Unable to add additional DNS Zone to Private Endpoint

Question

Unable to add additional DNS Zone to Private Endpoint

Apurva Pathak 890

Hi,

I am trying to add one more DNS zone to one of my private endpoints using Azure CLI, but it is failing with below error message. This PE is already registered with a local DNS Zone, but I am trying to integrate it with my Central Zone.

PS C:\Users\apurva.pathak> az network private-endpoint dns-zone-group add --endpoint-name blob-pe -g perg -n default --zone-name deployedByPolicy --private-dns-zone /subscriptions/xxxxxx-xxxx-xxxx/resourceGroups/privatednszone/providers/Microsoft.Network/privateDnsZones/Privatelink.blob.core.windows.netaz : ERROR: (InternalServerError) An error occurred.At line:1 char:1+ az network private-endpoint dns-zone-group add --endpoint-name gahdls ...+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~    + CategoryInfo          : NotSpecified: (ERROR: (Interna...error occurred.:String) [], RemoteException    + FullyQualifiedErrorId : NativeCommandError Code: InternalServerErrorMessage: An error occurred.

ChaitanyaNaykodi-MSFT 27,671 Reputation points Microsoft Employee Moderator

2023-09-09T10:35:04.98+00:00

@Apurva Pathak

Thank you for reaching out.

As documented here

Thank you!
Apurva Pathak 890 Reputation points

2023-09-10T06:05:01.8+00:00
Hi @ChaitanyaNaykodi-MSFT

I am using below:

az network private-endpoint dns-zone-group add --endpoint-name <YourPeName> -g <YourPeRgName> -n <YourPeZoneGroupName> --zone-name <NameYouWantToGiveToTheCentralDnsZone> --private-dns-zone <ResourceIdOfCentralDnsZone>

Wrt Portal, the fields are

YourPeZoneGroupName = DNS Zone group

this should be "default" for your case

NameYouWantToGiveToTheCentralDnsZone = Configuration name

This was suggested to me on https://learn.microsoft.com/en-us/answers/questions/1359805/azure-private-dns-zone-get-automatically-deleted
ChaitanyaNaykodi-MSFT 27,671 Reputation points Microsoft Employee Moderator

2023-09-11T23:53:02.6666667+00:00
@Apurva Pathak

Thank you for sharing the details above, it definitely helped.

Based on my understanding now (Please correct me if I am wrong).

Based on the statement made from Kapil's answer.

Let's call the local subscription as "LocalDNSZone" and centralized one as "CentralDNSZone".

So, I am assuming the private endpoint <YourPeName> and the resource group <YourPeRgName> are in the "LocalDNSZone" subscription and the <ResourceIdOfCentralDnsZone> are in the "CentralDNSZone" subscription.

So, in this case you can modify the command as below and see if that helps. You need to specify the

LocalDNSZone_SubscriptionID.

az network private-endpoint dns-zone-group add --endpoint-name <YourPeName> -g <YourPeRgName> -n <YourPeZoneGroupName> --zone-name <NameYouWantToGiveToTheCentralDnsZone> --private-dns-zone <ResourceIdOfCentralDnsZone> --subscription <LocalDNSZone_SubscriptionID>

If you are still facing the issue, can you please let us know if both the subscriptions are in the same tenant?

Also it will help if you could hare a screenshot of this command

az network private-endpoint dns-zone-group list --endpoint-name <YourPeName> --resource-group <YourPeRgName>

Thank you!

Apurva Pathak 890

Thanks for sharing this, Chaitanya!

PFB asked details. User's image

But unfortunately, this did not work. PFB details:

PS C:\Users\apurva.pathak> az network private-endpoint dns-zone-group add --endpoint-name gahdlsrenewdsc-blobrg/providers/Microsoft.Network/privateDnsZones/blob.core.windows.net --subscription xxx-xxxx-xxxx-xxxx
az : ERROR: (InternalServerError) An error occurred.
At line:1 char:1
+ az network private-endpoint dns-zone-group add --endpoint-name gahdls ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (ERROR: (Interna...error occurred.:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError
 
Code: InternalServerError
Message: An error occurred.

ChaitanyaNaykodi-MSFT 27,671 Reputation points Microsoft Employee Moderator

2023-09-13T00:29:21.3533333+00:00
@Apurva Pathak

Thank you for getting back.

A quick observation from the List command above, I see that the default DNS zone group's provisioning state is failed.

Can you please check if the private endpoint is in failed state? You can run the PowerShell command below to check the status.

Get-AzPrivateEndpoint -Name "your_resource_name" -ResourceGroupName "your_resource_group_name"

If the Private endpoint is in failed state, you can do quick get-set as shown here and see if that helps getting the provisioning state to suceeded.

If the Private endpoint is in succeeded state and DNS zone Group is in failed state then usually running a PUT operation can help in changing the provisioning state. So, can you run the az network private-endpoint dns-zone-group create and create the default DNS Zone Group again. Running this command will replace the current default DNS Zone Group and please make sure all the record sets are present.

Hope this helps! Thank you!
Apurva Pathak 890 Reputation points

2023-09-14T17:09:15.1233333+00:00

Hi,

I tried this and it worked too, thank for the help. But, it is not integrating the A record of the endpoint in the DNS Zone. Could you please help with this please. Thanks
ChaitanyaNaykodi-MSFT 27,671 Reputation points Microsoft Employee Moderator

2023-09-16T02:25:28.2366667+00:00

@Apurva Pathak

Thank you for getting back and glad to know the commands were successful.

But, it is not integrating the A record of the endpoint in the DNS Zone. Could you please help with this please. Thanks

Sure, can you please elaborate more on this issue faced? I am not sure if I understood the issue completely. Thank you!
Apurva Pathak 890 Reputation points

2023-09-16T21:13:41.1066667+00:00

I am able to do the integration, but the A records of my PE are not getting created in the DNS Zone.
Apurva Pathak 890 Reputation points

2023-09-19T09:56:47.8366667+00:00

Hi @ChaitanyaNaykodi-MSFT

Could you please help me on this. Thanks in advance!
ChaitanyaNaykodi-MSFT 27,671 Reputation points Microsoft Employee Moderator

2023-09-20T01:07:57.71+00:00

@Apurva Pathak

Apologies for the delay. I have reached out to the team internally regarding this issue and will make an update here as soon as I get a response. Thank you!
ChaitanyaNaykodi-MSFT 27,671 Reputation points Microsoft Employee Moderator

2023-09-23T04:02:17.02+00:00

@Apurva Pathak

Apologies for the delay here. In order to better troubleshoot this issue, I think we will need specialized 1:1 session, where a support engineer can have a screen share session to pin-point the issue. If you have a support plan you may file a support ticket, else could you please send an email to azcommunity@microsoft.com with the below details. I will create a one-time free support ticket for you in this case.

Subject : Attn Chaitanya

Thread URL: Link to this thread.

Subscription ID

Please let me know once you have done the same.