How can I test connection to Azure AI Foundry private endpoint from AWS network?

Question

Hello,

I created a site to site vpn from my azure virtual network to my aws vpc, I have an azure AI foundry created in the virtual network in azure with a private endpoint for private connection, how can I test the connection from an aws ec2 instance, and how can I test the connection to the private endpoint from a VM created in azure in the same network?

Answer 1

Hello Javier

I understand that you want to test the connectivity between the on-premises setup and Azure, as well as within Azure privately.

How can I test the connection to the private endpoint from a VM created in azure in the same network?

First, test the nslookup on the source machine within the private endpoint VNET range to see if it resolves privately. If it doesn't, check if the Private Endpoint VNET is linked to the private DNS zone.

If you're using custom DNS in the private endpoint VNET, set a forwarder in the custom DNS server to point to the Azure DNS IP (168.63.129.16). Also, verify if the custom DNS and private endpoint are in the same VNET or different VNETs. If they are in different VNETs, you need to link both VNETs in the private DNS zone.

Additionally, test psping on the source machine to check if connectivity is working.

Command: [ psping privateIp:portno ]

Check the below document for more understanding:

https://github.com/msrini-MSFT/Troubleshooting-Private-Link-DNS-Scenarios?tab=readme-ov-file#scenario-1--source-machine-deployed-in-azure

how can I test the connection from an aws ec2 instance,

First, you can test the nslookup on the source AWS machine to see if it resolves privately. If it does not resolve privately, check the DNS configuration on your on-prem DNS server to ensure the conditional forwarder is properly configured.

If it resolves privately, use psping on the source machine to check connectivity.

Command: [ psping privateIp:portno ]

Refer to the following public document for Psping

Configuration if you want to connect on-prem to Azure privately:

If you are connecting from on-premises (AWS), you need to configure a conditional forwarder in the on-prem DNS server machine to point to the private DNS resolver inbound IP. Additionally, you need to configure the private DNS resolver inside Azure.

you are not ready to use a private DNS resolver; you need to configure a VM as a DNS server instead. Then, set up a conditional forwarder in the on-prem (AWS) DNS server machine to point to the VM's private IP.

Check the below document for more uderstanding:

https://github.com/msrini-MSFT/Troubleshooting-Private-Link-DNS-Scenarios?tab=readme-ov-file#scenario-2---if-your-source-machine-is-deployed-on-premises-other-cloud

And also check the similar relevant thread:

https://learn.microsoft.com/en-us/answers/questions/2245617/cannot-connect-to-the-private-endpoint-of-an-azure

---

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to "Accept Answer " and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.