How to Connect Azure function App to site2Site VPN , so that It can access the resources in On prem

Ingle, Sachin (DEU) 0

Hi All,

I have created VPN tunnel ( site 2 site VPN Connection ) to our on prem VPN gateway and connection is successfull , I followed the following guide

https://learn.microsoft.com/en-us/azure/vpn-gateway/tutorial-site-to-site-portal

Now I want to creates a function app which can access SOAP web service accessable through VPN gateway

For this I have created function app in premium plan and connected outbout traffic to the s2s vpn subnet , but still i not able to consume the webservice from on prem vpn gateway

Am I missing osmeting ?

The connections seems to be scussfull

User's image

Silvia Wibowo 3,906 Reputation points Microsoft Employee

2024-08-23T03:13:40.2566667+00:00
Hi @Ingle, Sachin (DEU) , I understand that you've created Site-to-Site VPN connection and an Azure Function App with vnet integration. However, you still can't access on-premises web service from your Azure Function App.

A few questions to clarify the current situation:

How do you call the on-premises web service - using a private IP address or a DNS name?

Function App requires a dedicated subnet for its vnet integration. Does this subnet reside in the same vnet as your VPN gateway? Otherwise, do you have vnet peering between the two vnet: vnet of your VPN gateway and vnet of your Function App?

For easier testing, I'd recommend you create an Azure VM (Virtual Machine) in the same vnet (create different subnet) as your Function App's outbound vnet integration - Windows or Linux, up to your preferences. You can check network connectivity from the VM easier than from a Function App.
Ingle, Sachin (DEU) 0 Reputation points

2024-08-23T09:53:21.9033333+00:00
Hi @Silvia Wibowo

How do you call the on-premises web service - using a private IP address or a DNS name? I call it bt the DNS Name and its a SOAP request, python function app

Function App requires a dedicated subnet for its vnet integration. Does this subnet reside in the same vnet as your VPN gateway? Otherwise, do you have vnet peering between the two vnet: vnet of your VPN gateway and vnet of your Function App? I am using the subnet which is created in the vent there is no other vnet or peering I will check with the VM but i think function app shoudl be able to connet to the on prem service
Silvia Wibowo 3,906 Reputation points Microsoft Employee

2024-08-26T03:28:54.27+00:00

Hi @Ingle, Sachin (DEU) , have you tried accessing your on-prem app from Azure VM in the same Vnet as your Function App?
Ingle, Sachin (DEU) 0 Reputation points

2024-08-26T06:58:36.2666667+00:00

Hello silvia,

I am wokring on the creating the VM, meanwhile i tried to debug the issue I get the following in Support + troubleshooting

also I did the connection trouble shooting I get below error

Ingress Packets Dropped due to Traffic Selector Mismatch (since last connected) : 0 Packets

Thanks

Sachin
Silvia Wibowo 3,906 Reputation points Microsoft Employee

2024-08-27T01:56:59.71+00:00

Hi @Ingle, Sachin (DEU) , please verify your Azure VPN connection. If the status is not "Connected", please follow Troubleshooting Azure site-to-site VPN.
Ingle, Sachin (DEU) 0 Reputation points

2024-08-29T10:11:08.6+00:00
Hi ,

The status shows connected , we Have checked the IKE2 setting with the locl VPN and it was connected ,

The issue seems to be that the local vpn is allowing traffic only from the gateway subnet private ip and any other traffic is dropped

How do I route my traffic through GatewaySubnet

I have 4 subnet as followed in Vnet

Default

GatewaySubnet

subnt-functionapp

subnet-vm

local vpn tunnel traffic is only allowed throgh the gatewaySubnet subnet ,

How do I re route traffic thorihg the Gatewaysubnet

Am i missing some cofiguration

I do not have a support plan , can you create an one time support request

Thanks

Sachin

1 answer

Kris 26 Reputation points

2024-08-23T09:20:27.5133333+00:00
Is it correct you are trying to make a call TO call the function from on-premise? "but still i not able to consume the webservice from on prem vpn gateway"

Could it be you are missing a Private endpoint on your function app?

VNET Integration is for outbound connectivity FROM the function

Private Endpoints is for inbound connectivity if you want to make private calls TO the function from (network wise) private applications, like on-premise private systems.

However there are some things that need to be in place to make this work from On-Premise.

https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-dns-integration

https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-dns-integration#azure-private-resolver-for-on-premises-workloads
Please sign in to rate this answer.
Ingle, Sachin (DEU) 0 Reputation points

2024-08-23T09:59:22.4633333+00:00

Hi kris ,

No Acutally its otherway around

I want to consume webservice depnloyed on On premise network ,

for this i have create s2s vpn tunnel
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to Connect Azure function App to site2Site VPN , so that It can access the resources in On prem

1 answer

Your answer