{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-116-budget-application-gateway-v2-subnet-addresses-for-peak-instance-count/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-116-budget-application-gateway-v2-subnet-addresses-for-peak-instance-count/", "slug": "dse-20260909-116-budget-application-gateway-v2-subnet-addresses-for-peak-instance-count", "url": "https://update.dsesecurity.com/updates/dse-20260909-116-budget-application-gateway-v2-subnet-addresses-for-peak-instance-count/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-116-budget-application-gateway-v2-subnet-addresses-for-peak-instance-count.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-116-budget-application-gateway-v2-subnet-addresses-for-peak-instance-count/" }, "title": "Budget Application Gateway v2 subnet addresses for peak instance count", "summary": "Include Azure reservations, gateway instances, and private frontend addresses in subnet capacity planning.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:30:00+00:00", "modified_at": "2026-09-10T00:52:38+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 1, "word_count": 212, "potentially_affected": "Azure Application Gateway v2 deployments planning subnet capacity.", "dse_recommendation": "Calculate subnet capacity against the intended maximum gateway instances, not just visible network-interface addresses.", "primary_source": { "name": "Azure Application Gateway infrastructure configuration | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/application-gateway/configuration-infrastructure", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Azure reserves five addresses in each subnet. Application Gateway additionally consumes an address for every instance and another for a private frontend configuration. Microsoft recommends a /24 for v2 growth and maintenance, while explicitly saying that size is not mandatory.

\n

Application Gateway v2 instance addresses are managed by Azure and are not individually listed as NIC IP configurations. Microsoft directs owners to include them through capacity calculation rather than relying only on visible allocations. Microsoft Learn.

\n

Applicability

\n

Inventory every gateway sharing the dedicated subnet, each intended maximum instance count, and its private frontend configuration. Keep the v2 calculation separate from older deployment assumptions and unrelated subnet examples.

\n

DSE recommendation

\n

DSE recommends an address budget with explicit rows for reserved addresses, each gateway’s planned instances, and frontends. Compare it with the available subnet range before increasing scale settings or adding another gateway. Record the expected traffic-driven instance requirement and the owner approving remaining headroom.

\n

Verification

\n

Reconcile the budget with the actual gateway configuration and visible allocated addresses. In an approved test, observe a planned scale change and check that the application remains reachable. Treat a clean NIC listing as incomplete capacity evidence, and investigate any discrepancy before expanding production traffic.

\n

Official references

\n

Microsoft Learn: Azure Application Gateway infrastructure configuration. Source retrieved September 9, 2026.

", "content_text": "Source facts\nAzure reserves five addresses in each subnet. Application Gateway additionally consumes an address for every instance and another for a private frontend configuration. Microsoft recommends a /24 for v2 growth and maintenance, while explicitly saying that size is not mandatory.\nApplication Gateway v2 instance addresses are managed by Azure and are not individually listed as NIC IP configurations. Microsoft directs owners to include them through capacity calculation rather than relying only on visible allocations. Microsoft Learn.\nApplicability\nInventory every gateway sharing the dedicated subnet, each intended maximum instance count, and its private frontend configuration. Keep the v2 calculation separate from older deployment assumptions and unrelated subnet examples.\nDSE recommendation\nDSE recommends an address budget with explicit rows for reserved addresses, each gateway’s planned instances, and frontends. Compare it with the available subnet range before increasing scale settings or adding another gateway. Record the expected traffic-driven instance requirement and the owner approving remaining headroom.\nVerification\nReconcile the budget with the actual gateway configuration and visible allocated addresses. In an approved test, observe a planned scale change and check that the application remains reachable. Treat a clean NIC listing as incomplete capacity evidence, and investigate any discrepancy before expanding production traffic.\nOfficial references\nMicrosoft Learn: Azure Application Gateway infrastructure configuration. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nAzure reserves five addresses in each subnet. Application Gateway additionally consumes an address for every instance and another for a private frontend configuration. Microsoft recommends a /24 for v2 growth and maintenance, while explicitly saying that size is not mandatory.\n\nApplication Gateway v2 instance addresses are managed by Azure and are not individually listed as NIC IP configurations. Microsoft directs owners to include them through capacity calculation rather than relying only on visible allocations. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/application-gateway/configuration-infrastructure).\n\n## Applicability\n\nInventory every gateway sharing the dedicated subnet, each intended maximum instance count, and its private frontend configuration. Keep the v2 calculation separate from older deployment assumptions and unrelated subnet examples.\n\n## DSE recommendation\n\nDSE recommends an address budget with explicit rows for reserved addresses, each gateway’s planned instances, and frontends. Compare it with the available subnet range before increasing scale settings or adding another gateway. Record the expected traffic-driven instance requirement and the owner approving remaining headroom.\n\n## Verification\n\nReconcile the budget with the actual gateway configuration and visible allocated addresses. In an approved test, observe a planned scale change and check that the application remains reachable. Treat a clean NIC listing as incomplete capacity evidence, and investigate any discrepancy before expanding production traffic.\n\n## Official references\n\n[Microsoft Learn: Azure Application Gateway infrastructure configuration](https://learn.microsoft.com/en-us/azure/application-gateway/configuration-infrastructure). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-116-budget-application-gateway-v2-subnet-addresses-for-peak-instance-count/", "url": "https://update.dsesecurity.com/updates/dse-20260909-116-budget-application-gateway-v2-subnet-addresses-for-peak-instance-count/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-116-budget-application-gateway-v2-subnet-addresses-for-peak-instance-count/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Budget Application Gateway v2 subnet addresses for peak instance count", "item": "https://update.dsesecurity.com/updates/dse-20260909-116-budget-application-gateway-v2-subnet-addresses-for-peak-instance-count/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-116-budget-application-gateway-v2-subnet-addresses-for-peak-instance-count/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-116-budget-application-gateway-v2-subnet-addresses-for-peak-instance-count/", "url": "https://update.dsesecurity.com/updates/dse-20260909-116-budget-application-gateway-v2-subnet-addresses-for-peak-instance-count/", "headline": "Budget Application Gateway v2 subnet addresses for peak instance count", "description": "Include Azure reservations, gateway instances, and private frontend addresses in subnet capacity planning.", "abstract": "Include Azure reservations, gateway instances, and private frontend addresses in subnet capacity planning.", "articleBody": "Source facts\nAzure reserves five addresses in each subnet. Application Gateway additionally consumes an address for every instance and another for a private frontend configuration. Microsoft recommends a /24 for v2 growth and maintenance, while explicitly saying that size is not mandatory.\nApplication Gateway v2 instance addresses are managed by Azure and are not individually listed as NIC IP configurations. Microsoft directs owners to include them through capacity calculation rather than relying only on visible allocations. Microsoft Learn.\nApplicability\nInventory every gateway sharing the dedicated subnet, each intended maximum instance count, and its private frontend configuration. Keep the v2 calculation separate from older deployment assumptions and unrelated subnet examples.\nDSE recommendation\nDSE recommends an address budget with explicit rows for reserved addresses, each gateway’s planned instances, and frontends. Compare it with the available subnet range before increasing scale settings or adding another gateway. Record the expected traffic-driven instance requirement and the owner approving remaining headroom.\nVerification\nReconcile the budget with the actual gateway configuration and visible allocated addresses. In an approved test, observe a planned scale change and check that the application remains reachable. Treat a clean NIC listing as incomplete capacity evidence, and investigate any discrepancy before expanding production traffic.\nOfficial references\nMicrosoft Learn: Azure Application Gateway infrastructure configuration. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:30:00+00:00", "dateModified": "2026-09-10T00:52:38+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-116-budget-application-gateway-v2-subnet-addresses-for-peak-instance-count/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-116-budget-application-gateway-v2-subnet-addresses-for-peak-instance-count/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Budget Application Gateway v2 subnet addresses for peak instance count" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 212, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Azure Application Gateway infrastructure configuration | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/application-gateway/configuration-infrastructure" } } ] } }