Why do ports 11000-11999 need to be open for an Azure VM to connect to an Azure SQL Database?

skreebydba 26 Reputation points
2020-06-24T22:28:23.887+00:00

We just ran into an issue where a connection from an Azure VM to an Azure SQL Server failed with the following error:

A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: TCP Provider, error: 0 - The specified network name is no longer available.)

While troubleshooting using Wireshark, we noticed that a connection was being attempted from IP 40.79.152.27:11029

That led me to this link:

https://learn.microsoft.com/en-us/azure/azure-sql/database/adonet-v12-develop-direct-route-ports

which states that port range 11000-11999 need to be open for an Azure VM to connect to an Azure SQL Database.

I have two questions:

  1. Why does this port range need to be open for Azure connections, but not others?
  2. Why isn't this more widely publicized?

Thanks,

Azure SQL Database
Azure Virtual Machines
Azure Virtual Machines
An Azure service that is used to provision Windows and Linux virtual machines.
7,543 questions
0 comments No comments
{count} vote

Accepted answer
  1. Ronen Ariely 15,101 Reputation points
    2020-06-25T10:36:06.88+00:00

    Good day @skreebydba @skreebydba

    All the information exists in two documents: The one you provided and this one:

    https://learn.microsoft.com/en-us/azure/azure-sql/database/connectivity-architecture

    The short explanation

    Under the firewall configuration of the Azure SQL logical Server you can find the setting for "Connection Policy"

    You have three options there: (1) default, (2) Proxy , (3) Redirect.

    Proxy means that the client will do all communications through "Azure SQL Database gateway" using port 1434.

    Redirect means that the client will first establish the connection using "Azure SQL Database gateways" using port 1434, but once the connection was established the rest of the communication will be directly to the node hosting the database, which will make it faster

    Why does this port range need to be open for Azure connections, but not others?

    Since the option to use "Redirect" is only for Client runs on Azure (these can use both options). Client which runs on your desktop computer for example, will use the Proxy policy.

    Why isn't this more widely publicized?

    It does. This is why there are official documentations.

    You can always publish a post in your blog to publish the information if you think that it should be more widely publicized. In the documentation there is no reason for duplicate document.

    3 people found this answer helpful.

0 additional answers

Sort by: Most helpful