Can I route traffic internally when setting up API Management as External inside VNET?

Question

When configuring API Management inside a VNET one can choose between External and Internal.

My goal is to allow external trafic into API Management. But when request are made from other services within the VNET or from services that are on-premise and are using Express Route those calls should not be routed over the public internet. Those calls sould be routed directly to the APIM instance inside the VNET.

Is the above possible using the External mode? Or do I then need to set it Internal and use a Application Gateway to expose the endpoint for external traffic?

Answer 1

For the setup you've described you should use internal on apim and the vnet. Then all internal traffic should be routed via VNets/VPN. For the external traffic you should consider using a WAF with VNet UDR to route through to apim.