Last modified November 5, 2026

Configure Azure CNI Overlay, ACNS and User Defined Routing on AKS

AKS workload clusters use AKS-managed networking (Azure CNI powered by Cilium) by default. On top of it, you can choose:

• Azure CNI Overlay, which gives pods IPs from a private pod CIDR instead of the VNet;
• Advanced Container Networking Services (ACNS), for network observability and FQDN or L7 network policies;
• User Defined Routing, to send the cluster’s egress through your own firewall or network virtual appliance (NVA).

These options require AKS release v36.2.0 or newer. They apply to AKS-managed networking only. On clusters that run Giant Swarm’s Cilium with BYO CNI, the cluster chart rejects overlay and ACNS.

All settings go in the cluster’s user values. See the cluster-aks README for the full reference.

Use Azure CNI Overlay

Set networkPluginMode to overlay and give exactly one pod CIDR block:

global:
  connectivity:
    network:
      pods:
        cidrBlocks:
          - 100.64.0.0/16
  controlPlane:
    networking:
      networkPluginMode: overlay

Before you create the cluster, check these constraints:

• Creation-time choice. You can’t migrate an existing cluster from Azure CNI node subnet to overlay.
• No overlaps. The pod CIDR must not overlap the VNet, peered or on-premises networks, or the service CIDR.
• AKS reserved ranges. The pod CIDR, the service CIDR and the VNet must not overlap 169.254.0.0/16, 172.30.0.0/16, 172.31.0.0/16, 192.0.2.0/24 or 224.0.0.0/4. AKS rejects the cluster otherwise.
• Pod IPs stay inside the cluster. Pod egress is SNATed to the node IP, and pod IPs aren’t routable outside the cluster. Allowlists on external systems must use node or subnet IPs.
• Plugin settings. Overlay requires networkPlugin: azure and doesn’t support networkMode: bridge. The defaults already fit.

Enable ACNS

ACNS has two features:

• Observability provides Hubble network metrics and flow logs.
• Security provides FQDN filtering, which is the default, or L7 network policies.

Enable ACNS and the features you need:

global:
  controlPlane:
    networking:
      advancedNetworking:
        enabled: true
        observability:
          enabled: true
        security:
          enabled: true
          advancedNetworkPolicies: L7

Keep in mind:

• Paid add-on. ACNS is billed by Azure to the cluster’s subscription.
• Cilium dataplane. Security requires networkDataplane: cilium, which is the default.
• Explicit switch. Observability and security need enabled: true. If you leave enabled unset, the cluster keeps its current ACNS setting. Set it to false to turn ACNS off.
• Existing clusters. You can turn ACNS on or off on a running cluster.

ACNS works with or without overlay.

Route egress through your own firewall

To send the cluster’s egress through your own firewall or NVA, set outboundType to userDefinedRouting and use your own subnet:

global:
  connectivity:
    network:
      vnet:
        subnetArmId: /subscriptions/<subscription>/resourceGroups/<resource-group>/providers/Microsoft.Network/virtualNetworks/<vnet>/subnets/<subnet>
  controlPlane:
    networking:
      outboundType: userDefinedRouting

Prepare the subnet before you create the cluster:

• Bring your own subnet. A VNet created by the cluster has no route table, so userDefinedRouting requires subnetArmId.
• Default route. The subnet’s route table must send 0.0.0.0/0 to your egress device. If node pools use their own subnets, each of them needs that route table too.
• Ready before creation. The route table and the egress device must work before the cluster is created, because nodes need egress to bootstrap.

Change the outbound type of an existing cluster

You can change outboundType on a running cluster along the migration paths AKS supports. On your own subnet, these are loadBalancer, userAssignedNATGateway and userDefinedRouting.

When you switch between userDefinedRouting and another outbound type, move the default route with it:

• Leaving userDefinedRouting. Remove the 0.0.0.0/0 route from the subnet’s route table. Otherwise egress keeps going through your device.
• Going back to userDefinedRouting. Add the 0.0.0.0/0 route before you change outboundType.

The change interrupts existing connections and changes the cluster’s egress IP. Nodes have no egress until AKS finishes the change, so kubectl logs, kubectl exec and port forwarding stop working in the meantime. Update firewall rules and authorized IP ranges that rely on the old IP.