CODEWITHSUNDEEP
azureazure-private-link
Maciek Psiuk
Maciek Psiuk

Reputation: 33

Periodically getting 403 IP Forbidden on App Service with private endpoint

I'm having 6 App Services on 1 App Service Plan on Azure with private endpoint on each. Every Web app is using VNet integration. On 3 of them I'm experiencing 403 IP Forbidden from time to time. After few minutes it goes back to live with no config changes.

nslookup is returning to me proper addresses, but during the 403 I'm receiving Web App's in-bound IP Address.

Do you know what might be an issue here?

Upvotes: 1

Views: 4331

Answers (3)

Bill Hodder
Bill Hodder

Reputation: 1

If you require on-prem DNS (VPNs do play up sometimes!), then configuring conditional forwarders for azurewebsites.net (and any others that you will use Private Endpoints for) to forward those requests to your azure DNS over the VPN will solve the issue.

Upvotes: 0

Maciek Psiuk
Maciek Psiuk

Reputation: 33

Problem was in the DNS servers infrastructure. We moved DNS server from on-premise to Azure and it solved the problem.

Upvotes: 1

WaitingForGuacamole
WaitingForGuacamole

Reputation: 4301

I've seen problems with, and had tickets with Microsoft for problems with VNet integration in the past. There were some known issues that caused the wrong IP to be applied.

Go to the "Diagnose and solve problems" link on your app service, and enter "vnet" in the search box. Choose "Regional VNet Integration", and look at its output. When we experienced problems, we saw that one of the instances in the service wasn't getting a private IP address in the VNet.

We "resolved" by either restarting the app service, or, scaling the app service to a completely different tier (like from S2 to P1v2), waiting for the scale to complete, testing it (including running the troubleshooter and verifying addresses), then scaling back down to the original tier. The idea here was to get the app service off its current stamp and onto a different one.

Upvotes: 1

Related Questions