Learn Cloud NetAzure networking, beginner to advanced0 XP0/80
Expert · Incident · 17 of 180:00 / 25:00

Order app can't reach its database or storage

Problem

The order app can't reach its database or its storage.

Your job
  • Get vm-orders reaching srv-db on 1433
  • Get vm-orders reaching stlogs01 on 443 over its private endpoint
Without breaking
  • Keep vm-orders blocked on other outbound ports, like SSH to srv-dbbroken
  • Keep public access on stlogs01 offbroken
Background

"The order app is broken. It can't read from the on-premises database, and it can't write to blob storage either. We moved it to Spoke 1 on Friday." vm-orders needs srv-db, the on-premises SQL server, on 1433, reached over the hub's VPN gateway. It also writes to stlogs01, a blob storage account, through a private endpoint in the hub. Public access on stlogs01 stays off, and vm-orders may only use the ports it needs.

How to work it
  1. 1See it fail

    Prove the problem yourself before you change anything. Reports are often wrong.

    VM commands forVMs
    1. ssh vm-orders
      What's this?

      Opens a shell on vm-orders, so the next commands run on that VM. In this lab it's a shortcut. In real Azure you'd connect through something like Azure Bastion, or SSH to an address you can reach.

    2. nc -zv 192.168.10.5 1433
      What's this?

      netcat, a standard Linux tool. Tries to open a TCP connection and reports whether it worked.

      • -z only check whether the port answers. Send no data
      • -v print the result in words
      • 192.168.10.5 where to connect
      • 1433 the port to try

    Ticks off when the test runs on vm-orders.

  2. 2Find where it stops
  3. 3Name the cause
  4. 4Fix it and test again
Sources on Microsoft Learn (3)
Configure VPN gateway transit for virtual network peeringTroubleshoot private endpoint DNS resolutionHow network security groups filter network traffic: outbound
0/4 changes
Network map
?
  • Resource group, the outer dashed frame
  • Virtual network, with its address space top right
  • Subnet, with range and usable IPs (5 reserved)
  • Network security group. A small shield on a VM's NIC means the NIC has one too
  • Route table on the subnet
  • NICVM Appliance Private endpoint
  • Peering Connected Initiated or access off
  • Goal working Goal broken, X marks where it stops
  • Private DNS zone, dotted lines go to linked VNets
  • Orange pulse: what your last command changed. Drag to pan, Ctrl and scroll to zoom.
Resource grouprg-labvnet-spoke1: tap to inspectVirtual networkvnet-spoke110.1.0.0/16subnet-app: tap to inspectsubnet-app10.1.1.0/24 · 251 usablevm-orders 10.1.1.4: tap to inspectNICvm-orders10.1.1.4vnet-hub: tap to inspectVirtual networkvnet-hub10.0.0.0/16subnet-shared: tap to inspectsubnet-shared10.0.1.0/24 · 251 usableGatewaySubnet: tap to inspectGatewaySubnet10.0.255.0/27 · 27 usablevgw-hub 10.0.255.4: tap to inspectVPNvgw-hub10.0.255.4subnet-pe: tap to inspectsubnet-pe10.0.3.0/24 · 251 usablepe-stlogs01 10.0.3.4: tap to inspectpe-stlogs0110.0.3.4onprem-dc: tap to inspectOn-premises networkonprem-dc192.168.0.0/16subnet-servers: tap to inspectsubnet-servers192.168.10.0/24 · 251 usablesrv-db 192.168.10.5: tap to inspectNICsrv-db192.168.10.5Connected: tap to inspectpeeredVPN connection from vgw-hub to onprem-dcVPNprivatelink.blob.core.windows.net: tap to inspectDNSPrivate DNS zone · privatelink.blob.core.windows.net · 1 link · stlogs01 → 10.0.3.4
  • vm-orders → srv-db:1433should work: not working
  • vm-orders → stlogs01.blob.core.windows.net:443should work: not working
Goals 0/4
Cloud Shell · bashVMsrg-lab · eastus2
cloudshell:~$