Securing app services with Vnet integration & private endpoint not working

Question

Hi Team, we have followed below Azure microsoft document to secure the communication between Frontend and backend web app. https://learn.microsoft.com/en-us/azure/app-service/tutorial-secure-ntier-app We are using Premium P2V2 app service plan for the same, and on single app service plan we are running both frontend and backend applications. But when we disable public access from inbound traffic rule in backend web app, it throws 403 error code which is as expected but the traffic from frontend to backend will not route. I have tried to check whether private ip assigned to backend app will get resolved through nslookup and tcpping command and both will work from ssh session of frontend app. Kindly assist me to resolve this scenario, all our resources in Australia East region.

Answer 1

Hi @Arvind Dige

I'm going to refer you to Integrate your app with an Azure virtual network - Azure App Service | Microsoft Learn Routing app settings. From what you've stated, it sounds like you enabled access restrictions from the internet but haven't configured vnet routing between your front end and backend. On the Access Restrictions blade, make sure an additional rule was added that allows traffic from the subnet vnet that your frontend app service is configured to.

You could also use the Network/Connectivity troubleshooter and/or Collect a Network Trace under the Diagnose and solve problems blade to further investigate any configuration errors. Personally, even though nslookup worked from ssh, I would update your frontend app to use the private IP and see if the traffic is flowing to rule out DNS and routing. If that works, then you know you have a configuration issue somewhere. Another thing to check, for sanity's sake, is for any identity providers on the Authentication blade of the backend app service. That could also result in a 403.