Configure an Azure Dedicated Cloud Gateway with virtual WAN

First, configure a Dedicated Cloud Gateway with an Azure network.

1. In the Konnect sidebar, click API Gateways.
2. From the New dropdown menu, select “New API gateway”.
3. Select Dedicated Cloud.
4. In the Gateway name field, enter Azure.
5. Click Create and configure.
6. From the Provider dropdown menu, select “Azure”.
7. From the Region dropdown menu, select the region you want to configure the cluster in.

8. Edit the Network range as needed.

   Important: Your Azure virtual network must use a different IP than your network in Konnect, which is 10.0.0.0/16 by default but can be edited.

9. From the Access dropdown menu, select “Public” or “Private”.
10. Click Create data plane node.

Important: Wait until your Azure network displays as Ready before proceeding to the next step.

Now that your Dedicated Cloud Gateway Azure network is ready, you can configure virtual hub peering to connect your Azure virtual WAN to your Dedicated Cloud Gateway.

1. In the Konnect sidebar, click API Gateways.
2. Click your Azure Dedicated Cloud Gateway.
3. In the API Gateways sidebar, click Networks.
4. From the action menu next to your Azure network, select “Configure private networking”.
5. Click Virtual hub peering.
6. In the Tenant ID field, enter your Microsoft Entra tenant ID.
7. In the Subscription ID field, enter your virtual WAN’s subscription ID.
8. In the Resource group name field, enter your virtual WAN’s resource group name.
9. In the Virtual hub name field, enter your virtual WAN’s hub name.
10. Click Next.

11. Grant access to the Dedicated Cloud Gateway app in Microsoft Entra using the link provided in the setup wizard.

    Important: You need an admin account to approve the app.

12. Create a peering role with the Azure CLI using the command in the UI wizard.

    Konnect requires permission to create and manage peering resources. You must define a role named Kong Cloud Gateway Peering Creator with the following permissions:

    • Read and write access to virtual hub configurations
    • Permission to perform peering actions
13. Assign the role to the service principal so it has permission to peer with your virtual hub using the command in the UI wizard.
14. Select I’ve completed the Azure setup steps above.
15. Click Done.

After your virtual hub peering configuration displays as ready, you can begin using your Dedicated Cloud Gateway. To verify that it’s ready, do the following:

1. In the Konnect sidebar, click API Gateways.
2. Click your Azure Dedicated Cloud Gateway.
3. In the API Gateways sidebar, click Networks.
4. Scroll until you see Ready for virtual hub peering.