Hi, I have an application gateway with public IP having backend as an app service on which UI code is deployed. The app service have private access with private endpoint and public access is disabled. The app service calls the cognitive search service, and the cognitive search service also have public access disabled and private access is enabled through private endpoint. When I am using the app gateway public IP to access the UI, it gives error while calling the search service - net::ERR_CONNECTION_TIMED_OUT When I use the app service URL inside a private VM to access the UI, then it is able to call the search service without any issue. Please help how can I use the private search service form a public IP app gateway.

@Satyam Chauhan Thanks for reaching here! The error message "net::ERR_CONNECTION_TIMED_OUT" indicates that the connection to the search service is timing out. This could be due to a firewall blocking the connection or a misconfiguration of the private endpoint. see- Create a Private Endpoint for a secure connection to Azure Cognitive Search You can check if the private endpoint is configured correctly by following the steps in the documentation . You can also check if the firewall rules are configured correctly to allow traffic from the app gateway public IP to the private endpoint. If the issue persists, you can try creating a shared private link to connect to the search service through a virtual network IP address instead of a port that's open to the internet. You can also check if the resource owner has approved the connection request you created. see- Make outbound connections through a shared private link Let us know.

How to access private cognitive search service from an app service having public IP app gateway

Satyam Chauhan 547

Hi,

I have an application gateway with public IP having backend as an app service on which UI code is deployed. The app service have private access with private endpoint and public access is disabled. The app service calls the cognitive search service, and the cognitive search service also have public access disabled and private access is enabled through private endpoint.

When I am using the app gateway public IP to access the UI, it gives error while calling the search service - net::ERR_CONNECTION_TIMED_OUT
When I use the app service URL inside a private VM to access the UI, then it is able to call the search service without any issue.

Please help how can I use the private search service form a public IP app gateway.

Satyam Chauhan 547 Reputation points

2023-07-19T09:03:11.48+00:00

Thanks for responding @SnehaAgrawal-MSFT ,

You have mentioned - "I can also check if the firewall rules are configured correctly to allow traffic from the app gateway public IP to the private endpoint."

All the services are inside same VNET, subnet is different.

Can you please help how to verify this step
SnehaAgrawal-MSFT 21,506 Reputation points

2023-07-20T11:49:40.1766667+00:00

@Satyam Chauhan To access a search service protected by an IP firewall through the portal, allow access from a specific client and the portal IP address.

You need enable the IP access control policy for your Azure Cognitive Search service, all requests to the data plane from machines outside the allowed list of IP address ranges are rejected.

when you sign in to Azure portal and go to your Azure Cognitive Search service page > Networking > Set Public Network Access to Selected Networks. If your connectivity is set to Disabled, you can only access your search service via a private endpoint.

For detailed step check- https://learn.microsoft.com/en-us/azure/search/service-configure-firewall

let us know.
SnehaAgrawal-MSFT 21,506 Reputation points

2023-07-25T05:56:07.7166667+00:00

@Satyam Chauhan

Just checking if you have chance to see recent response.

Please let us know if further query or issue remains.
Satyam Chauhan 547 Reputation points

2023-08-07T10:25:41.11+00:00

Hi @SnehaAgrawal-MSFT ,

Thanks,

Is there any way around to whitelist only selected IPs, so that only those IPs are allowed.

I tried to whitelist my system's IP and the public IP of the application gateway, but still getting the same response. I guess to calling the search service URL, the browser is using some random IP to generate the API call.
SnehaAgrawal-MSFT 21,506 Reputation points

2023-08-09T14:29:12.58+00:00

@Satyam Chauhan Sure, Azure Cognitive Search supports IP rules for inbound access through a firewall, similar to the IP rules you'll find in an Azure virtual network security group.

By applying IP rules, you can restrict search service access to an approved set of machines and cloud services.

see- for more details see- https://learn.microsoft.com/en-us/azure/search/service-configure-firewall#set-ip-ranges-in-azure-portal

let us know.
Satyam Chauhan 547 Reputation points

2023-08-29T09:58:22.7366667+00:00

Hi @SnehaAgrawal-MSFT ,

I tried by whitelisting only selected IP in the Search service, but the User's IP from where the request is generated changes without notifying, so is there any other ways to connect to that search service.

The flow looks like -

Search service (private) <-- App Service (Private) <-- App gateway (it is inside the same VNET but has a public IP exposed).

User is accessing the App gateway public IP to access the application which is deployed in the App service, and app service code is calling the search service.

Please let me know any workaround for this

1 answer

SnehaAgrawal-MSFT 21,506 Reputation points

2023-07-19T06:23:13.9033333+00:00

@Satyam Chauhan Thanks for reaching here!

The error message "net::ERR_CONNECTION_TIMED_OUT" indicates that the connection to the search service is timing out. This could be due to a firewall blocking the connection or a misconfiguration of the private endpoint. see- Create a Private Endpoint for a secure connection to Azure Cognitive Search

You can check if the private endpoint is configured correctly by following the steps in the documentation. You can also check if the firewall rules are configured correctly to allow traffic from the app gateway public IP to the private endpoint.

If the issue persists, you can try creating a shared private link to connect to the search service through a virtual network IP address instead of a port that's open to the internet. You can also check if the resource owner has approved the connection request you created.

see- Make outbound connections through a shared private link

Let us know.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to access private cognitive search service from an app service having public IP app gateway

1 answer

Your answer