Unable to connect Spoke VM using Private IP and Storage account , key vault with private endpoint from On-prem VPN

Question

Hi

Good morning.

We have deployed our Analytics layer by following Hub and Spoke architecture.

We created a site-to-site VPN connection between On-prem and the Hub Vnet using VPN Gateway.

Kindly refer the below image , about our setup.

Below connections are working fine.

1. Able to connect the VM using its Private IP in hub_vnet from the VPN.
2. Databricks in Spoke_vnet (subnet-2), can able to connect On-prem SQL databases and extract data.

But below connections not working ,

1. Unable to connect the VM in Spoke Vnet (subnet-1) from the VPN.
2. Unable to access the Storage account and Key vault with private endpoint deployed in Spoke_vnet (subnet-1) Both storage account and key vault networking is disable for public access

We dont have any UDR defined both in Hub and Spoke vnet , we are using the System and Gateway route.

Kindly advice what settings we are missing,. If you want more information do let me know.

Regards,

Sunil

Answer 1

Hello @Sunilprasath Elangovan ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you are unable to connect Spoke VM using Private IP and Storage account & key vault with private endpoint from On-prem site-to-site VPN.

Below are the recommendations to resolve mentioned issues:

Unable to connect the VM in Spoke Vnet (subnet-1) from the VPN.

From your screenshot, I understand that hub and spoke Vnets are peered with "gateway transit" and "use remote gateway" options enabled, which will make sure that the spoke Vnet VM is able to reach the on-prem via the hub Vnet VPN gateway.

Refer: https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli#spoke-connections-to-remote-networks-through-a-hub-gateway

However, you need to make sure that the return traffic is also allowed. You can do this by adding a route for the spoke Vnet subnet-1 address range on your on-premises VPN device.

Also make sure that ICMP is allowed on the subnet-1 and subnet-1 VM in case NSGs are applied to the subnet/NIC. Additionally, make sure that the subnet-1 VM's OS firewall is allowing ICMP traffic and is not blocking it.

Unable to access the Storage account and Key vault with private endpoint deployed in Spoke_vnet (subnet-1) Both storage account and key vault networking is disable for public access.

For on-premises workloads to resolve the FQDN of a private endpoint, use a DNS forwarder to resolve the Azure service public DNS zone in Azure. A DNS forwarder is a Virtual Machine running on the Virtual Network linked to the Private DNS Zone that can proxy DNS queries coming from other Virtual Networks or from on-premises. This is required as the query must be originated from the Virtual Network to Azure DNS. A few options for DNS proxies are: Windows running DNS services, Linux running DNS services, Azure Firewall. Or you could use the new Azure service called Azure DNS Private Resolver that enables you to query Azure DNS private zones from an on-premises environment and vice versa without deploying VM based DNS servers.

Reference: https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-dns#on-premises-workloads-using-a-dns-forwarder

If you check the table in Name resolution for resources in Azure virtual networks article, you can find the below:

https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances

For on-prem clients to be able to resolve Private Endpoint entries hosted on Azure Private DNS Zones, you must leverage Azure DNS Private Resolver or an existing DNS Server (Forwarder or Proxy) or deploy one IaaS VM using a DNS Server role.

Refer: https://github.com/dmauser/PrivateLink/tree/master/DNS-Integration-Scenarios#4-on-premises-dns-integration

https://learn.microsoft.com/en-us/azure/dns/dns-private-resolver-overview

https://learn.microsoft.com/en-us/azure/dns/private-resolver-hybrid-dns

Kindly let us know if the above helps or you need further assistance on this issue.

---

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.