Communicate between App Services having VNet routing

Bouke Haarsma 0

I have two App Services (A & B) that live in separate subscriptions (1 & 2) as they should be logically separated. Both these App Services have separate VNet integrations to communicate with their private resources.

App Service A is a publicly accessible website.

App Service B communicates with App Service X through this VNet integration. App Service X must not be exposed to the public. So on App Service B the VNet routing table includes "Microsoft.Web", which means that traffic to App Services uses the VNet routing.

App Service B also needs to communicate with App Service A. As these App Services are logically separated, they must not have their VNets integrated. The communication between B and A should happen over the public endpoint.

The problem I'm having is that having "Microsoft.Web" in the routing table, App Service B cannot communicate with App Service A. The log table AppServiceIPSecAuditLogs has the following error:

Traffic was received via service tunneling but no private link identifier was provided.

Turning off "Microsoft.Web" in the routing table and B cannot communicate with App Service X.

How can I setup the networking configuration to achieve the separation that I want?

SnehaAgrawal-MSFT 21,506 Reputation points

2023-09-29T13:49:10.0633333+00:00

@Bouke Haarsma

Thanks for reaching here!

Based on the information you provided, it sounds like you have a VNet integration set up for App Service B that includes the "Microsoft.Web" route, which is causing traffic to App Service A to be routed through the VNet. However, you also need App Service B to be able to communicate with App Service A over the public endpoint.

One solution to this problem is to create a new VNet integration for App Service B that does not include the "Microsoft.Web" route. This will allow traffic to App Service A to be routed over the public endpoint, while still allowing App Service B to communicate with App Service X through the existing VNet integration.

To set this up, you can follow these steps:

Create a new VNet integration for App Service B that does not include the "Microsoft.Web" route. You can do this by going to the "Networking" section of App Service B in the Azure portal, selecting "VNet Integration", and then selecting "Add".

Configure the new VNet integration to use a separate subnet in the same VNet as the existing VNet integration. This will allow App Service B to communicate with App Service X through the existing VNet integration, while still allowing traffic to App Service A to be routed over the public endpoint.

Update the routing table for the new VNet integration to exclude the "Microsoft.Web" route. You can do this by going to the "Networking" section of App Service B in the Azure portal, selecting "VNet Integration", and then selecting "Configure".

Test the new configuration to ensure that App Service B can communicate with both App Service A and App Service X as expected.

I hope this helps! Let me know if you have any other questions.
SnehaAgrawal-MSFT 21,506 Reputation points

2023-10-03T05:02:50.6333333+00:00

@Bouke Haarsma Just checking if you have chance to see recent response.

Please let us know if further query or issue remains.

Share via

Communicate between App Services having VNet routing

Your answer