Trouble connecting to new Azure SQl Managed Instance from Azure VM in same vnet.

Question

Hello. I have set up a new Azure SQL Managed Instance and imported copies of my databases. I have an Azure VM in the same VNET (but different subnet) that will ultimately connect to these databases to run an application. This VM is running Windows Server 2022.

I also have an Azure VPN gateway configured on this VNET and can connect with my laptop via Point to Site VPN.

I can connect to the SQL Managed Instance over the P2S VPN from my laptop using SSMS without any problems.

However, I cannot seem to connect to the SQL Managed Instance from the Azure VM.

I have checked all the usual things, including the following:

• Windows firewall on the VM
• Azure Network Security Groups on both the SQL subnet and the VM subnet

Interestingly enough, I ran an nmap scan from the VM to the entire SQL MI subnet. The nmap scan reveals that I can connect to some of the IP addresses within the SQL MI subnet, but not the primary SQL IP address, i.e. the IP address that the SQL MI host name (xxx.database.windows.net) resolves to.

I've tried rebooting the VM a number of times. I even tried moving the entire SQL MI to a new subnet to see if that would help - no change, same problem.

I've tried running packet captures and various Azure networking troubleshooting tools - nothing is helping and I'm out of ideas.

Does anyone have any thoughts? Am I missing something obvious?

Thanks in advance!

Answer 1

Hi @Alex Swetz , thank you for your update that your issue has been resolved.

Problem: Azure SQL Managed Instance cannot be accessed from an Azure VM in the same VNET, different subnet from SQL MI. The VM is running Windows Server 2022. The same SQL Managed Instance can be accessed over the P2S VPN from a laptop using SSMS. All possible blocker has been checked: Windows firewall, NSG, DNS.

Solution: created a new VM in a new subnet on the same vnet. The new VM can access SQL MI.

Answer 2

Hi @Alex Swetz , please check the connection type of your SQL MI Vnet-Local endpoint. If you didn't change anything, by default it is using Proxy connection type. To enable connectivity, only port 1433 for private networks and port 3342 for public connection need to be opened.

Try changing the Vnet-Local endpoint to Redirect connection type. Make sure that your Network Security Groups (NSG) allow access on ports 1433, and 11000-11999.

More info: https://learn.microsoft.com/en-us/azure/azure-sql/managed-instance/connection-types-overview?view=azuresql#connection-types

Answer 3

Hi Silvia. I have already checked DNS resolution - that piece is working just fine. I resolved my problem by building a new VM in a new subnet on the same vnet. The connection to the SQL managed instance from the new VM is working just fine. No clue what the difference is, but oh well. Thanks for your feedback!