-01/publicIpAddress.json at kamboj-prjwl/release-network-Microsoft.Network-2024-07-01 · Azure/azure-rest-api-specs

Public IP Prefixes

azure-rest-api-specs/specification/network/resource-manager/Microsoft.Network/stable/2024-07-01/publicIpPrefix.json at kamboj-prjwl/release-network-Microsoft.Network-2024-07-01 · Azure/azure-rest-api-specs

Release

Current status: In private preview, skipping public preview

GA: 6/30/2025

Release requirements for client work:

CLI needs to be ready in time for 6/30/25 release.

New features/functionality should locate in a command module

Upon GA, functionality will be available publicly

NAT Gateway Commands

az network nat gateway create

New parameters

--sku

• Description: SKU of NAT Gateway
• Additional notes: Standard SKU exists today, StandardV2 SKU will support zone-redundancy and IPv6 public IPs in addition to IPv4 public IPs

--public-ip-addressesv6

• Description: IPv6 public IP addresses

--public-ip-prefixesv6

• Description: IPv6 public IP prefixes

--source-virtual-network

• Description: attaching NAT gateway to the source virtual network applies NAT gateway to all subnets in the VNet. Source virtual network is a property of the StandardV2 SKU NAT gateway

Output values

--sku

• Accepted values: Standard or StandardV2

--public-ip-addressesv6

• Accepted values: Space-separated list of IPv6 public IP addresses (Names or IDs)

--public-ip-prefixesv6

• Accepted values: Space-separated list of public IP prefixes (Names or IDs)

--source-virtual-network

• Accepted values: Name or ID of a VNet. Uses existing resource or creates new if specified, or none if omitted.

Example scenario – Create a StandardV2 NAT Gateway with an IPv6 public IP address and source virtual network
az network nat gateway create --resource-group MyResourceGroup --name MyStdV2NatGateway --location MyLocation --public-ip-addressesv6 Myv6PublicIp –-source-virtual-network myVNet --idle-timeout 4 --zone 1 2 3 –-sku StandardV2

az network nat gateway list

New output values

When a customer uses az network nat gateway list command, the output that should return for each NAT gateway resource in the list, should include the new properties if configured on the StandardV2 SKU NAT Gateway:

{
“publicIpAddressesV6”: [
{
“id”: “insert id here”
}
]
“publicIpPrefixesV6”: [
{
“id”: “insert id here”
}
]
“sourceVirtualNetwork”: {
“id”: “insert id here”
}

Example scenario – Show list of NAT Gateways – includes a StandardV2 NAT GW with an IPv6 public IP address, IPv6 public IP prefix, and a source virtual network configured

Input
az network nat gateway list --resource-group MyResourceGroup

Output

[   
  { 
    "etag": "insertetagname", 
    "id": "/subscriptions/.../resourceGroups/MyResourceGroup/providers/Microsoft.Network/natGateways/", 
    "idleTimeoutInMinutes": 4, 
    "location": "MyLocation", 
    "name": "MyStdV2NatGateway", 
    "provisioningState": "Succeeded", 
    "publicIpAddressesV6": [ 
        { 
           "id": "/subscriptions/..../resourceGroups/MyResourceGroup/providers/Microsoft.Network/publicIPAddresses/Myv6PublicIp" 
         } 
    ], 
    "publicIpPrefixesV6": [ 
        { 
          "id": 
"/subscriptions/..../resourceGroups/MyResourceGroup/providers/Microsoft.Network/publicIPPrefixes/Myv6PublicIpPrefix" 
        } 
    ], 
    "resourceGroup": "MyResourceGroup", 
    "resourceGuid": "insertGUID", 
    "sku": { 
       "name": "StandardV2" 
    }, 
    "sourceVirtualNetwork": { 
       "id": "/subscriptions/..../resourceGroups/MyResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet" 
      },  
    "tags": {}, 
    "type": "Microsoft.Network/natGateways", 
    "zones": [ 
      "1", 
      "2", 
      "3" 
    ] 
  } 
] 

az network nat gateway show

New output values

When a customer uses az network nat gateway show command, the output that should return for the NAT gateway resource, should include the new properties if configured on the StandardV2 SKU NAT Gateway:

{
“publicIpAddressesV6”: [
{
“id”: “insert id here”
}
]
“publicIpPrefixesV6”: [
{
“id”: “insert id here”
}
]
“sourceVirtualNetwork”: {
“id”: “insert id here”
}
}

Example scenario – Show details of a StandardV2 SKU NAT Gateway resource that has a IPv6 public IP prefix, IPv6 public IP address and source virtual network configured

Input
az network nat gateway show --resource-group MyResourceGroup –name MyStdV2NatGateway

Output

[   
  { 
    "etag": "insertetagname", 
    "id": "/subscriptions/.../resourceGroups/MyResourceGroup/providers/Microsoft.Network/natGateways/", 
    "idleTimeoutInMinutes": 4, 
    "location": "MyLocation", 
    "name": "MyStdV2NatGateway", 
    "provisioningState": "Succeeded", 
    "publicIpAddressesV6": [ 
        { 
           "id": "/subscriptions/..../resourceGroups/MyResourceGroup/providers/Microsoft.Network/publicIPAddresses/Myv6PublicIp" 
         } 
    ], 
    "publicIpPrefixesV6": [ 
        { 
          "id": 
"/subscriptions/..../resourceGroups/MyResourceGroup/providers/Microsoft.Network/publicIPPrefixes/Myv6PublicIpPrefix" 
        } 
    ], 
    "resourceGroup": "MyResourceGroup", 
    "resourceGuid": "insertGUID", 
    "sku": { 
       "name": "StandardV2" 
    }, 
    "sourceVirtualNetwork": { 
       "id": "/subscriptions/..../resourceGroups/MyResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet" 
      },  
    "tags": {}, 
    "type": "Microsoft.Network/natGateways", 
    "zones": [ 
      "1", 
      "2", 
      "3" 
    ] 
  } 
] 

az network nat gateway update

New parameters

--public-ip-addressesv6

• Description: IPv6 public IP addresses

--public-ip-prefixesv6

• Description: IPv6 public IP prefixes

--source-virtual-network

• Description: attaching NAT gateway to the source virtual network applies NAT gateway to all subnets in the VNet. Source virtual network is a property of the StandardV2 SKU NAT gateway

Output values

--public-ip-addressesv6

• Accepted values: Space-separated list of IPv6 public IP addresses (Names or IDs)

--public-ip-prefixesv6

• Accepted values: Space-separated list of public IP prefixes (Names or IDs)

--source-virtual-network

• Accepted values: Name or ID of a VNet. Uses existing resource or creates new if specified, or none if omitted.

Example scenario – update a StandardV2 SKU NAT Gateway with an IPv6 public IP address, IPv6 public IP prefix, and a source virtual network

az network nat gateway update --resource-group MyResourceGroup --name MyStdV2NatGateway --public-ip-addressesv6 Myv6PublicIp --public-ip-prefixesv6 Myv6PublicIpPrefix –-source-virtual-network myVNet

Virtual Network Commands

az network vnet show

Virtual networks will have a new read-only property “defaultPublicNatGateway” that is populated when a StandardV2 SKU NAT Gateway has a source virtual network configured.

New output values
When a customer uses az network vnet show command, the output that should return for the virtual network resource if a StandardV2 SKU NAT Gateway is configured, should include the following new parameter:

{
“defaultPublicNatGateway”: {
“id”: “insert id here”
}
}

Example scenario: add a source virtual network to StandardV2 NAT Gateway then run show vnet command

Input
az network nat gateway update --resource-group MyResourceGroup --name MyStdV2NatGateway --source-virtual-network myVNet

az network vnet show --resource-group MyResourceGroup --name MyStdV2NatGateway --name myVNet

Output

{ 
  "addressSpace": { 
    "addressPrefixes": [ 
      "10.0.0.0/16" 
    ] 
  }, 
  "enableDdosProtection": false, 
  "defaultPublicNatGateway": { 
     "id": "/subscriptions/..../resourceGroups/MyResourceGroup/providers/Microsoft.Network/natGateways/MyStdV2NatGateway 
  "encryption": { 
    "enabled": false, 
    "enforcement": "AllowUnencrypted" 
  }, 
  "id": "/subscriptions/..../resourceGroups/MyResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet", 
  "location": "MyLocation", 
  "name": "myVNet", 
  "resourceGroup": "myVNet", 
  "resourceGuid": ".....", 
  "subnets": [] 
"type": "Microsoft.Network/virtualNetworks", 
"virtualNetworkPeerings": [] 
} 

az network vnet list

New output values

When a customer uses az network vnet list command, the output that should return for each virtual network resource in the list, should include the new properties if configured with a StandardV2 SKU NAT Gateway:

{
“defaultPublicNatGateway”: {
“id”: “insert id here”
}
}

Example scenario – Show list of virtual networks – includes a virtual network with a StandardV2 SKU Nat Gateway configured as the default public Nat Gateway

Input
az network vnet list --resource-group MyResourceGroup

Output

{ 
  "addressSpace": { 
    "addressPrefixes": [ 
      "10.0.0.0/16" 
    ] 
  }, 
  "enableDdosProtection": false, 
  "defaultPublicNatGateway": { 
     "id": "/subscriptions/..../resourceGroups/MyResourceGroup/providers/Microsoft.Network/natGateways/MyStdV2NatGateway 
  "encryption": { 
    "enabled": false, 
    "enforcement": "AllowUnencrypted" 
  }, 
  "id": "/subscriptions/..../resourceGroups/MyResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet", 
  "location": "MyLocation", 
  "name": "myVNet", 
  "resourceGroup": "myVNet", 
  "resourceGuid": ".....", 
  "subnets": [] 
"type": "Microsoft.Network/virtualNetworks", 
"virtualNetworkPeerings": [] 
} 

Public IP Address Commands

az network public-ip create

New output values

--sku

• Accepted values: Basic, Standard, or StandardV2

Example scenario – Create a StandardV2 Public IP Address

az network public-ip create --resource-group MyResourceGroup --name MyStdV2PIP --location MyLocation –-zones 1 2 3 --sku StandardV2

Public IP Prefix Commands

az network public-ip prefix create

New output values

--sku

• Accepted values: Basic, Standard, or StandardV2

Example scenario – Create a StandardV2 Public IP Prefix

az network public-ip prefix create --resource-group MyResourceGroup --name MyStdV2PIPPrefix --location MyLocation –-zones 1 2 3 --sku StandardV2

[yonzhan]

Thank you for opening this issue, we will look into it.

[aimee-littleton]

@yonzhan , just following up - do you have any questions about this request? We are targeting June 30 for GA date / when CLI support needs to be ready, so just want to make sure this is picked up in a timely manner.

[jsntcy]

@yonzhan , just following up - do you have any questions about this request? We are targeting June 30 for GA date / when CLI support needs to be ready, so just want to make sure this is picked up in a timely manner.

We can start work in May. We have monthly release, so for this feature, we can release in May or June, and when do you want us to release?

[aimee-littleton]

@jsntcy How long does it take for roll out to complete? Do you release region by region?

[jsntcy]

@jsntcy How long does it take for roll out to complete? Do you release region by region?

Usually it will take one month from development to release. We just release globally (not region by region like service) as Azure CLI is client tool, not service.

[aimee-littleton]

@jsntcy got it, we would want it to be available on June 30, not sooner. Do your roll outs start beginning of month or end of month?

[jsntcy]

@jsntcy got it, we would want it to be available on June 30, not sooner. Do your roll outs start beginning of month or end of month?

Fortunately, we will release it and make it available on June 30.

@necusjz, let's work on it in June since we cannot release it before June 30.