azure web app vnet integration

Question

I am trying to connect to on prem DB from Azure but it is not allowed as the azure web app outbound uses public IP to traverse.

I enabled vnet integration and still does not appear to be connecting to db. Is there a way to force the internal path instead external.

Client is not going allow all MS public IP exception. Or I may have to convince them to allow service tag to allow traffic in the vnet integratoin

Answer 1

Hi,

Please verify that the FQDN of the on-premises database server is resolving to private IP from within the app service. To do this, navigate to the app service in the portal, Development tools -- Advanced tools blade -- click Go. When Kudu site opens, click Debug console -- CMD. In the command prompt, enter command similar to below:

nameresolver <DatabaseServerFQDN>

The output should should show the private IP address of the database server, not public IP. If it shows public IP then you need to make some changes to DNS configuration. Exact changes are going to depend on your specific environment and needs. If you post output of nameresolver and provide details on environment I can recommend what changes need to be made.

Please click Accept Answer if the above was helpful.

Thanks.

-TP

Answer 2

Hope you are doing good

Azure Static Web Apps primarily hosts static web content and doesn't provide direct integration with on-premises databases or other on-premises resources. However, if you need to connect from your Azure Static Web App to an on-premises database, you will typically need to go through a few steps to set up the connectivity securely, the steps performed by you are the same

and yes Azure service tag. Alternatively, as you mentioned, allowing traffic from the VNet integration could be a more secure option.

Please accept if it helps

Answer 3

Then for your use case the best solution is to Control outbound traffic with Azure Firewall and please find the attach doc for step by step process https://learn.microsoft.com/en-us/azure/app-service/network-secure-outbound-traffic-azure-firewall

Also , make sure to have the DNS entry for Azure firewall in your DNS if needed

Please accept answer it may help you for sure

Thanks!