Uploads keep failing
The app in Spoke 1 can't upload to stuploads01.
- Get the app reaching stuploads01 on 443 over its private endpoint
- Keep public network access on stuploads01 offbroken
- Keep Spoke 1 using the company DNS serverbroken
Background
"Since security locked down storage last week, the app in Spoke 1 can't upload to stuploads01." The app runs on vm-app. stuploads01 is a blob storage account reached through a private endpoint in the hub, and its public network access stays off. Spoke 1 uses the company DNS server, dns-hub at 10.0.4.4 in the hub, and keeps using it.
- 1See it fail
Prove the problem yourself before you change anything. Reports are often wrong.
VM commands forVMsssh vm-appWhat's this?
Opens a shell on vm-app, so the next commands run on that VM. In this lab it's a shortcut. In real Azure you'd connect through something like Azure Bastion, or SSH to an address you can reach.
nslookup stuploads01.blob.core.windows.netWhat's this?
Asks the VM's DNS server what IP address a name points to. Run it on the VM that has the problem, because each VM can get a different answer.
nc -zv stuploads01.blob.core.windows.net 443What's this?
netcat, a standard Linux tool. Tries to open a TCP connection and reports whether it worked.
-zonly check whether the port answers. Send no data-vprint the result in wordsstuploads01.blob.core.windows.netwhere to connect443the port to try
Ticks off when the test runs on vm-app.
- 2Find where it stops
- 3Name the cause
- 4Fix it and test again
?
- Resource group, the outer dashed frame
- Virtual network, with its address space top right
- Subnet, with range and usable IPs (5 reserved)
- Network security group. A small shield on a VM's NIC means the NIC has one too
- Route table on the subnet
- VM Appliance Private endpoint
- Peering Connected Initiated or access off
- Goal working Goal broken, X marks where it stops
- Private DNS zone, dotted lines go to linked VNets
- Orange pulse: what your last command changed. Drag to pan, Ctrl and scroll to zoom.
vm-app → stuploads01.blob.core.windows.net:443should work: not working