Azure container apps can not connect to Azure file share via Private Endpoint

Question

Hi all,

In a bad day, my azure container apps can not connect to Azure file share via private endpoint.

It worked well before.

In my diagram, I seperate 2 virtual networks: Apps-VNet and Storage-VNet

Azure container apps environment will use Apps-VNet

Azure files and private endpoint will use Storage-VNet

Peering is created between 2 VNet.

Private DNS Zone is implemented and linked to 2 VNets. The records are set.

The storage account (include file share) had public network access disabled

Please advise me.

Regards,

Answer 1

Hello Văn Huy Tuyên,

Greetings! Welcome to Microsoft Q&A Platform.

Azure Files provides two main types of endpoints for accessing Azure file shares:

-Public endpoints, which have a public IP address and can be accessed from anywhere in the world.

-Private endpoints, which exist within a virtual network and have a private IP address from within the address space of that virtual network.

Connect to an Azure File Share via a Private Endpoint https://learn.microsoft.com/en-us/samples/azure/azure-quickstart-templates/file-share-private-endpoint/

Configuring Azure Files network endpoints https://learn.microsoft.com/en-us/azure/storage/files/storage-files-networking-endpoints?tabs=azure-portal

This article focuses on how to configure a storage account's endpoints for accessing the Azure file share directly. Much of this article also applies to how Azure File Sync interoperates with public and private endpoints for the storage account. For more information about networking considerations for Azure File Sync, see configuring Azure File Sync proxy and firewall settings.refer https://learn.microsoft.com/en-us/azure/private-link/troubleshoot-private-endpoint-connectivity?source=recommendations for more troubleshooting steps.

If you are still facing issues, please let me know and provide me with more information about the error message you are receiving.

You can also check DNS resolution and connectivity to your Azure file share. To mount or access a file share successfully, your client must be able to resolve the fully qualified domain name of the storage account to the correct IP address for the desired network endpoint of the storage account. Establish a successful TCP connection to the correctly resolved IP address on the correct port for the desired protocol.

References:

• Troubleshoot Azure Private Endpoint connectivity problems
• Troubleshoot Azure Files
• Troubleshoot Azure Private Link Service connectivity problems
• Troubleshooting connectivity problems between Azure VMs

Additional information:

Connecting to an Azure Storage Account using Azure VPN without public IP access can be challenging. Here are some steps and considerations that might help you troubleshoot the issue:

1. Azure VPN Client Setup: Ensure that you have the latest Azure VPN profile provisioning. If you’re encountering difficulties, you can manually import the VPN profile using the Azure VPN Client application. This might help establish a secure connection to the Azure network
2. Private IP Address: To connect to resources like VMs or storage accounts, you need to know their private IP addresses. If you’re unable to ping the private endpoint, it could be due to insufficient network routes provided by the VPN. In such cases, a new peering setup might be required for the VPN gateway2
3. Always On VPN Configuration: For a more persistent connection, consider configuring an Always On VPN user tunnel. This setup ensures that your VPN connection remains active and could help maintain a stable connection to your storage account3

DNS Resolution: If resolving PrivateLink gives you the public address, it might be a DNS issue. Ensure that your DNS settings are correctly configured to resolve to the private IP address of the private endpoint within the Azure network.

1. Troubleshooting Connectivity: If you’re unable to reach the Azure storage account via port 445, it could be blocked by your organization or ISP. Using Azure P2S VPN, Azure S2S VPN, or Express Route can help tunnel SMB traffic over a different port4
2. Private Endpoint Configuration: Using private endpoints for your storage account allows clients on a VNet to securely access data over a Private Link. The private endpoint uses an IP address from the VNet address space, eliminating exposure from the public internet. This setup is crucial for secure access from on-premises networks connected to the VNet via VPN or ExpressRoute

Remember to check the network security group (NSG) rules and the storage account’s firewall settings to ensure they’re not blocking the desired traffic. If the issue persists, I would like to work offline on this issue.If you are still facing issues, please let me know and provide me with more information about the error message you are receiving.

You can also check DNS resolution and connectivity to your Azure file share. To mount or access a file share successfully, your client must be able to resolve the fully qualified domain name of the storage account to the correct IP address for the desired network endpoint of the storage account. Establish a successful TCP connection to the correctly resolved IP address on the correct port for the desired protocol.

References:

• Troubleshoot Azure Private Endpoint connectivity problems
• Troubleshoot Azure Files
• Troubleshoot Azure Private Link Service connectivity problems
• Troubleshooting connectivity problems between Azure VMs

Additional information:

Connecting to an Azure Storage Account using Azure VPN without public IP access can be challenging. Here are some steps and considerations that might help you troubleshoot the issue:

1. Azure VPN Client Setup: Ensure that you have the latest Azure VPN profile provisioning. If you’re encountering difficulties, you can manually import the VPN profile using the Azure VPN Client application. This might help establish a secure connection to the Azure network
2. Private IP Address: To connect to resources like VMs or storage accounts, you need to know their private IP addresses. If you’re unable to ping the private endpoint, it could be due to insufficient network routes provided by the VPN. In such cases, a new peering setup might be required for the VPN gateway2
3. Always On VPN Configuration: For a more persistent connection, consider configuring an Always On VPN user tunnel. This setup ensures that your VPN connection remains active and could help maintain a stable connection to your storage account3

DNS Resolution: If resolving PrivateLink gives you the public address, it might be a DNS issue. Ensure that your DNS settings are correctly configured to resolve to the private IP address of the private endpoint within the Azure network.

1. Troubleshooting Connectivity: If you’re unable to reach the Azure storage account via port 445, it could be blocked by your organization or ISP. Using Azure P2S VPN, Azure S2S VPN, or Express Route can help tunnel SMB traffic over a different port4
2. Private Endpoint Configuration: Using private endpoints for your storage account allows clients on a VNet to securely access data over a Private Link. The private endpoint uses an IP address from the VNet address space, eliminating exposure from the public internet. This setup is crucial for secure access from on-premises networks connected to the VNet via VPN or ExpressRoute

Remember to check the network security group (NSG) rules and the storage account’s firewall settings to ensure they’re not blocking the desired traffic.

Hope this answer helps! please let us know if you have any further queries. I’m happy to assist you further.

---

Please "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.