HTTPS 403 error from Azure function

Question

HTTPS 403 error from Azure function

Riccardo Gatti 41

Hello, I have two service on Azure

App service deployed with flask that serve as Front End
Function that serve as Back End

The App service as a custom domain and a static IP after binding my custom domain with IP SSL and certificate
The function has access restriction enable with the static IP that I got after binding.

When I made a call I got a 403 Error, if I get the listed of IP rejected by the function I got the list of the outbound IP of the App service.

So my question is: I have to set all the outbound IP of the App service or there is a way I can use the static IP obtained after bounding domain?

SnehaAgrawal-MSFT 22,706 Reputation points Moderator

2022-10-13T12:01:35.08+00:00
Using access restriction capability for App Service is when a request is made to your app, the FROM address is evaluated against the rules in your access restriction list. If the FROM address is in a subnet that's configured with service endpoints to Microsoft.Web, the source subnet is compared against the virtual network rules in your access restriction list. If the address isn't allowed access based on the rules in the list, the service replies with an HTTP 403 status code.

Solutions to try:

You may try giving the access to all by adding 0.0.0.0/0. Later you can add restrictions based on your requirements.

For a scenario where you want to explicitly block a single IP address or a block of IP addresses, but allow access to everything else, add a Deny rule for the specific IP address and configure the unmatched rule action to Allow.

You can also have restrictions based on http-headers like X-Forwarded-For. See Access restriction advanced scenarios

For more details suggest you to refer to article: Manage access restriction rules in the portal

Let us know if further query or issue remains.
Riccardo Gatti 41 Reputation points

2022-10-13T12:06:29.567+00:00

Thanks for the reply, and now I think I have explained my problem in the wrong way.

The 403 is correct but I have to understand if I can use the Virtual IP address after configuring custom domain binding with IP-based SSL binding or I must use all the IP address that I get in the Outbound IP addresses under properties.
Riccardo Gatti 41 Reputation points

2022-10-13T12:12:26.263+00:00

Thanks for the reply, but I think I've explained myself wrong.

My question is if there is a way to use the Virtual IP address obtained after IP-based SSL binding or I must set all the Outbound IP addresses under properties in the access restriction

1 answer

Your answer

SnehaAgrawal-MSFT 22,706 Reputation points Moderator

2022-10-13T12:01:35.08+00:00

Using access restriction capability for App Service is when a request is made to your app, the FROM address is evaluated against the rules in your access restriction list. If the FROM address is in a subnet that's configured with service endpoints to Microsoft.Web, the source subnet is compared against the virtual network rules in your access restriction list. If the address isn't allowed access based on the rules in the list, the service replies with an HTTP 403 status code.

Solutions to try:

You may try giving the access to all by adding 0.0.0.0/0. Later you can add restrictions based on your requirements.

For a scenario where you want to explicitly block a single IP address or a block of IP addresses, but allow access to everything else, add a Deny rule for the specific IP address and configure the unmatched rule action to Allow.

You can also have restrictions based on http-headers like X-Forwarded-For. See Access restriction advanced scenarios

For more details suggest you to refer to article: Manage access restriction rules in the portal

Let us know if further query or issue remains.
Riccardo Gatti 41 Reputation points

2022-10-13T12:06:29.567+00:00

Thanks for the reply, and now I think I have explained my problem in the wrong way.

The 403 is correct but I have to understand if I can use the Virtual IP address after configuring custom domain binding with IP-based SSL binding or I must use all the IP address that I get in the Outbound IP addresses under properties.
Riccardo Gatti 41 Reputation points

2022-10-13T12:12:26.263+00:00

Thanks for the reply, but I think I've explained myself wrong.

My question is if there is a way to use the Virtual IP address obtained after IP-based SSL binding or I must set all the Outbound IP addresses under properties in the access restriction

Answer 1

Apologies for late response here! You may want to know that App Service app runs in an App Service plan, and App Service plans are deployed into one of the deployment units called as webspace. Each deployment unit is assigned a set of virtual IP addresses, which includes one public inbound IP address and a set of outbound IP addresses.
But if you scale your app between tier, one or more of the four outbound IP addresses may change (with some of the additional outbound IP addresses)

Check: When outbound IPs change

If you are looking for that your App Service is use a fixed IP address then for static outbound IP you can use Azure NAT Gateway and static inbound IP you may use Application gateway.

Refer to this detail blog How to use static IP addresses with Azure App Service

Share via

HTTPS 403 error from Azure function

1 answer

Your answer