In this blog we will look at some common issues that we face using storage accounts with Firewalls and Virtual Networks enabled. We have enabled storage diagnostics logs on the storage account, and we will use the same to troubleshoot some of the issues.
You have enabled Firewalls and Virtual networks on your storage account and allowed access to the storage account only from specific Virtual Network(s) (VNet).
Scenario 1:
You are not able to access your storage account using Portal from an on-premises network (not part of the Azure VNet) or over the internet.
Actions:
Scenario 2:
You are not able to access your storage account from a Virtual Machine, which is part of the VNet, already authorized in storage accounts Firewall and virtual networks.
When trying to download a file, we see the following error message.
Actions:
Transaction Start Time |
2020-11-13T14:46:26.5411013Z |
REST Operation Type |
GetBlob |
Request Status |
OAuthIpAuthorizationError |
HTTP Status Code |
403 |
Authentication type |
bearer |
Service Type |
blob |
Request URL |
https://storageaccount.blob.core.windows.net:443/testcontainer/Image1.png |
Request ID |
6c736153-f01e-0024-16cb-b9e694000000 |
Client IP |
10.1.3.4:50265 |
User Agent |
Azure-Storage/2.0.0-2.0.1 (Python CPython 3.6.8; Windows 10) AZURECLI/2.11.1 (MSI) |
User Object ID |
9e1xxxxx-xxxx-xxxx-xxxx-xxxxxx786d11 |
Scenario 3:
You are trying to add a VNet and its subnets to storage accounts firewall. However, you are getting NetworkSourceDeleted error.
Actions:
The error message in this case is very self-explanatory. The subnet ‘subnet1’ under testvnet1 is required to be removed from storage accounts named in the error message.
Let us understand why this error occurs. We have a Virtual Network setup as below and all these subnets are added to a storage accounts firewall:
VNet1 | Storage1 Firewall | |
⇒subnet0 | VNet1\subnet0 | |
⇒subnet1 | VNet1\subnet1 | |
⇒subnet2 | VNet1\subnet2 |
Now, if you delete a subnet from the virtual network, that subnet gets marked as NetworkSourceDeleted in the storage account.
VNet1 | Storage1 Firewall | |
⇒subnet0 | VNet1\subnet0 | |
⇒subnet1 -deleted | VNet1\subnet1 -NetworkSourceDeleted | |
⇒subnet2 | VNet1\subnet2 |
We create another subnet having the same name as the one which was deleted earlier. The previously deleted subnet1 is still marked as ‘NetworkSourceDeleted’ under Storage1 firewall.
VNet1 | Storage1 Firewall | |
⇒subnet0 | VNet1\subnet0 | |
⇒subnet1 -new | VNet1\subnet1 -NetworkSourceDeleted | |
⇒subnet2 | VNet1\subnet2 |
If we try to add the new ‘subnet1’ to any other storage accounts firewall, we get ‘NetworkSourceDeleted’ error. To resolve this:
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.