Hi I need to connect datafactory to a VNET and direct the traffic through a NAT gateway to a storage account in another AD tenant, but cant get it to work, and I am starting to wonder if it can be done at all. The reason for doing this, is that I can use a storage accounts built in firewall to limit trafic from the NAT gateway. Currently I am using the NAT Gateway, but I will be using a firewall later on. However the setup is the same either way what network traffic concerns. What I have done: First off all I have created a VNET/Subnet where I have my NAT gateway placed Setup custom routes to direct 0.0.0.0/0 trafic from subnets in that VNET to the NAT gateway Setup firewall restrictions on the storage account to only allow traffic from the public ip of the nat gateway. Attempt Creating a private endpoint, and setup data factories build in Integration runtime to connect the storage account. Datafactory is not using the endpoint for that, since it can not connect to the storage account without removing the firewall restrictions. Attempt Setup data factorys build in Integration runtime to connect the storage account, and using the managed VNET. The same result, it does not connect to the storage account unless I remove the IP restriction on the storage account Does anyone know if this scenario can work at all, or if it can, how should I proceed? I do not want to install a VM with Integration runtime on the network. I guess it would solve the issue, but it is just adding complexity, more to maintain, added cost, and also it needs to be restarted whenever patching needs to be done. Any help at all will be greatly appreciated, Best Regards Frank

Data factory on VNET and NAT gateway

Christiansen, Frank Weier 1

I need to connect datafactory to a VNET and direct the traffic through a NAT gateway to a storage account in another AD tenant, but cant get it to work, and I am starting to wonder if it can be done at all.

The reason for doing this, is that I can use a storage accounts built in firewall to limit trafic from the NAT gateway.
Currently I am using the NAT Gateway, but I will be using a firewall later on. However the setup is the same either way what network traffic concerns.

What I have done:
First off all I have created a VNET/Subnet where I have my NAT gateway placed
Setup custom routes to direct 0.0.0.0/0 trafic from subnets in that VNET to the NAT gateway
Setup firewall restrictions on the storage account to only allow traffic from the public ip of the nat gateway.

Attempt
Creating a private endpoint, and setup data factories build in Integration runtime to connect the storage account.
Datafactory is not using the endpoint for that, since it can not connect to the storage account without removing the firewall restrictions.
Attempt
Setup data factorys build in Integration runtime to connect the storage account, and using the managed VNET.
The same result, it does not connect to the storage account unless I remove the IP restriction on the storage account

Does anyone know if this scenario can work at all, or if it can, how should I proceed?

I do not want to install a VM with Integration runtime on the network. I guess it would solve the issue, but it is just adding complexity, more to maintain, added cost, and also it needs to be restarted whenever patching needs to be done.

Any help at all will be greatly appreciated,

Best Regards
Frank

Bhargava-MSFT 31,121 Reputation points Microsoft Employee

2022-12-03T00:17:42.387+00:00

Hello @Christiansen, Frank Weier ,

Welcome to the MS Q&A platform. I am currently checking with my internal team on your ask. I will get back to you as soon as I hear from them.
Christiansen, Frank Weier 1 Reputation point

2022-12-06T17:58:35.073+00:00

Hi,

Thank you, I appreciate it very much

Best Regards
Frank
Maatoug wassim 76 Reputation points

2022-12-07T17:30:01.977+00:00

Hi @Christiansen, Frank Weier ,
I see your point to have only one public IP address to trust from storage account side which could be a security requirement for production but is it possible to ask for allowing trusted Azure services on the storage account side? I think if you can do so you will simply require an azure IR (Data Factory is now a 'Trusted Service' in Azure Storage and Azure Key Vault firewall)
Bhargava-MSFT 31,121 Reputation points Microsoft Employee

2022-12-12T22:54:53.157+00:00

Thank you @Maatoug wassim
Hi @Christiansen, Frank Weier ,
Did you get a chance to look into the response from @Maatoug wassim ? Please look into allowing trusted Azure services on the storage account side to resolve the error message.

Share via

Data factory on VNET and NAT gateway

Your answer