I have storage account used by vm for boot diagnostics. recently I changed the network setting of the storage account from public access allowed for all to Enabled from selected virtual networks and IP addresses. After this boot diagnostic is not able to connect to the storage account. Is there a way to solve this? Adding the vnet of the vm in storage account network didn't help.

Hi Shivam, Two things: a) On your storage account -- Networking blade, please make sure that Allow trusted services on the trusted services list to access this storage account is checked. b) On your storage account -- Networking blade, please make sure your client's public IP address is allowed. In other words, if you are using the Azure portal to access screenshot of your VM, you need to have the public IP address of the client PC you are using listed. If you don't you will receive an error. If you are accessing the Azure portal from a VM on a VNet, then you could allow the VNet to access your storage account instead of allowing public IP. Please note that any changes you make to your storage account's firewall settings can take a minute or so after clicking Save before they take effect. Please click Accept Answer and upvote if the above was helpful. If something is unclear or you need additional assistance please add a comment. Thanks. -TP

storage account firewall and virtual network setting

Accepted answer

TP 97,671 Reputation points

2024-06-02T17:09:45.6566667+00:00

Hi Shivam,

Two things:

a) On your storage account -- Networking blade, please make sure that Allow trusted services on the trusted services list to access this storage account is checked.

b) On your storage account -- Networking blade, please make sure your client's public IP address is allowed. In other words, if you are using the Azure portal to access screenshot of your VM, you need to have the public IP address of the client PC you are using listed. If you don't you will receive an error.

If you are accessing the Azure portal from a VM on a VNet, then you could allow the VNet to access your storage account instead of allowing public IP.

Please note that any changes you make to your storage account's firewall settings can take a minute or so after clicking Save before they take effect.

Please click Accept Answer and upvote if the above was helpful. If something is unclear or you need additional assistance please add a comment.

Thanks.

-TP
Please sign in to rate this answer.
Shivam Singh 220 Reputation points

2024-06-02T17:48:04.6033333+00:00

Hi, thanks fort the suggestions.
I have already allowed trusted services. Also my VM does not have a public IP due to security reasons so I cannot add the IP in firewall as it only take Public IP. I have also added my VM's Vnet CIDR, but still it didn't work.

TP 97,671 Reputation points

2024-06-02T17:57:29.5733333+00:00

You don't need to add the VM's IP. I'm referring to the public IP address of the PC that you are using to access the Azure portal. It needs to be in the allow list for the storage account so that you can view the screenshot.

Shivam Singh 220 Reputation points

2024-06-02T18:35:56.2933333+00:00

It worked, after allowing my own workstation IP. But is there no other way to do this?

TP 97,671 Reputation points

2024-06-02T18:55:19.1733333+00:00

It worked, after allowing my own workstation IP. But is there no other way to do this?

You only need to allow your workstation's IP if/when you want to view the screenshot. "Allow trusted services on the trusted services list to access this storage account" is all that is needed to allow the screenshots to be saved to the storage account.

When you want to view the screenshot, your workstation doesn't have access to the storage account, because it [your workstation] is blocked by the firewall. This is why you have to add your workstation's IP to be able to view the screenshot without error.

You can see what I mean if you browse to your storage account -- Data storage -- Containers, then click on the screenshot blob. If your workstation's IP isn't allowed by the firewall, you will get an error.

This is no different than if you had a storage account and were storing blobs for other reasons unrelated to VM diagnostics. If you set the storage account's firewall to block all except certain virtual networks/IPs, that is what it will do, including blocking your workstation from accessing blobs.

To allow your workstation to view the blobs without allowing its public IP then you would need to connect from an approved VNet.

Does that make sense? If not let me know and I can explain further or give different example.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

storage account firewall and virtual network setting

0 additional answers

Your answer