Our website is hosted on the Azure Linux web app, the site pulls data from third-party vendors. So we need to whitelist our website IP address to their server but after adding the IP for whitelisting still getting 401 unauthorized errors.
We checked the vendor and the IP has been configured properly but why we are getting 401 errors while pulling data via API call.
The IP address we found from Azure Portal --> web app --> select properties and the virtual IP address.
Any help or recommendation will be helpful.
If I understand you correctly, you are trying to whitelist the web app against the firewall for the third-party vendors app?
If so, then the virtual IP address that you have added is the ingress IP address for the web app. You need to add the outbound IP addresses from the Properties blade for the web app to the vendor's firewall.
You should note that there can be up to 11 of these IP addresses. Also, if you scale the web app up or down to a different service plan, or perform any change that will result in a new scale plan, the IP addresses will change. This does not apply to scaling out to multiple instances.
Using a static IP address solved the problem.
Related
Playing with Azure App Service, I instantiated a simple web app. I tried to identify its IP address and found one in the properties of my app. It was described as 'virtual IP address'.
Trying to ping it or put it in my browser, it doesn't work and I can't find if it's an Azure configuration or a principle of virtual IP addresses... To be more precise, if I type '40.79.130.128' in my search bar, I crash on a 404 page, instead of my website page.
I read a bit on the topic, mainly what it is used for, but I don't understand if I can just reach it in my browser, because just typing it in my search bar is no use. What am I missing?
The Virtual IP address under your App Service on the blade Settings->Properties is the Shared IP.
The way IP address work in App Service is different. App Service app runs in an App Service plan, and App Service plans are deployed into one of the deployment units in the Azure infrastructure which is internally called a webspace and each of the deployment unit is assigned up to five virtual IP addresses, which includes one public inbound IP address and four outbound IP addresses.
All App Service plans in the same deployment unit, and app instances that run in them, share the same set of virtual IP addresses which means many App Services is behind same IP address hence you need to configure Custom Domain on your App Service to get it to work.
For configuring Custom domain refer to this link:
https://learn.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-custom-domain
Please refer to below articles for details:
Inbound and outbound IP addresses in Azure App Service
App Service networking features
I have created an App Service Environment and have multiple web app and web API associated with it. I want to achieve an arrangement where only my App service has access to the API, so trying to block traffic to the API using IP Restriction. But all the Web Apps as well as the web API has the same VIP and i cant find any other IP address associated with it.
Also to attach the NSG to the subnet(in which ASE is there), we need to add rules which again need specific IP. How can I achieve this?
I assume you have provisioned external ASE.
"App Service has the ability to allocate a dedicated IP address to an app. This capability is available after you configure an IP-based SSL"
So, you can limit the access to some of your apps inside the ASE by using App-assigned IP-based SSL addresses (Only possible with an External ASE and when IP-based SSL is configured).
When you provision your ASE, you can select how many external IP addresses the system should have including those for IP-based SSL purposes.
please see: https://learn.microsoft.com/en-us/azure/app-service/environment/using-an-ase#ip-addresses and slide nr.14 here https://8gportalvhdsf9v440s15hrt.blob.core.windows.net/ignite2017/session-presentations/BRK3204.PPTX
I deployed a Asp.Net Core 2 application to Azure, using Visual Studio Community's Publish feature. The non-database-dependent parts of the application function, but the database-specific code returns an error.
The application's database is a Sql Server instance installed on a Windows server hosted on a Azure VM (not an Azure SQL database).
To fix this, I:
determined the application's IP address using the Url property (xxx.azurewebsites.net) of the app's blade
added an inbound rule to the network security group's blade that allows all ports from this IP address
added an entry to the VM's Windows firewall to allow ports from this IP address
Unfortunately, this did not solve the problem. What am I missing?
Incidentally, what's the recommended way to set the ASPNETCORE_ENVIRONMENT to development when publishing to Azure (to enable more-detailed error messages)?
I am assuming that your web application is deployed to an Azure Web App. You may not have the correct outbound IP address for your VM hosting. Note that a Web App's inbound IP address may be different from the Web App's outbound address. To find the outbound addresses for your Web App, do the following:
Go to your Web App's management blade.
Choose the Properties menu item (under Settings). On this screen, there's a list of possible outbound IP addresses. Try whitelisting them all in your VM's firewall.
I've got a app plan (BASIC SMALL) with a private (hopefully) ip adress that can be found under Settings > Custom Domains.
When I try to access the content of the app using just the ip, it doesn't work. The site says "Error 404 - Web app not found." The hostname works just fine. When I ping the hostname it gives me the same ip adress. What do I have to do in order to be able to access it just using the ip?
That's not how Web Apps work, since you don't get a unique IP address assigned. You'll need to access it via yourname.azurewebsites.net or yourcustomdomainname.com - and then your requests are routed appropriately based on the name you provide.
If you absolutely needed a dedicated IP address, you'd need to deploy to a virtual machine.
When you host your web site on Azure web app it is bound to a virtual IP address that is shared with other web sites in the same app service plan. If you want to get a dedicated IP with your web site, please try to use Azure virtual machine with reserved IP. You could also choose App Service Environment
If you buy your custom domain, you can freely set DNS A records for that IP (it remains static). It sets binding of your domain to your web app. You can't access it directly by IP. Because on a given IP address and standard HTTP port 80, only one web can be running.
Imagine your web app could be open by entering that IP. You would "block" port 80 for zillions of other stuff running there.
If you check Properties blade there you will see a number of outbound IP addresses. If you consume some requests from web app / job / ... and have IP restriction set on the other side - you need to allow all these IPs.
As David suggested. If you really need a static IP - you need to run VM and set IP address as static or set VNet for web app.
I have a WebJob on an Azure Website that needs to connect to a VM Endpoint to make REST calls.
My Endpoint is configured to deny all except my company's IP range. Now what rule would I need to add or url should I use so my webjob can connect to the endpoint?
I have tried the following without success:
Allow my website virtual IP address in the ACL
Connect to the endpoint using the internal IP instead of the DNS without changing
the ACL
Connect to the endpoint using the public virtual IP instead
of the DNS without changing the ACL
This works but is not what I am looking for:
Remove the current ACL and allow all
Keep the ACL but add a /16 rule with my website IP
Thank you for your help, and let me know if you need precision!
I need the same thing but it seems as though is not possible right now. Looking at this answer on a related question:
Azure Web Sites do not have dedicated outbound IP addresses for each
deployment. This precludes you from using ACLs or Virtual Networks to
connect to your Redis / Solr virtual machines.
So even though you can have a (reasonably) fixed incoming IP address on Azure Websites, the outgoing address is highly unpredictable and as far as I can see, the only exclusion that you could make was to restrict it to the entire range of IP addresses for that data centre which is far from ideal.
A solution moving forward will be to connect your Azure Website and the VM on the same Virtual Network. As of my writing this it is still in Preview so it still is not ready for production use just yet.
Here is more information on it: http://azure.microsoft.com/blog/2014/09/15/azure-websites-virtual-network-integration/