Forum Discussion

cxmelga's avatar
cxmelga
Copper Contributor
Jun 01, 2021

Can I use an Azure Private Endpoint to access Azure WEB Application Gateway

Hello

 

If I have an Azure WEB application gateway which talks back to an on-premise App (using header based authentication) and I only need users on my own internal network (not internet users or customers) to access it. Can I connect Azure Private Endpoint and Azure Application Gateway to achieve this result (or is there an alternative). if I can do this, is their a URL doc/video showing how this is set up please?

 

Thanks very much

Charlie

 

2 Replies

  • Seshadrr's avatar
    Seshadrr
    Iron Contributor
    Jun 02, 2021
    Azure Private Endpoint is a network interface that connects you privately and securely to a service powered by Azure Private Link. Private link resource such as Azure SQL DB, Cosmos, Backup, automation, storage, Azure Web app.

    Private Endpoint is only used for incoming flows to your Web App which is hosted in Azure as PAAS sevice as Web app. Outgoing flows will not use this Private Endpoint.

    I hope your network connection between Azure and On-Prem securely connect through either VPN or Express route method in that case, the Outbound flow from On-prem to Azure ingress will flow through internal binding as VPN or ER over a private connection with the help of a connectivity provider.
    • cxmelga's avatar
      cxmelga
      Copper Contributor
      Jun 04, 2021

      Seshadrr 

      Hello Seshadrr

      Thanks very much for taking the time to reply,

       

      I am still a bit unclear, can you (or someone else on the forum) clarify the following for me a bit further please.

       

      if we have an Azure WEB Application Proxy (connecting to a backend app on-premise as normal), but we only want 'company users' to use this (not internet based users). Can remove/disable the public IP address from the WEB Application Proxy (in some way e.g. using a Service EndPoint or Private EndPoint, or some other way) so only internal users can access it. 

       

      What I really want to achieve is using a private IP address/subnet  (e.g. 10.x.x.x ) and therefore one DNS record internally to reach the front end of the WAP

       

      can you kindly advise further if this is possible

       

      Thanks

      Charlie

       

       

       

Resources