Learn Cloud NetAzure networking, beginner to advanced0 XP0/80
Advanced · DNS · 16 of 32

On-premises can't reach a private endpoint

Problem

srv-onprem can't reach stlogs01 over its private endpoint.

Your job
  • Make stlogs01.blob.core.windows.net resolve to 10.0.3.4 from srv-onprem
Without breaking
  • Get srv-onprem reaching the private endpoint on 443broken
Background

On-premises servers like srv-onprem use dns-onprem at 192.168.10.10, which forwards blob.core.windows.net to 10.0.5.4, the planned inbound endpoint of the hub's resolver dnspr-hub. srv-onprem needs stlogs01 over its private endpoint at 10.0.3.4. The resolver exists, but the rollout isn't finished.

How to work it
  1. 1See it fail

    Prove the problem yourself before you change anything. Reports are often wrong.

    VM commands forVMs
    1. ssh srv-onprem
      What's this?

      Opens a shell on srv-onprem, so the next commands run on that VM. In this lab it's a shortcut. In real Azure you'd connect through something like Azure Bastion, or SSH to an address you can reach.

    2. nslookup stlogs01.blob.core.windows.net
      What's this?

      Asks the VM's DNS server what IP address a name points to. Run it on the VM that has the problem, because each VM can get a different answer.

    3. nc -zv stlogs01.blob.core.windows.net 443
      What's this?

      netcat, a standard Linux tool. Tries to open a TCP connection and reports whether it worked.

      • -z only check whether the port answers. Send no data
      • -v print the result in words
      • stlogs01.blob.core.windows.net where to connect
      • 443 the port to try

    Ticks off when the test runs on srv-onprem.

  2. 2Find where it stops
  3. 3Name the cause
  4. 4Fix it and test again
  5. 5Explain it
Sources on Microsoft Learn (3)
Private endpoint DNS integration: on-premises workloadsAzure DNS Private Resolver endpoints and rulesetsTroubleshoot private endpoint DNS resolution
0/2 changes
Network map
?
  • Resource group, the outer dashed frame
  • Virtual network, with its address space top right
  • Subnet, with range and usable IPs (5 reserved)
  • Network security group. A small shield on a VM's NIC means the NIC has one too
  • Route table on the subnet
  • NICVM Appliance Private endpoint
  • Peering Connected Initiated or access off
  • Goal working Goal broken, X marks where it stops
  • Private DNS zone, dotted lines go to linked VNets
  • Orange pulse: what your last command changed. Drag to pan, Ctrl and scroll to zoom.
Resource grouprg-labvnet-spoke1: tap to inspectVirtual networkvnet-spoke110.1.0.0/16subnet-app: tap to inspectsubnet-app10.1.1.0/24 · 251 usablevm-spoke1 10.1.1.4: tap to inspectNICvm-spoke110.1.1.4vnet-hub: tap to inspectVirtual networkvnet-hub10.0.0.0/16subnet-shared: tap to inspectsubnet-shared10.0.1.0/24 · 251 usableGatewaySubnet: tap to inspectGatewaySubnet10.0.255.0/27 · 27 usablevgw-hub 10.0.255.4: tap to inspectVPNvgw-hub10.0.255.4subnet-pe: tap to inspectsubnet-pe10.0.3.0/24 · 251 usablepe-stlogs01 10.0.3.4: tap to inspectpe-stlogs0110.0.3.4snet-dns-in: tap to inspectsnet-dns-in10.0.5.0/28 · 11 usableonprem-dc: tap to inspectOn-premises networkonprem-dc192.168.0.0/16subnet-servers: tap to inspectsubnet-servers192.168.10.0/24 · 251 usablesrv-onprem 192.168.10.5: tap to inspectNICsrv-onprem192.168.10.5dns-onprem 192.168.10.10: tap to inspectNICdns-onprem192.168.10.10Connected: tap to inspectpeeredVPN connection from vgw-hub to onprem-dcVPNprivatelink.blob.core.windows.net: tap to inspectDNSPrivate DNS zone · privatelink.blob.core.windows.net · 0 links · stlogs01 → 10.0.3.4stlogs01.blob.core.windows.net?:443 ✗
  • srv-onprem → stlogs01.blob.core.windows.net:443should work: not working
Goals 0/3
Cloud Shell · bashVMsrg-lab · eastus2
cloudshell:~$