How to apply my client VPN access/IP whitelisting to my SFTP server at azure

Question

I want to create SFTP server with storage in my azure account. I am required to whitelist IP access to my SFTP server at azure so they can access files from my SFTP. Please help with steps.

Answer 1

Hello Rakesh Kamboj,

Greetings! Welcome to Microsoft Q&A Forum.

I understand that you would like to create SFTP server with storage account in azure and to whitelist IP access to SFTP server so that it can access files from SFTP.

• Create a standard general-purpose v2 or premium block blob storage account and enable SFTP support during account creation.
• Ensure that the hierarchical namespace feature is enabled. If not, follow the instructions to upgrade your storage account with Azure Data Lake Storage Gen2 capabilities.
• Under Settings, select SFTP (this option appears only if the hierarchical namespace feature is enabled), click Enable SFTP. If no local users appear, add at least one of them (see next section).
• To whitelist specific IPs:

            Deploy an Azure Firewall in a virtual network.
  
            Configure DNAT rules to translate SFTP traffic to the storage account container.
  
            Associate the storage account container with a private endpoint to allow access from the                   firewall.
  
            Connect to the container using the firewall public IP address and the storage account                         container name.
  

• Refer - https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support-how-to?tabs=azure-portal This will guide you through creating your SFTP server while ensuring secure and authorized access for your clients.

Hope this answer helps! Please let us know if you have any further queries. I’m happy to assist you further.

Answer 2

To apply client VPN access and IP whitelisting to your SFTP server in Azure, you can configure Azure Storage firewalls and virtual networks. Here are the steps:

1. Disable all public network access for the storage account under the Public network access setting in the storage account firewall.
2. Configure private links to your storage account from private endpoints on virtual network subnets where the clients reside that require access to your data.
3. If client applications require access over the public endpoints, change the Public network access setting to Enabled from selected virtual networks and IP addresses. Then, specify the virtual network subnets from which you want to allow access and the public IP address ranges of clients from which you want to allow access, such as those on on-premises networks.

For more information and detailed steps, please see the "Configure Azure Storage firewalls and virtual networks" section in the "Configure network access to Azure Storage" article in the Context Url below.

---

References:

• Configure Azure Storage firewalls and virtual networks