Forum Discussion

JacksWastedLife's avatar
JacksWastedLife
Tin Contributor
Jun 29, 2020

vNet Integration Service Endpoints

Hi,  I'm trying to understand in vNet Integrated AppServices can access other service endpoints. I have a number of WebApps which are vNet Integrated and I want to deploy a service bus and cosmos DB...
App Services
networking
virtual network
rohanislam's avatar
rohanislam
Brass Contributor
Jun 30, 2020

JacksWastedLife 

By configuring service endpoint you enable the private resources (VM) hosted on your subnet to communicate with the PaaS service (App Service) through Azue backbone network instead of open internet. However, you are still using the public endpoint of your PaaS resource.

 

You can turn off public access by configuring 'Firewalls and virtual networks' option properly. In this option you have to allow 'trusted Microsoft Services' under 'Exceptions' section in order to enable communication between your PaaS resource and other PaaS services. In my view this PaaS to PaaS communication takes place via Azure backbone (Microsoft network routing endpoint) by default. So this will be the case always even if you do not have service endpoints of all the services enabled on your subnet.

 

If you want to go complete private, you have to configure private link for your PaaS resources. This will allow you to assign private IP from your subnet to the PaaS resources. Still you have to configure 'Firewalls and virtual networks' to suit your requirement. 

 

Hope this helps!

 

Thanks,

Rohan

 

JacksWastedLife's avatar
JacksWastedLife
Tin Contributor
Jun 30, 2020

rohanislam Thanks. 

 

I kinda guess that would be the case with PaaS to PaaS. So on that basis, I don't need to worry about traffic between the WebApp and ServiceBus/Cosmos passing over public internet? 

 

So we only need to be a concern with resources in the vnet, such as VMs that I would need to enable service endpoints. 

 

 

 

  • rohanislam's avatar
    rohanislam
    Brass Contributor
    Jun 30, 2020

    JacksWastedLife Yes, that's correct.

     

    Please keep in mind if you want to allow access from on-prem, the traffic is either routed via internet or Expresroute MS peering session depending on your infrastructure setup. So it is very critical to configure Firewall and vNet option properly.

     

     

    Thanks,

    Rohan