Wiring up Azure SQL Managed Instance Private Link with ExpressRoute connection

Question

Wiring up Azure SQL Managed Instance Private Link with ExpressRoute connection

EchoFrankDelta 1

We have a current ExpressRoute configured in Azure. We are routing 10.x.x.x/16 through the ER connection. I created a Azure SQL Managed Instance and want to keep public access completely disabled and unavailable.

The vNet for the SQL MI has a different network space and a single subnet that is delegated to ManagedInstance. I want to be able to connect from a jump box in the DMZ to the SQL managed instance using SSMS. I dont want to have to spin up a bastion and point-to-site isnt an option. They want a private endpoint (link) if possible.

Unfortunately I am not as strong in networking as I would like to be, but this is on my plate so I have to figure it out.

Is there a way to configure the networking so that
- I can connect from the jump box VM to the private endpoint?
  - I dont need to use point-to-site
    - I dont need to use a bastion

Do I need to peer a vnet from the SQL managed instance to the ExpressRoute circuit? If so, how do I configure that particular vNet.?

The ExpressRoute has a gateway, do I need to add another gateway to the SQL vNet?

I am on VPN to the corporate network. I can connect to Azure either on or off VPN, but I would prefer I be able to log into VPN (Checkpoint client) and then be able to access the 10.x.x.x private link using SSMS.

From what I understand I will need to be able to access from SSMS for the next several months even longer.

I played around with the private endpoint and read the documentation, but I just dont get it.

Thanks

KapilAnanth 49,876 Reputation points Moderator

2023-07-07T05:18:26.7966667+00:00
@EchoFrankDelta

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

Unfortunately, your networking architecture is still not very clear to me.

From my understanding,

From my understanding,

You have a SQL MI in a VNet.

And you would like to access this from a VM in different VNet using Private EndPoint (i.e, without P2S or JumpHost)

Please correct me if my understanding is wrong.

Now,

Now,

Why have you mentioned ExpressRoute here?

I am under the impression you would like to access the SQL MI from a VM in Azure itself

Is my understanding incorrect?

Do you want to access it from OnPrem?

In case my understanding is correct,

Then PE is very much supported.
- You just have to create the private EndPoint in the VM's VNet - Refer : - [https://techcommunity.microsoft.com/t5/azure-sql-blog/private-endpoints-for-azure-sql-managed-instance/ba-p/3782015](https://techcommunity.microsoft.com/t5/azure-sql-blog/private-endpoints-for-azure-sql-managed-instance/ba-p/3782015) - [https://www.youtube.com/watch?v=hkzNP6JUqbM&t=77s](https://www.youtube.com/watch?v=hkzNP6JUqbM&t=77s)

However, I believe this feature is still in preview as of now

Should there be any follow-up questions or concerns, please let us know and we shall try to address them. Should there be any follow-up questions or concerns, please let us know and we shall try to address them. Thanks, Thanks, Kapil

1 answer

Your answer

KapilAnanth 49,876 Reputation points Moderator

2023-07-07T05:18:26.7966667+00:00

@EchoFrankDelta

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

Unfortunately, your networking architecture is still not very clear to me.

From my understanding,

From my understanding,

You have a SQL MI in a VNet.

And you would like to access this from a VM in different VNet using Private EndPoint (i.e, without P2S or JumpHost)

Please correct me if my understanding is wrong.

Now,

Now,

Why have you mentioned ExpressRoute here?

I am under the impression you would like to access the SQL MI from a VM in Azure itself

Is my understanding incorrect?

Do you want to access it from OnPrem?

In case my understanding is correct,

Then PE is very much supported.
- You just have to create the private EndPoint in the VM's VNet - Refer : - [https://techcommunity.microsoft.com/t5/azure-sql-blog/private-endpoints-for-azure-sql-managed-instance/ba-p/3782015](https://techcommunity.microsoft.com/t5/azure-sql-blog/private-endpoints-for-azure-sql-managed-instance/ba-p/3782015) - [https://www.youtube.com/watch?v=hkzNP6JUqbM&t=77s](https://www.youtube.com/watch?v=hkzNP6JUqbM&t=77s)

However, I believe this feature is still in preview as of now

Should there be any follow-up questions or concerns, please let us know and we shall try to address them. Should there be any follow-up questions or concerns, please let us know and we shall try to address them. Thanks, Thanks, Kapil

Answer 1

Oury Ba-MSFT 21,156 Microsoft Employee Moderator

@EchoFrankDelta Thank you for reaching out.

My understanding is that you are trying to connect to an Azure SQL Managed Instance from a jump box in the DMZ using a private endpoint.

Deploy a private endpoint to SQL MI inside the DMZ network (assuming this network is in Azure). No peering would then be necessary: the private endpoint would belong in, and have an IP address from, the DMZ range (assuming this is one of the 10.x.x.x networks), so you will be able to reach it from on-prem via ExpressRoute.

Regards,

Oury

Oury Ba-MSFT 21,156 Reputation points Microsoft Employee Moderator

2023-07-20T17:23:49.5366667+00:00

@EchoFrankDelta I wanted to follow up and see if the above answer helped you in anyway. If yes, please mark as accept answer. Otherwise, comment below so we can continue to work on the same.

Regards,

Oury

Share via

Wiring up Azure SQL Managed Instance Private Link with ExpressRoute connection

1 answer

Your answer