Here is my scenario: My Database is on MongoDB Atlas. I need to access Atlas from Azure Function(Dynamic/Consumption Plan) and App Service. In doing so, I am facing A timeout issue. I know, this is because I have to whitelist outbound IP addresses of Azure Function and App Service Plan in Atlas. But Azure Function(with Consumption Plan) and App Service update their outbound IP addresses during the autoscaling process. Now there are 2 solutions I can think of:
Whitelist all the IP addresses of an Azure Region/Zone. But this is
not an ideal approach, as a single Zone may have
many(500~1000 or more) IP addresses.
Using the VPC peering. I guess we may connect Azure and Atlas through VNET. However, to do that, I need to connect the Azure function and App Service to Vnet first. The problem is VNET Integration with these services is a very expensive approach.
So my question is what other options do I have? Is there any way to connect them using some managed identity or Authentication/Authorization approach using Azure AD or something like that? Is Federated Authentication fits for such a case?
You can use App Service Environment
App Service Environments use dedicated network infrastructures, so
apps running in an App Service environment get static, dedicated IP
addresses both for inbound and outbound connections.
See: https://learn.microsoft.com/en-us/azure/app-service/overview-inbound-outbound-ips
Another solution would be to place your app behind a Firewall and give the firewall a static IP address.
Related
I deploy my web application to an App Service instance on Premium tier. My web application makes outbound requests to external resources on the Internet.
In order to secure the connection with one of these external resources so I can reach it with a private IP address, my plan is to create a Site-to-Site VPN from Azure to Oracle Cloud Infrastructure (where the external resource resides). Then, I plan to use the VNET Integration for outbound traffic and connect my App Service to my VPN.
My question is - will the web application still be able to reach the other external resources on the Internet with their public IPs? I believe the answer is related to routing tables but I can't wrap my mind around it.
Just because you integrate a Regional VNet (I'm assuming) doesn't mean the app service won't be able to make outbound connections. Pretty much like
When you integrate your app service with your VNet that has the site-to-site VPN, traffic from your app service will traverse the Azure network rather than going out to internet, assuming your app service is using an RFC1918 address for your infrastructure. If you want to secure the traffic even further, then your app service would need to be hosted inside an App Service Environment
We have three App Services in Azure (API1, API2, API3).
API2 is getting data from CosmosDB.
API3 is getting data from other CosmosDB.
Main API1 calls API2 to get some data. Then using this data calls API3.
We have poor performance of API1 and we are trying to figure out why. We noticed that there are too many connections in metrics. Also we have issue with SNAT ports.
We tried to setup these APIs to the same VNet but it doesn't help and we are not sure how to set up it correctly.
Do you have any idea what we should setup?
UPDATE:
Seems like VNet helped us with SNAT ports issue but performance of API was still very poor.
What really helped us was change from Windows to Linux. When all APIs runs on the Linux servers we don't see any connections anymore.
Not sure what's specific configurations about three APIs on your side. If you want to use IP from Vnet instead of an external one, you can use a separate environment ASE.
Alternatively, you can use a private link to the app service. By using Private Endpoint, you can connect privately to your web app. Read Connect privately to a web app by using Azure Private Endpoint (Preview).
Today, you can secure this connection using VNet service endpoints
which keep the traffic within the Microsoft backbone network and allow
the PaaS resource to be locked down to just your VNet. However, the
PaaS endpoint is still served over a public IP address and therefore
not reachable from on-premises through Azure ExpressRoute private
peering or VPN gateway. With today’s announcement of Azure Private
Link, you can simply create a private endpoint in your VNet and map it
to your PaaS resource (Your Azure Storage account blob or SQL Database
server). These resources are then accessible over a private IP address
in your VNet, enabling connectivity from on-premises through Azure
ExpressRoute private peering and/or VPN gateway and keep the network
configuration simple by not opening it up to public IP addresses.
For more information, you could read here.
I am trying to solve a problem. I have to access APIs that are hosted on my on premises server (on-prem) from Azure hosted Web API.
The problem is that my on-prem server only allows white listed IPs. I know we can get outbound IPs from our Web App (Azure hosted). But I am not sure whether they are static or will change based on scaling.
Another Solution is to create VNET and add that Web app into that VNET. But I would like someone to suggest better solutions.
There are couple of choices you have.
First, you can have a look at the possibleOutboundIpAddress of your App Service and whitelist this IPs. This however also opens up the door for IPs not really in use by your App Service.
az webapp show --resource-group <group_name> --name <app_name> --query possibleOutboundIpAddresses --output tsv
Secondly, you can put a NAT Gateway in-front of your App Service. This however requires an App Service Plan that supports virtual network integration.
Configure regional virtual network integration from within your app service.
Force all outbound traffic originating from that app to travel through the virtual network. This is done by setting WEBSITE_VNET_ROUTE_ALL=1 property in your web app configuration
Create a public IP address.
Add a NAT gateway, attach it to the subnet that contains the app service and make use of the public IP created in step 3.
If you would also like to use a static inbound IP you can find more information here
The outbound IPs for Azure App service are generally static and will not change on scaling. There are normally 4 outbound IPs and they only change if you change the SKU or there is a need at MS end to increase the capacity of their data center (rare or may never happen in near future).
I would recommend creating a VNET as that is more secure than whitelisting IPs at your on prem service. But if you want to want list the outbound IPs, I would recommend creating a wrapper for your on prem APIs in Azure and whitelist IPs for these in your on prem firewall. This will ensure that you don't have to whitelist every time you want to create an API in Azure that needs to access on prem APIs.
Unfortunately there is no straight forward way to do this in Azure for App Services, I also had this issue recently.
The only solution (for now anyway) is to add the list of outbound IPs of the App Service to your allow rules.
Just be careful with scaling between the tiers because it will change the outbound IP addresses. (https://learn.microsoft.com/en-us/azure/app-service/overview-inbound-outbound-ips#when-outbound-ips-change)
The simplest way would be to use an Azure VM with a static public IP which is used for both inbound and outbound.
Sam Cogan has a good blog post where he does go through a couple of options.
(https://samcogan.com/obtaining-a-static-outbound-ip-from-an-azure-virtual-network/)
A hybrid connection might be a solution https://learn.microsoft.com/en-us/azure/app-service/app-service-hybrid-connections? I think they are designed for accessing on premise services.
I have an Azure App Service that needs to communicate first to a Google Cloud SQL database. I already "whitelisted" an IP address (obtained from Custom Domains) of that App Service in Google Cloud SQL db instance. However, the Azure App Service always throws a db connection timeout.
I'm assuming that I whitelisted the wrong IP address. I checked the Properties of the Azure App Service and saw some outbound IP addresses. Should I whitelist the outbound IP address too or is their a more correct way to whitelist the Azure App SErvice to be able to communicate with Google Cloud SQL?
Thanks for the help!
UPDATE
Solved by whitelisting all outbound IP addresses of the Azure App Service.
This was solved by whitelisting all Outbound IPs of the Azure App Service. In order determine the Outbound IP's of your App Service:
Go to your App Service
In the Settings (left-side nav), click Properties.
Check Outbound IP addresses text field and you will see a couple of IP addresses there.
Next,
Go to your Google Cloud Console, select a project and proceed to SQL.
In SQL, select your instance.
Go to Connections
Set the Outbound IP addresses from Azure App Service in the Authorized networks of your GCP Cloud SQL.
Hope this will be a big help to others.
I have a .Net Web API deployed as a Web App and am trying to connect it to a MySQL db on a VM in a virtual network, but it's responding with a 500 internal server error.
My VNET just consists of one VM with no DNS or site-to-site configuration.
The preview portal says VNET Integration is connected, my certificates are in sync and the gateway is online.
I gave my VM a static IP address which I'm using in my web.config connection string, thinking requests would be routed through the gateway to the VM, but according to my general mysql log their aren't any connection attempts to the mysql server.
The address I gave my VM is within the range of addresses being routed to the VNET, and I setup an endpoint on the VM for the port I'm trying to connect to mysql on with an access rule that allows all connections, so I'm not sure why the connection doesn't appear to be getting through the gateway to my VM.
You may check this link which provides instructions on how to connect Azure App Service - Web App with Azure Virtual Network, so that it can use resources visible within network itself:
https://azure.microsoft.com/en-us/documentation/articles/web-sites-integrate-with-vnet/
App Service supports three ways to connect to VNETs.
ASE - (App Service Environment) is a dedicated Cloud Service that includes all the needed pieces for App Service and as such can be joined to a VNET. A good starting point on ASE is this blog (https://azure.microsoft.com/en-us/blog/introducing-app-service-environment/).
Hybrid Connections - an agent based way to punch an application specific "wormhole" through network boundaries (https://azure.microsoft.com/en-us/documentation/articles/integration-hybrid-connection-overview/)
Virtual Networks - a way to "dial up" from an App Service App into an network (https://azure.microsoft.com/en-us/documentation/articles/web-sites-integrate-with-vnet/)