Can't connect to on premises Database over site2site VPN from Azure Web App

Ed Commandeur 0 Reputation points
2023-03-15T08:48:38.02+00:00

I've create an app service which need to connect a database which is on my on-premises network (Oracle on Port 1521) and i used VNET integration on the app service, but still it can't connect.

To make sure it's not a Site-site problem i've create another subnet in the same Vnet with a simple VM and i was able to connect to that resource through the VPN.

I've connected the same Network Security Group and route table to both subnets.

The app serviceplan that was connected to the service was the Basic plan and according to the documentation VNET intergration should work on that plan.

If needed i can recreate the app again

Azure Virtual Network
Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
2,120 questions
Azure App Service
Azure App Service
Azure App Service is a service used to create and deploy scalable, mission-critical web apps.
6,775 questions
{count} votes

1 answer

Sort by: Most helpful
  1. KapilAnanth-MSFT 34,591 Reputation points Microsoft Employee
    2023-03-15T10:12:21.3133333+00:00

    @Ed Commandeur

    Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

    I understand that you would like to establish a connection with VNET Integrated App Service and OnPrem server on Port 1521.

    I see you have mentioned the above works with a VM with same NSG and UDR.

    • One thing I would like to get clarified is why is there a UDR involved here?
    • Isn't the VNet a Hub or Spoke? (in any case, you wouldn't need a UDR to route OnPremises traffic)
    • If you are routing the traffic through a custom NVA, I would suggest you directly route the traffic to OnPrem and test this out.
    • While the VM may work as expected, there is still a chance that the NVA is blocking the traffic from App Service Subnet.
    • In case the NVA is Azure Firewall, can you check the logs and see if it's allowing or blocking.

    Wrt DNS,

    Cheers,

    Kapil

    1 person found this answer helpful.