Thanks man, I am working with azure functions and I need to use VNet Integration to access the SQL Server, Basic Plan does not have the feature so I am testing hosting on an existing app service plan since is a low cost (in terms of resources) function app and this was helpful to do that VNet integration :D
Newbie here. For resources located In a vnet with service endpoint enabled for certain PaaS services and employees are coming in from public internet, how can I let them access the vnet services? Mine is an app gateway that links to a API management gateway.
As the Endpoints are enabled on subnets configured in Azure virtual networks, they can't be used for traffic from your on-premises to Azure services over public internet. When you say you have an app gateway, do you mean it is enabled for service endpoints from within vNet? I am asking because Service Endpoints can't be enabled for app gateway. In case that is not the case, you can have users reach the PaaS service behind service endpoints from App Gateway by configuring the backend pool to reach the service's private IP addresses. Hope this helps.
Please accept my apologies for the delayed response. I was not well. To start with, Virtual Network (VNet) integration for an Azure service enables you to lock down access to the service to only your virtual network infrastructure. It provides Azure services the benefits of network isolation. Azure services with Private Endpoint allows only inbound access. For the outbound calls, VNet integration is needed. PE only brings your Azure resource within your VNet and enforces inbound access policies. So in essence, it does use the other IP address to access resources withig the same VNet.
Is it possible to restrict the inbound and outbound rules for the web app by placing the app inside a subnet and restricting the public access using nsg rules?? I was unable to block the ports using the nsg rules. But I want to make my api app and sql db private???
Hello Kalyan, In case you wish to restrict public access, I would suggest you to go with Private endpoints. Also, you can implement access restriction from inside Networking under settings inside App Services. There is also another Networking link, which is in Preview. This will also help in performing access restrictions. When you use Private Endpoints, you will have to create the Private DNS Zone. Refer to Microsoft Docs on Private DNS Zone and Private Links. Hope this helps.
How about using private dns zone (of private end points app service) instead of using Azure AD domain service behind load balancer(using app gateway) backend pool, would that be possible?
Good Thought! Azure AD Domain Service acts as a DNS Server and is a replacement for the internal default DNS Server. Azure DNS Private Zone also provides the DNS functionality. What you have mentioned should ideally work, but I have not tested it myself.
If I got it right the purpose of vnet integration is only if you integration with other services (in a private way), right? If you only need the function to be private, then a private endpoint is required.
Virtual Network integration provides network isolation for your Azure service and is needed when you wish to lock down access to that service to only your virtual network infrastructure. When we say Virtual Network Infrastructure, it also includes the peered virtual networks and on-premises networks. It also enables access from your Azure services to the resources within the virtual network infrastructure. VNet integration provides Azure services the benefits of network isolation and one of the ways to accomplish is by using Private Endpoints. Hope it is clear now.
Hello Sagar, you can use the Set-AzureRmAppServicePlan command to do that. Now you can use the Az module instead of AzureRm module. You will have to do some research on that part. Hope this helps.
Great question. You are right. We can have a single subnet, but it is better to have separation of concerns, meaning, different types of resources have different subnets. This helps in multiple ways. One example could be in case for subnets having VMs you may wish to implement NSG with certain set of security rules, which might not be needed for other resources.. It also makes it easier to manage as you are aware which subnet belongs to which resource. Hope this helps
Hi Neeraj Great work done here but I have a scenario where I am facing SNAT port exhaust issue with WebApp so to fix that Azure has recommended implementing NAT with the subnet. Do you agree that to use the NAT to fix that issue with have to use Vnet Integration and attach that NAT with subnet and will that just fix the issue?
Hi Vivek, Apologies for the delayed response as I was in a training. I have understood your question, but unfortunately, I have not undergone that use case. I will try to replicate your scenario and will then respond to your query. Meanwhile, can you please share more on your implementation steps?
Thanks :) Is it possible to also have the resources within the Vnet integration behind it's own Private Endpoint? For example, in case of a web app connecting to a SQL server that we do not want to have a public IP?
First, accept my apologies for responding late. I was traveling for business and did not have time to respond to the queries posted here. Yes, each resource can have their own Private IP address. Then you can go to the resource and define what all resources can connect to it. You can also have service endpoints defined for the subnet having the resources with private IP address within it's range. Hope it helps.
Very well explained. But once the private endpoint is enabled, I'm facing an issue while deploying application to web app. Did anyone else face similar issue?
Hello, Although no one has ever reported issues, but everyone's situation is unique :) Wanted to check how are you deploying your application. Can you confirm if you are also connected to the VPN when deploying the app?
Why not associate the web app with azure AD. That way we wouldn't need to configure infra services while at the same time it will only be accessible to people in my Azure AD. I do agree that the endpoint will be public but no one would be able to open it since AD check is on. What do you think about it?
Hello Anmol, what you have suggested makes complete sense and is possible and we can register our application, but for scenarios where we do not have the S2S/P2S setup, it will not work as we do not want to have a public endpoint. Also, in my case, the application does not have AD authentication, it has Forms Based Authentication. Hope it helps.
Hi Neeraj, I did not understand one thing, when you did the vent integration, the outbound calls will go from which IP address. I am asking this for a scenario, where the app service is behind a firewall and we need to publish it. a visio diagram would also do to make us understand.
Thanks for watching the video. That's a good question and a tricky one. There is a very good documentation from Microsoft explaining the networking features. Below is the link to the same. Also, If you click on the properties for the app services web app, it shows the outbound IP addresses as well as additional outbound IP addresses. docs.microsoft.com/en-us/azure/app-service/networking-features Hope this helps. Please let me know. Regards, Neeraj
Thanks man, I am working with azure functions and I need to use VNet Integration to access the SQL Server, Basic Plan does not have the feature so I am testing hosting on an existing app service plan since is a low cost (in terms of resources) function app and this was helpful to do that VNet integration :D
Glad it helped
Congratulations on the video. Very informative.
Glad you enjoyed it! Thank You!
Newbie here. For resources located In a vnet with service endpoint enabled for certain PaaS services and employees are coming in from public internet, how can I let them access the vnet services?
Mine is an app gateway that links to a API management gateway.
As the Endpoints are enabled on subnets configured in Azure virtual networks, they can't be used for traffic from your on-premises to Azure services over public internet.
When you say you have an app gateway, do you mean it is enabled for service endpoints from within vNet? I am asking because Service Endpoints can't be enabled for app gateway. In case that is not the case, you can have users reach the PaaS service behind service endpoints from App Gateway by configuring the backend pool to reach the service's private IP addresses. Hope this helps.
So when we use a separate subnet for vnet integration, will it use another IP address for the outbound call ?
Please accept my apologies for the delayed response. I was not well.
To start with, Virtual Network (VNet) integration for an Azure service enables you to lock down access to the service to only your virtual network infrastructure. It provides Azure services the benefits of network isolation. Azure services with Private Endpoint allows only inbound access. For the outbound calls, VNet integration is needed. PE only brings your Azure resource within your VNet and enforces inbound access policies. So in essence, it does use the other IP address to access resources withig the same VNet.
Excellent work. Thanks for explaining us. Expecting more Azure IAAS services videos as well from you sir.
Thanks for watching Sathish. Sure 👍, I have plans for the same and I will be creating more videos for everyone to benefit.
Is it possible to restrict the inbound and outbound rules for the web app by placing the app inside a subnet and restricting the public access using nsg rules?? I was unable to block the ports using the nsg rules. But I want to make my api app and sql db private???
Hello Kalyan,
In case you wish to restrict public access, I would suggest you to go with Private endpoints. Also, you can implement access restriction from inside Networking under settings inside App Services. There is also another Networking link, which is in Preview. This will also help in performing access restrictions.
When you use Private Endpoints, you will have to create the Private DNS Zone. Refer to Microsoft Docs on Private DNS Zone and Private Links. Hope this helps.
Amazing and accurate information ,great Thanks Mr.Champion
You are very welcome. That is so kind of you :)
How about using private dns zone (of private end points app service) instead of using Azure AD domain service behind load balancer(using app gateway) backend pool, would that be possible?
Good Thought! Azure AD Domain Service acts as a DNS Server and is a replacement for the internal default DNS Server. Azure DNS Private Zone also provides the DNS functionality. What you have mentioned should ideally work, but I have not tested it myself.
@@AzureTrainingSeries It works well with Azure DNS Private Zone . Add A record for your private Endpoint URL in DNS private Zone .I have tested also.
If I got it right the purpose of vnet integration is only if you integration with other services (in a private way), right? If you only need the function to be private, then a private endpoint is required.
Virtual Network integration provides network isolation for your Azure service and is needed when you wish to lock down access to that service to only your virtual network infrastructure. When we say Virtual Network Infrastructure, it also includes the peered virtual networks and on-premises networks. It also enables access from your Azure services to the resources within the virtual network infrastructure.
VNet integration provides Azure services the benefits of network isolation and one of the ways to accomplish is by using Private Endpoints. Hope it is clear now.
@@AzureTrainingSeries thanks!
How to create a script which will change the a sku of app service plan and virtual machine from runbook
Hello Sagar, you can use the Set-AzureRmAppServicePlan command to do that. Now you can use the Az module instead of AzureRm module. You will have to do some research on that part. Hope this helps.
why it is necessary to create a subnet for each resource? I mean, the outbound can`t not simply have one ip in the vnet?
Great question. You are right. We can have a single subnet, but it is better to have separation of concerns, meaning, different types of resources have different subnets. This helps in multiple ways. One example could be in case for subnets having VMs you may wish to implement NSG with certain set of security rules, which might not be needed for other resources.. It also makes it easier to manage as you are aware which subnet belongs to which resource. Hope this helps
@@AzureTrainingSeries got it, thank you!
Hi Neeraj
Great work done here but I have a scenario where I am facing SNAT port exhaust issue with WebApp so to fix that Azure has recommended implementing NAT with the subnet. Do you agree that to use the NAT to fix that issue with have to use Vnet Integration and attach that NAT with subnet and will that just fix the issue?
Hi Vivek, Apologies for the delayed response as I was in a training. I have understood your question, but unfortunately, I have not undergone that use case. I will try to replicate your scenario and will then respond to your query. Meanwhile, can you please share more on your implementation steps?
Thanks :) Is it possible to also have the resources within the Vnet integration behind it's own Private Endpoint? For example, in case of a web app connecting to a SQL server that we do not want to have a public IP?
First, accept my apologies for responding late. I was traveling for business and did not have time to respond to the queries posted here. Yes, each resource can have their own Private IP address. Then you can go to the resource and define what all resources can connect to it. You can also have service endpoints defined for the subnet having the resources with private IP address within it's range. Hope it helps.
Very well explained.
But once the private endpoint is enabled, I'm facing an issue while deploying application to web app. Did anyone else face similar issue?
Hello, Although no one has ever reported issues, but everyone's situation is unique :) Wanted to check how are you deploying your application. Can you confirm if you are also connected to the VPN when deploying the app?
@@AzureTrainingSeries Thank you for the quick response.
No, I'm not using vpn while deployment.
Why not associate the web app with azure AD. That way we wouldn't need to configure infra services while at the same time it will only be accessible to people in my Azure AD. I do agree that the endpoint will be public but no one would be able to open it since AD check is on. What do you think about it?
Hello Anmol, what you have suggested makes complete sense and is possible and we can register our application, but for scenarios where we do not have the S2S/P2S setup, it will not work as we do not want to have a public endpoint. Also, in my case, the application does not have AD authentication, it has Forms Based Authentication. Hope it helps.
Hi Neeraj,
I did not understand one thing, when you did the vent integration, the outbound calls will go from which IP address. I am asking this for a scenario, where the app service is behind a firewall and we need to publish it. a visio diagram would also do to make us understand.
Thanks for watching the video. That's a good question and a tricky one. There is a very good documentation from Microsoft explaining the networking features. Below is the link to the same. Also, If you click on the properties for the app services web app, it shows the outbound IP addresses as well as additional outbound IP addresses.
docs.microsoft.com/en-us/azure/app-service/networking-features
Hope this helps. Please let me know.
Regards,
Neeraj
Plz give code
Super!!
Thank you! Cheers!
Suggestion: Pls include the visio’s for better understanding of the scenarios.
Thank you so much for your feedback, Rahul. I will definitely keep that in mind going forward.
One more thing 🙏🙏🙏🙏
Try to add diagram when you explain
Sure. Thanks for the feedback.
U r trying to cover too many things in one single video ...
Thank you for your feedback. I will keep this in mind from next time onwards.