Question 247145 in Azure Question posted in
The official documentation to get you started can be found here.

Azure Vnet peering with private endpoints

I have a two vnets (vnet1 and vnet2) I established a peering between them.
I have Web App service with outbound traffic vnet integration set to vnet1.

I have a CosmosDb private endpoint in vnet2.
I use account endpoint and key to authenticate to the Cosmos from the web app.
When I try to access it I’m getting error:

Response status code does not indicate success: Forbidden (403); Reason: (Request originated from IP xx.xx.xx.xx through public internet. This is blocked by your Cosmos DB account firewall settings.

Could you advice why the traffic goes via public network and how to fix it, please?

Tags:

2

Answers


  1. 0

    When I tried to access Cosmos DB private link in vnet2 I got the same error like below:

    Request originated from IP xx.xx.xx.xx through public internet.his is blocked by your Cosmos DB account firewall settings.

    enter image description here

    To resolve this issue, make use of below steps:

    As long as a valid authorization token is provided, your Azure Cosmos DB account is by default accessible from the internet. For IP policy-based access control to be configured, the user needs to provide a list of IP addresses in CIDR that will be added to the list of client IPs that are permitted to access a certain Azure Cosmos DB account.

    Once this configuration is in place, any requests coming from machines that aren’t on the permitted list will result in a 403 (Forbidden) response. It is recommended to allow Azure portal to access your account when using IP firewall.

    In your Cosmos -> Networking ->selected network -> add you existing virtual network (vnet2) like below:

    • Make sure to update your firewall settings to add your current IP address to the firewall rules.
    • Select the Allow access from Azure portal option and save like below:

    enter image description here

    Added private endpoint in vnet2:

    enter image description here

    Now, when I tried to access my cosmos db account got result successfully like below:

    enter image description here

    Reference:

    Configure an IP firewall for your Azure Cosmos DB account | Microsoft Learn

    Login or Signup to reply.
  2. 0

    You will need a single private DNS zone for the private endpoint and the DNS Zone must be linked to both VNETs.

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search