VNet Integration For Azure Web App and Azure SQL S

问题:

I have an Azure Web App and an Azure SQL Server, both in the same subscription. Both of them are connected to the same VNet Subnet as shown in the below snapshots. The SQL Server is configured not to Allow Azure Resources and Services to access the server, as it should only permit access from either the connected subnet or a set of IP rules.

Unfortunately, the SQL Server is actively refusing any connection from the web app stating that the web app IP is not allowed to access the server.

The interesting thing is that I have the exact same configuration working on another subscription.

What could I be missing?

Snapshots:

1- Here you can see the web application connected to the "webapps" subnet

2- And here you can see the SQL Server connected to the same subnet

3- And that's the error I get

回答1:

Virtual networking in Azure is quite different from how it would work on premises.

I had similar problems in production environment and digging deep, the working solution (meeting security standards and create a secure connection to the database) was to create a private endpoint for SQL access in the virtual network. Then all the calls to the SQL were performed internally (it did not go on the internet), and the databases were denying all public calls.

In your case now, you deactivated the Allow Azure apps to access so when your app is trying to access the SQL the server checks the ip to find out if it is white listed or not. So fast solutions would be one of the following:

1. Enable Azure Web apps to access SQL
2. Find all outbound IPs of your web app and register them in you SQL firewall/ security settings.

If you talk about a proper production environment with security regulations I would suggest you go down the more tedious path of private endpoints.

回答2:

You have to configure the outbound IPs from the app service in the sql fw. You can find them under properties of your app service. Documentation. The reason why is that the VNET integration doesn't give your app service an outbound IP in the VNET you configured it in, so the FW you configured doesn't work.

回答3:

I have working web apps which access storage accounts and KVs. These storage accounts and KVs accept traffic from a particular subnet and the web apps have been configured to integrate with those subnets. I did face an issue where even after integration apps were not able to access these resources. What worked for me was, I changed the App service SKU from Standard to Premium and restarted the app. As you can see, it warns that "Outgoing IPs of your app might change". This is not guaranteed solution but it worked for me.. several times! Not sure about SQL server though. Private endpoint does seem like the way to go but you can give this a try.