diff --git a/clouddriver-azure/src/main/groovy/com/netflix/spinnaker/clouddriver/azure/resources/servergroup/model/AzureServerGroupDescription.groovy b/clouddriver-azure/src/main/groovy/com/netflix/spinnaker/clouddriver/azure/resources/servergroup/model/AzureServerGroupDescription.groovy
index 7f0ab2945a5..9c408d89cb0 100644
--- a/clouddriver-azure/src/main/groovy/com/netflix/spinnaker/clouddriver/azure/resources/servergroup/model/AzureServerGroupDescription.groovy
+++ b/clouddriver-azure/src/main/groovy/com/netflix/spinnaker/clouddriver/azure/resources/servergroup/model/AzureServerGroupDescription.groovy
@@ -78,6 +78,7 @@ class AzureServerGroupDescription extends AzureResourceOpsDescription implements
   Boolean doNotRunExtensionsOnOverprovisionedVMs = false
   Boolean useSystemManagedIdentity = false
   String userAssignedIdentities
+  Boolean enableIpForwarding = false
 
   static class AzureScaleSetSku {
     String name
@@ -177,6 +178,13 @@ class AzureServerGroupDescription extends AzureResourceOpsDescription implements
     azureSG.appGatewayName = scaleSet.tags?.appGatewayName
     azureSG.loadBalancerType = azureSG.appGatewayName != null ? AzureLoadBalancer.AzureLoadBalancerType.AZURE_APPLICATION_GATEWAY.toString() : AzureLoadBalancer.AzureLoadBalancerType.AZURE_LOAD_BALANCER.toString()
     azureSG.appGatewayBapId = scaleSet.tags?.appGatewayBapId
+
+    def networkInterfaceConfigurations = scaleSet.virtualMachineProfile()?.networkProfile()?.networkInterfaceConfigurations()
+
+    if (networkInterfaceConfigurations && networkInterfaceConfigurations.size() > 0) {
+      azureSG.enableIpForwarding = networkInterfaceConfigurations[0].enableIPForwarding()
+    }
+    // scaleSet.virtualMachineProfile()?.networkProfile()?.networkInterfaceConfigurations()?[0].ipConfigurations()?[0].applicationGatewayBackendAddressPools()?[0].id()
     // TODO: appGatewayBapId can be retrieved via scaleSet->networkProfile->networkInterfaceConfigurations->ipConfigurations->ApplicationGatewayBackendAddressPools
     azureSG.subnetId = scaleSet.tags?.subnetId
     azureSG.subnet = AzureUtilities.getNameFromResourceId(azureSG.subnetId)
diff --git a/clouddriver-azure/src/main/groovy/com/netflix/spinnaker/clouddriver/azure/templates/AzureServerGroupResourceTemplate.groovy b/clouddriver-azure/src/main/groovy/com/netflix/spinnaker/clouddriver/azure/templates/AzureServerGroupResourceTemplate.groovy
index 7367edc4f5b..3b48e99f8f4 100644
--- a/clouddriver-azure/src/main/groovy/com/netflix/spinnaker/clouddriver/azure/templates/AzureServerGroupResourceTemplate.groovy
+++ b/clouddriver-azure/src/main/groovy/com/netflix/spinnaker/clouddriver/azure/templates/AzureServerGroupResourceTemplate.groovy
@@ -607,6 +607,7 @@ class AzureServerGroupResourceTemplate {
    */
   static class NetworkInterfaceConfigurationProperty {
     boolean primary
+    boolean enableIpForwarding
     ArrayList<NetworkInterfaceIPConfiguration> ipConfigurations = []
 
     /**
@@ -615,6 +616,7 @@ class AzureServerGroupResourceTemplate {
      */
     NetworkInterfaceConfigurationProperty(AzureServerGroupDescription description) {
       primary = true
+      enableIpForwarding = description.enableIpForwarding
       ipConfigurations.add(new NetworkInterfaceIPConfiguration(description))
     }
   }
diff --git a/clouddriver-azure/src/test/groovy/com/netflix/spinnaker/clouddriver/azure/resources/servergroups/deploy/AzureServerGroupResourceTemplateSpec.groovy b/clouddriver-azure/src/test/groovy/com/netflix/spinnaker/clouddriver/azure/resources/servergroups/deploy/AzureServerGroupResourceTemplateSpec.groovy
index 2b1eda7df0a..4b3ff0f5641 100644
--- a/clouddriver-azure/src/test/groovy/com/netflix/spinnaker/clouddriver/azure/resources/servergroups/deploy/AzureServerGroupResourceTemplateSpec.groovy
+++ b/clouddriver-azure/src/test/groovy/com/netflix/spinnaker/clouddriver/azure/resources/servergroups/deploy/AzureServerGroupResourceTemplateSpec.groovy
@@ -69,6 +69,15 @@ class AzureServerGroupResourceTemplateSpec extends Specification {
     template.replaceAll('"createdTime" : "\\d+"', '"createdTime" : "1234567890"').replace('\r', '') == expectedFullTemplateWithDoNotRunExtensionsOnOverprovisionedVMs
   }
 
+  def 'should generate correct ServerGroup resource template with enableIpForwarding'() {
+    description = createDescription(false)
+    description.enableIpForwarding = true
+    String template = AzureServerGroupResourceTemplate.getTemplate(description)
+
+    expect:
+    template.replaceAll('"createdTime" : "\\d+"', '"createdTime" : "1234567890"').replace('\r', '') == expectedFullTemplateWithEnableIpForwarding
+  }
+
   def 'should generate correct ServerGroup resource template with custom image'() {
     description = createDescription(true)
     String template = AzureServerGroupResourceTemplate.getTemplate(description)
@@ -368,6 +377,7 @@ class AzureServerGroupResourceTemplateSpec extends Specification {
             "name" : "nic-azureMASM-st1-d11",
             "properties" : {
               "primary" : true,
+              "enableIpForwarding" : false,
               "ipConfigurations" : [ {
                 "name" : "ipc-azureMASM-st1-d11",
                 "properties" : {
@@ -542,6 +552,7 @@ class AzureServerGroupResourceTemplateSpec extends Specification {
             "name" : "nic-azureMASM-st1-d11",
             "properties" : {
               "primary" : true,
+              "enableIpForwarding" : false,
               "ipConfigurations" : [ {
                 "name" : "ipc-azureMASM-st1-d11",
                 "properties" : {
@@ -721,6 +732,7 @@ class AzureServerGroupResourceTemplateSpec extends Specification {
             "name" : "nic-azureMASM-st1-d11",
             "properties" : {
               "primary" : true,
+              "enableIpForwarding" : false,
               "ipConfigurations" : [ {
                 "name" : "ipc-azureMASM-st1-d11",
                 "properties" : {
@@ -898,6 +910,7 @@ class AzureServerGroupResourceTemplateSpec extends Specification {
             "name" : "nic-azureMASM-st1-d11",
             "properties" : {
               "primary" : true,
+              "enableIpForwarding" : false,
               "ipConfigurations" : [ {
                 "name" : "ipc-azureMASM-st1-d11",
                 "properties" : {
@@ -1039,6 +1052,7 @@ class AzureServerGroupResourceTemplateSpec extends Specification {
             "name" : "nic-azureMASM-st1-d11",
             "properties" : {
               "primary" : true,
+              "enableIpForwarding" : false,
               "ipConfigurations" : [ {
                 "name" : "ipc-azureMASM-st1-d11",
                 "properties" : {
@@ -1213,6 +1227,7 @@ class AzureServerGroupResourceTemplateSpec extends Specification {
             "name" : "nic-azureMASM-st1-d11",
             "properties" : {
               "primary" : true,
+              "enableIpForwarding" : false,
               "ipConfigurations" : [ {
                 "name" : "ipc-azureMASM-st1-d11",
                 "properties" : {
@@ -1402,6 +1417,7 @@ class AzureServerGroupResourceTemplateSpec extends Specification {
             "name" : "nic-azureMASM-st1-d11",
             "properties" : {
               "primary" : true,
+              "enableIpForwarding" : false,
               "ipConfigurations" : [ {
                 "name" : "ipc-azureMASM-st1-d11",
                 "properties" : {
@@ -1444,6 +1460,181 @@ class AzureServerGroupResourceTemplateSpec extends Specification {
   } ]
 }'''
 
+  private static String expectedFullTemplateWithEnableIpForwarding = '''{
+  "$schema" : "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
+  "contentVersion" : "1.0.0.0",
+  "parameters" : {
+    "location" : {
+      "type" : "string",
+      "metadata" : {
+        "description" : "Location to deploy"
+      }
+    },
+    "subnetId" : {
+      "type" : "string",
+      "metadata" : {
+        "description" : "Subnet Resource ID"
+      },
+      "defaultValue" : ""
+    },
+    "appGatewayAddressPoolId" : {
+      "type" : "string",
+      "metadata" : {
+        "description" : "App Gateway backend address pool resource ID"
+      }
+    },
+    "vmUserName" : {
+      "type" : "securestring",
+      "metadata" : {
+        "description" : "Admin username on all VMs"
+      },
+      "defaultValue" : ""
+    },
+    "vmPassword" : {
+      "type" : "securestring",
+      "metadata" : {
+        "description" : "Admin password on all VMs"
+      },
+      "defaultValue" : ""
+    },
+    "vmSshPublicKey" : {
+      "type" : "securestring",
+      "metadata" : {
+        "description" : "SSH public key on all VMs"
+      },
+      "defaultValue" : ""
+    },
+    "loadBalancerAddressPoolId" : {
+      "type" : "string",
+      "metadata" : {
+        "description" : "Load balancer pool ID"
+      },
+      "defaultValue" : ""
+    },
+    "loadBalancerNatPoolId" : {
+      "type" : "string",
+      "metadata" : {
+        "description" : "Load balancer NAT pool ID"
+      },
+      "defaultValue" : ""
+    },
+    "customData" : {
+      "type" : "string",
+      "metadata" : {
+        "description" : "custom data to pass down to the virtual machine(s)"
+      },
+      "defaultValue" : "sample custom data"
+    }
+  },
+  "variables" : {
+    "apiVersion" : "2019-03-01",
+    "publicIPAddressName" : "",
+    "publicIPAddressID" : "",
+    "publicIPAddressType" : "",
+    "dnsNameForLBIP" : "",
+    "loadBalancerBackend" : "",
+    "loadBalancerFrontEnd" : "",
+    "loadBalancerName" : "",
+    "loadBalancerID" : "",
+    "frontEndIPConfigID" : "",
+    "inboundNatPoolName" : "",
+    "vhdContainerName" : "azuremasm-st1-d11",
+    "osType" : {
+      "publisher" : "Canonical",
+      "offer" : "UbuntuServer",
+      "sku" : "14.04.3-LTS",
+      "version" : "latest"
+    },
+    "imageReference" : "[variables('osType')]",
+    "uniqueStorageNameArray" : [ "[concat(uniqueString(concat(resourceGroup().id, subscription().id, 'azuremasmst1d11', '0')), 'sa')]" ]
+  },
+  "resources" : [ {
+    "apiVersion" : "[variables('apiVersion')]",
+    "name" : "[concat(variables('uniqueStorageNameArray')[copyIndex()])]",
+    "type" : "Microsoft.Storage/storageAccounts",
+    "location" : "[parameters('location')]",
+    "tags" : {
+      "appName" : "azureMASM",
+      "stack" : "st1",
+      "detail" : "d11",
+      "cluster" : "azureMASM-st1-d11",
+      "serverGroupName" : "azureMASM-st1-d11",
+      "createdTime" : "1234567890"
+    },
+    "copy" : {
+      "name" : "storageLoop",
+      "count" : 1
+    },
+    "properties" : {
+      "accountType" : "Premium_LRS"
+    }
+  }, {
+    "apiVersion" : "[variables('apiVersion')]",
+    "name" : "azureMASM-st1-d11",
+    "type" : "Microsoft.Compute/virtualMachineScaleSets",
+    "location" : "[parameters('location')]",
+    "tags" : {
+      "createdTime" : "1234567890"
+    },
+    "dependsOn" : [ ],
+    "sku" : {
+      "name" : "Standard_A1",
+      "tier" : "Standard",
+      "capacity" : 2
+    },
+    "properties" : {
+      "upgradePolicy" : {
+        "mode" : "Manual"
+      },
+      "virtualMachineProfile" : {
+        "storageProfile" : {
+          "osDisk" : {
+            "name" : "osdisk-azureMASM-st1-d11",
+            "caching" : "ReadOnly",
+            "createOption" : "FromImage",
+            "vhdContainers" : [ "[concat('https://', variables('uniqueStorageNameArray')[0], '.blob.core.windows.net/', variables('vhdContainerName'))]" ]
+          },
+          "imageReference" : "[variables('imageReference')]",
+          "dataDisks" : null
+        },
+        "osProfile" : {
+          "computerNamePrefix" : "azureMASM-",
+          "adminUsername" : "[parameters('vmUserName')]",
+          "adminPassword" : "[parameters('vmPassword')]",
+          "customData" : "[base64(parameters('customData'))]"
+        },
+        "networkProfile" : {
+          "networkInterfaceConfigurations" : [ {
+            "name" : "nic-azureMASM-st1-d11",
+            "properties" : {
+              "primary" : true,
+              "enableIpForwarding" : true,
+              "ipConfigurations" : [ {
+                "name" : "ipc-azureMASM-st1-d11",
+                "properties" : {
+                  "subnet" : {
+                    "id" : "[parameters('subnetId')]"
+                  },
+                  "loadBalancerBackendAddressPools" : [ ],
+                  "loadBalancerInboundNatPools" : [ ],
+                  "applicationGatewayBackendAddressPools" : [ {
+                    "id" : "[parameters('appGatewayAddressPoolId')]"
+                  } ]
+                }
+              } ]
+            }
+          } ]
+        },
+        "scheduledEventsProfile" : null
+      },
+      "doNotRunExtensionsOnOverprovisionedVMs" : false
+    },
+    "identity" : {
+      "type" : "None"
+    }
+  } ]
+}'''
+
   private static String expectedCustomScriptTemplateWindows = '''{
   "$schema" : "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
   "contentVersion" : "1.0.0.0",
@@ -1592,6 +1783,7 @@ class AzureServerGroupResourceTemplateSpec extends Specification {
             "name" : "nic-azureMASM-st1-d11",
             "properties" : {
               "primary" : true,
+              "enableIpForwarding" : false,
               "ipConfigurations" : [ {
                 "name" : "ipc-azureMASM-st1-d11",
                 "properties" : {
@@ -1781,6 +1973,7 @@ class AzureServerGroupResourceTemplateSpec extends Specification {
             "name" : "nic-azureMASM-st1-d11",
             "properties" : {
               "primary" : true,
+              "enableIpForwarding" : false,
               "ipConfigurations" : [ {
                 "name" : "ipc-azureMASM-st1-d11",
                 "properties" : {
@@ -1970,6 +2163,7 @@ class AzureServerGroupResourceTemplateSpec extends Specification {
             "name" : "nic-azureMASM-st1-d11",
             "properties" : {
               "primary" : true,
+              "enableIpForwarding" : false,
               "ipConfigurations" : [ {
                 "name" : "ipc-azureMASM-st1-d11",
                 "properties" : {
@@ -2146,6 +2340,7 @@ class AzureServerGroupResourceTemplateSpec extends Specification {
             "name" : "nic-azureMASM-st1-d11",
             "properties" : {
               "primary" : true,
+              "enableIpForwarding" : false,
               "ipConfigurations" : [ {
                 "name" : "ipc-azureMASM-st1-d11",
                 "properties" : {
@@ -2335,6 +2530,7 @@ class AzureServerGroupResourceTemplateSpec extends Specification {
             "name" : "nic-azureMASM-st1-d11",
             "properties" : {
               "primary" : true,
+              "enableIpForwarding" : false,
               "ipConfigurations" : [ {
                 "name" : "ipc-azureMASM-st1-d11",
                 "properties" : {
@@ -2512,6 +2708,7 @@ class AzureServerGroupResourceTemplateSpec extends Specification {
             "name" : "nic-azureMASM-st1-d11",
             "properties" : {
               "primary" : true,
+              "enableIpForwarding" : false,
               "ipConfigurations" : [ {
                 "name" : "ipc-azureMASM-st1-d11",
                 "properties" : {