0

I am trying to configure the network setting for Azure SQL server. I have got three services interacting with SQL. They are VM, Azure Data Factory and Web Service. Below are their details.

  1. VM --> It's under Solution VNet
  2. Azure Data Factory --> Configured with Managed Vnet
  3. Web App --> Under its own VNet called Web Vnet. This is not peered with solution VNet.

VM will access SQL using Service Endpoint. ADF will access SQL using Private Endpoint as it uses its own managed VNet. Finally, the Web App will access SQL using its public IP whitelisted at the Server's network setting. The following picture explains the setup.

enter image description here

Below are my questions?

  1. Does this setup work when both private and service endpoints are enabled to access SQL service at the same time?
  2. If I try to create a Private Endpoint for VM's VNet to SQL, does public IP firewall at SQL still work for Web App?
  3. When I create a Private Endpoint for VM's VNet to SQL, do I need to add any NSG rules for other subnet resources?

Note: I still keep "Deny public network access: No".

Improve this question

1 Answer 1

Reset to default
1

Does this setup work when both private and service endpoints are enabled to access SQL service at the same time?

• Yes, both the service endpoint and the private endpoint can be enabled to access the SQL server simultaneously because a service endpoint is a publicly routable IP address while a private endpoint is a private IP in the address space of the virtual network where the private endpoint is configured. Also, since both the endpoints have their distinct DNS zones for routing the requests to the SQL server, it wouldn’t be much of a problem if both the service endpoint and the private endpoint access the SQL server at the same time. It’s just that they shouldn’t request data from the same table or database which would surely create some latency in communication and data processing.

If I try to create a Private Endpoint for VM's VNet to SQL, does public IP firewall at SQL still work for Web App?

• Yes, the public IP firewall will still work for the Web app as the private endpoint created for the VM’s virtual network to the SQL server will route the traffic between these two internally over selected and allowed networks privately between the two virtual networks only and thus will surely not interfere with public IP firewall configured to block or allow traffic from identified or validated sources.

When I create a Private Endpoint for VM's VNet to SQL, do I need to add any NSG rules for other subnet resources?

• When you create a private endpoint for VM’s virtual network to SQL server, you create it by referencing the subnet in which your virtual network is hosted thus, you can create multiple private endpoints in a same subnet for as many resources that are hosted in it. As a result, when you create a private endpoint for a resource in a subnet in virtual network, you don’t need to add any NSG rules for other subnet resources as this connection is a private connection to that resource.

Improve this answer
Sign up to request clarification or add additional context in comments.

2 Comments

thanks @kartik.. a follow-up question on the last point.. assume I created a private endpoint between the subnet (subnet1) where VM (vm1) is hosted and SQL. And there is an another VM (vm2) inside a different subnet (subnet2) but under the same vnet (solution-vnet) as vm1. Subnet2 doesn't have any endpoint enabled but it has NSG configured. Does it need any nsg rule for sql traffic to access the SQL DB from vm2?
@AngiSen, thanks for your gesture and the follow up question. To successfully establish communication between the VM2 and the SQL DB in Azure, you will surely need to open ports in the NSG or configure them accordingly for communication over that TCP connection. Kindly refer to the below link for more information: - roykim.ca/2018/02/28/…

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.