nginx · rshyamsu · May 28, 2025
@@ -16,6 +16,13 @@ To review older entries, visit the [Changelog archive]({{< ref "/nginxaas-azure/
 
 ## May 22, 2025
 
+- {{% icon-feature %}} **NGINXaaS for Azure can now support IPv6**
+
+  Users can now configure their NGINXaaS deployments with just a single IPv6 frontend IP or in dual-stack (IPv4 + IPv6) mode.
+
+  If you plan to use an IPv6 IP address whether standalone or in dual-stack mode, ensure that the subnet used by NGINXaaS has both IPv4 and IPv6 address spaces included. For more information on creating a vnets and subnets with IPv6 address spaces, refer to [Add IPv6 to virtual Network](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/add-dual-stack-ipv6-vm-portal?tabs=azureportal#add-ipv6-to-virtual-network)
+
+
 - {{% icon-feature %}} **NGINXaaS is now running NGINX Plus Release 33 (R33) in the Stable Upgrade Channel**
 
   NGINXaaS for Azure deployments using the **Stable** [Upgrade Channel]({{< ref "/nginxaas-azure/quickstart/upgrade-channels.md" >}}) have now been automatically upgraded to  [NGINX Plus Release 33 (R33)]({{< ref "/nginx/releases.md#nginxplusrelease-33-r33" >}}). This upgrade also includes updates to the following NGINX Plus modules:

@@ -64,6 +64,25 @@ az nginx deployment create --deployment-name
       network-interface-configuration="{subnet-id:/subscriptions/mySubscription/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/mySubnet}"
    ```
 
+- Create a dual-stack (IPv4 + IPv6) NGINXaaS deployment with public IPs:
+
+   ```bash
+   az nginx deployment create --name myDeployment --resource-group \
+      myResourceGroup --location eastus2 --sku name="standardv2_Monthly" \
+      --network-profile front-end-ip-configuration="{public-ip-addresses:[{id:/subscriptions/mySubscription/resourceGroups/myResourceGroup/providers/Microsoft.Network/publicIPAddresses/pubIPv4},{id:/subscriptions/mySubscription/resourceGroups/myResourceGroup/providers/Microsoft.Network/publicIPAddresses/pubIPv6}]}" \
+      network-interface-configuration="{subnet-id:/subscriptions/mySubscription/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/mySubnet}"
+   ```
+
+- Create a dual-stack (IPv4 + IPv6) NGINXaaS deployment with private IPs:
+
+   ```bash
+   az nginx deployment create --name myDeployment --resource-group \
+      myResourceGroup --location eastus2 --sku \
+      name="standardv2_Monthly" --network-profile \
+      front-end-ip-configuration="{private-ip-addresses:[{private-ip-allocation-method:Static,subnet-id:/subscriptions/mySubscription/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/mySubnet,private-ip-address:10.0.0.2},{private-ip-allocation-method:Static,subnet-id:/subscriptions/mySubscription/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/mySubnet,private-ip-address:2001:0db8:85a3:0000:0000:8a2e:0370:7334}]}" \
+      network-interface-configuration="{subnet-id:/subscriptions/mySubscription/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/mySubnet}"
+   ```
+
 - Create a deployment with managed identity, storage account and scaling:
 
    ```bash
@@ -115,6 +134,14 @@ az nginx deployment update [--add]
    tag2="value2" --enable-diagnostics
    ```
 
+Update an NGINXaaS deployment to a dual-stack (IPv4 + IPv6) network configuration with public IPs:
+
+   ```bash
+   az nginx deployment update --name myDeployment --resource-group myResourceGroup \
+      --network-profile front-end-ip-configuration="{public-ip-addresses:[{id:/subscriptions/mySubscription/resourceGroups/myResourceGroup/providers/Microsoft.Network/publicIPAddresses/pubIPv4},{id:/subscriptions/mySubscription/resourceGroups/myResourceGroup/providers/Microsoft.Network/publicIPAddresses/pubIPv6}]}" \
+      network-interface-configuration="{subnet-id:/subscriptions/mySubscription/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/mySubnet}"
+   ```
+
 See the [Azure CLI Deployment Update Documentation](https://learn.microsoft.com/en-us/cli/azure/nginx/deployment#az-nginx-deployment-update) for more details on the required and optional parameters.
 
 

@@ -63,6 +63,7 @@ You can start the NGINXaaS deployment process by visiting the [Create NGINXaaS](
    - The minimum subnet size for NGINXaaS is `/27` and is enough for a single NGINXaaS deployment even at large scales.
    - You can use an existing subnet; make sure that the subnet is delegated to `NGINX.NGINXPLUS/nginxDeployments` before creating a deployment in it. The subnet can contain other resources.
    - You can deploy more than one NGINXaaS in the same subnet. Every deployment in the subnet will share the subnet IP address space. A larger subnet, for example, a `/24` is recommended.
+   - If you plan on using an IPv6 address on the frontend, make sure the subnet is dual-stack, i.e., the subnet has both IPv4 and IPv6 address spaces. Attempting to use a subnet that is not dual-stack will cause deployment creation to fail.
    - Changes to a virtual network's DNS settings will not be applied automatically to your NGINXaaS deployment. To ensure DNS settings are applied, you must add any custom DNS servers to the VNET's DNS settings before creating an NGINXaaS deployment. As a workaround for existing deployments, we recommend using the [`resolver` directive](https://nginx.org/en/docs/http/ngx_http_core_module.html#resolver) to explicitly specify your name server(s) and the [`resolve` parameter](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#resolve) to automatically re-resolve the domain name of the server without restarting NGINX.
 
       <details>

@@ -103,8 +103,6 @@ If a configuration update request uses a certificate that is in failed `provisio
 - NGINXaaS deployments cannot access [Private Endpoints](https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview) behind network security groups for private links. Attempts to do so will fail silently.
 - NGINXaaS deployments cannot access [Private Endpoints](https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview) in a globally peered VNET. Attempts to do so will fail silently.
 - The resource group which contains the public IP resource attached to NGINXaaS deployment cannot be moved across subscriptions. Attempts to do so will result in a validation error.
-- Creating an NGINXaaS deployment in a dual-stack subnet is not supported. Attempts to do so will result in a validation error.
-- NGINXaaS deployments cannot be created with an IPv6 Public IP address. Attempts to do so will result in a validation error.
 - [Network security group](https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview) (NSG) flow logs will not be available for IP traffic flowing through an NGINXaaS deployment attached to a customer delegated subnet. Flow logs for other resources on the same subnet will be available as normal.
 
 ### {{% icon-bug %}} Deployment locked when updating mutliple certificates at once. (ID-767)

@@ -36,8 +36,8 @@ The key capabilities of NGINXaaS for Azure are:
 
 ## Limitations
 
-- NGINXaaS does not support IPv6 yet.
-- NGINXaaS supports one public or private IP per deployment. NGINXaaS doesn't support a mix of public and private IPs at this time.
+- NGINXaaS supports at most one IPv4 and one IPv6 IP address at any given time.
+- NGINXaaS doesn't support a mix of public and private IPs at this time.
 - The IP address associated with an NGINXaaS deployment can't be changed from public to private, or from private to public.
 
 ## Supported regions