CODEWITHSUNDEEP
azurenetwork-programmingazure-functionsazure-sql-database
Kid101
Kid101

Reputation: 1470

Unable to connect Azure Function with Azure SQL using private endpoint

I've created a SQL Server and then created a private link with my TESTVNET/SUBNET1 with private IP 10.1.1.4. I've now disabled Public access for the SQL server.

I have an Azure function running on App Service which I've VNET Integrated with VNET/SUBNET2. Subnet Image Subnet 2 shows it's delegated to server farms. (also if someone can explain what does delegate to means, I found I cannot create any VM in that subnet as well, probably it's just can't be useful for any other purpose)

Now when my azure function tries to connect to DB. it fails with below error:

2020-08-30T15:25:45.216 [Error] Unhandled rejection SequelizeAccessDeniedError: Cannot open server "10.1.1.4" requested by the login. The login failed. However, if I give the public FQDN it gives me below error.

2020-08-30T15:29:43.654 [Error] Unhandled rejection SequelizeAccessDeniedError: Reason: An instance-specific error occurred while establishing a connection to SQL Server. The public network interface on this server is not accessible. To connect to this server, use the Private Endpoint from inside your virtual network.

Here the Private DNS created by Private endpoint should have been ideally used to get the private IP of the SQL database, but it seems the function is not using the private DNS probably because not running in an isolated environment.

Now in my Azure function Application settings, I've added WEBSITE_VNET_ROUTE_ALL =1 which should mean that all the requests should be routed to VNET. So now If I enable public access internet, and allow Azure services to access DB (I think azure added the public IP by default). The function gets connected to the DB. Now I want to understand where I'm going wrong and why is the private endpoint connection not working. Any help is appreciated.

In the DB firewall settings, I've allowed traffic from below to subnets: DB firewall settings Network Configuration

TESTVNET: 10.1.0.0/16

SUBNET 1: 10.1.1.0/24

SUBNET 2: 10.1.2.0/24

I've disabled Service endpoint for SQL in both SUBNET 1 and SUBNET 2. My NSG has default settings i.e. AllowVnetInBound, AllowAzureLoadBalancerInBound, DenyAllInBound AllowVnetOutBound, AllowInternetOutBound, DenyAllOutBound. Since my private link has a private IP present in the same VNET I don't think NSG should have any impact.

New to Azure, testing things out. Thank you for your patience.

Upvotes: 2

Views: 4455

Answers (1)

Nancy Xiong
Nancy Xiong

Reputation: 28204

To make Azure Function connect to a private endpoint you will need to use VNET integration.

After your app integrates with your VNet, it uses the same DNS server that your VNet is configured with. By default, your app won't work with Azure DNS Private Zones. To work with Azure DNS Private Zones you need to add the following app settings:

WEBSITE_DNS_SERVER with value 168.63.129.16
WEBSITE_VNET_ROUTE_ALL with value 1

These settings will send all of your outbound calls from your app into your VNet in addition to enabling your app to use Azure DNS private zones. Reference here.

Then you could set up Private Link for Azure SQL Database. You can create an Azure VM from a new subnet in the same VNet to check connectivity using SQL Server Management Studio (SSMS). If you enable the private endpoint, you should get a client private IP from that Azure VM to connect the Azure SQL database with its FQDN.

For more information, you could read private endpoint VS service endpoint in this blog.

Upvotes: 4

Related Questions