Why do ports 11000-11999 need to be open for an Azure VM to connect to an Azure SQL Database?

Question

We just ran into an issue where a connection from an Azure VM to an Azure SQL Server failed with the following error:

A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: TCP Provider, error: 0 - The specified network name is no longer available.)

While troubleshooting using Wireshark, we noticed that a connection was being attempted from IP 40.79.152.27:11029

That led me to this link:

https://learn.microsoft.com/en-us/azure/azure-sql/database/adonet-v12-develop-direct-route-ports

which states that port range 11000-11999 need to be open for an Azure VM to connect to an Azure SQL Database.

I have two questions:

1. Why does this port range need to be open for Azure connections, but not others?
2. Why isn't this more widely publicized?

Thanks,

Answer 1

Good day @skreebydba @skreebydba

All the information exists in two documents: The one you provided and this one:

https://learn.microsoft.com/en-us/azure/azure-sql/database/connectivity-architecture

The short explanation

Under the firewall configuration of the Azure SQL logical Server you can find the setting for "Connection Policy"

You have three options there: (1) default, (2) Proxy , (3) Redirect.

Proxy means that the client will do all communications through "Azure SQL Database gateway" using port 1434.

Redirect means that the client will first establish the connection using "Azure SQL Database gateways" using port 1434, but once the connection was established the rest of the communication will be directly to the node hosting the database, which will make it faster

Why does this port range need to be open for Azure connections, but not others?

Since the option to use "Redirect" is only for Client runs on Azure (these can use both options). Client which runs on your desktop computer for example, will use the Proxy policy.

Why isn't this more widely publicized?

It does. This is why there are official documentations.

You can always publish a post in your blog to publish the information if you think that it should be more widely publicized. In the documentation there is no reason for duplicate document.