azure - 了解 Azure 应用服务计划的出站数据传输

Question

为了将一个非常小的企业 Web 应用程序从本地迁移到 Azure PAAS 服务环境，我们确定了以下暂定解决方案。

• Use Azure Storage Account to Host the front end (Angular SPA).
• Use App Service Plan to run the Back-End Spring Boot Application.
• Use Application Gateway V2 (with WAF) as public end point which will re-route traffic to both Storage account and App Service (SSL will be hosted in Gateway as it is the public endpoint)
• Use Azure SQL Server as database.
• Use VPN gateway Site to Site connection from Azure service to on-premise for out going SFTP file transfer.(very small in size).

但应用服务计划似乎不会放置在应用程序 VNET 中，因此首先需要从 Azure 服务到应用程序 VNET 的 VNET 集成才能启用 VPN 连接。我们的应用程序非常小，没有 HA 或其他多区域/区域要求，因此使用专用 ASE(Azure 服务环境)对我们来说不可行。由于与应用程序服务的通信不是应用程序 VNET 的本地通信，因此我们尝试理解 Azure 网络中与上述 PAAS 相关的术语“出站数据传输(特别是收费的和不收费的)”的概念服务。

1. Does the traffic from Application Gateway (in Application VNET) to Azure Service (Plan) are considered outbound data transfer?
2. If there a VNET integration is in place from Azure Service to application VNET, does the traffic going out of Azure service to application VNET is considered outbound data transfer?

Answer 1

从此article ，我们知道

Outbound data transfer: The first 5 GB per month of outbound datatransfer is free for all Azure zones, but following that the Azurepricing tiers will kick in based on various slabs (5–10 TB, then 40TB,100TB, 350TB, and then everything above 500 TB).

This charge should be considered if the applications deployed in Azureare accessed over the internet. For example, when downloading datafrom Azure storage accounts or websites, accessing VMs over RDP andSSH will incur charges as data is being transferred out of an Azuredata center.

Another scenario where these charges will be applied is with hybridconnectivity through VPN or ExpressRoute. For VPNs, the outbound datafrom the VPN Gateways will be billed at outbound data charge rates.For ExpressRoute, outbound data transfers are chargeable for metereddata plans, and the cost will vary based on the selected plan.

对于您的问题:

1. 从应用程序网关(在应用程序 VNET 中)到 Azure 服务(计划)的流量将被视为出站数据传输

因为如果后端池是公共(public)终结点(azure 应用程序服务)，则应用程序网关将使用其前端公共(public) IP 来访问服务器。如果没有前端公共(public) IP 地址，则会分配一个用于出站外部连接。阅读 How an application gateway routes a request 。另外，如果您有不同地区的应用逍遥游和应用服务计划，也会收取费用。

通过 VNet 集成，应用服务可同时连接到 VNet 和互联网。从 Azure 服务到应用程序 VNET 的流量不会被视为出站数据传输

因为流量通常通过 Azure 主干网络传输，并且托管 Web 应用程序的 VM 会被分配来自该集成子网的私有(private) IP 地址。这些 IP 地址用于出站连接。如果跨区域部署所有资源，您也需要付费(为此，您可以使用网关所需的 VNet 集成)。

如果您有兴趣，可以阅读 other Azure services can reduce your cloud costs .