Don’t Rely On a Static IP Address for Your SQL Database

Published Jan 15 2019 03:46 PM 336 Views
Microsoft

Updated in TechCommunity on Aug 05, 2019

This blog post is no longer relevant. For current guidance, please refer to https://docs.microsoft.com/en-us/azure/sql-database/sql-database-connectivity-architecture#connectiv...

 

%3CLINGO-SUB%20id%3D%22lingo-sub-318238%22%20slang%3D%22en-US%22%3EDon%26amp%3B%238217%3Bt%20Rely%20On%20a%20Static%20IP%20Address%20for%20Your%20SQL%20Database%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-318238%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSTRONG%20style%3D%22box-sizing%3A%20border-box%3B%20color%3A%20%23333333%3B%20font-family%3A%20%26amp%3Bquot%3B%20segoeui%26amp%3Bquot%3B%2C%26amp%3Bquot%3Blato%26amp%3Bquot%3B%2C%26amp%3Bquot%3Bhelvetica%20neue%26amp%3Bquot%3B%2Chelvetica%2Carial%2Csans-serif%3B%20font-size%3A%2016px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20bold%3B%20letter-spacing%3A%20normal%3B%20orphans%3A%202%3B%20text-align%3A%20left%3B%20text-decoration%3A%20none%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%22%3EUpdated%20in%20TechCommunity%20on%20Aug%2005%2C%202019%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3EThis%20blog%20post%20is%20no%20longer%20relevant.%20For%20current%20guidance%2C%20please%20refer%20to%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps%253A%252F%252Fdocs.microsoft.com%252Fen-us%252Fazure%252Fsql-database%252Fsql-database-connectivity-architecture%2523connectivity-architecture%26amp%3Bdata%3D02%257C01%257CSuresh.Kandoth%2540microsoft.com%257Cdc799c7b288f43fc061008d719cd8a62%257C72f988bf86f141af91ab2d7cd011db47%257C1%257C0%257C637006242892233833%26amp%3Bsdata%3DgoJI9IIW4TwPygeZRdQtVUYZBck%252F89KFJQfxiGN4kms%253D%26amp%3Breserved%3D0%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fsql-database%2Fsql-database-connectivity-architecture%23connectivity-architecture%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EFirst%20published%20on%20MSDN%20on%20Mar%2027%2C%202014%26nbsp%3B%3C%2FSTRONG%3Eas%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps%253A%252F%252Fblogs.msdn.microsoft.com%252Fpsssql%252F2014%252F03%252F27%252Fdont-rely-on-a-static-ip-address-for-your-sql-database%252F%26amp%3Bdata%3D02%257C01%257CSuresh.Kandoth%2540microsoft.com%257Cdc799c7b288f43fc061008d719cd8a62%257C72f988bf86f141af91ab2d7cd011db47%257C1%257C0%257C637006242892243794%26amp%3Bsdata%3DZgLEAiSrdS%252FmX9Aryn5dV54Jq9eDQ0wECzszsoFRzD4%253D%26amp%3Breserved%3D0%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fblogs.msdn.microsoft.com%2Fpsssql%2F2014%2F03%2F27%2Fdont-rely-on-a-static-ip-address-for-your-sql-database%2F%3C%2FA%3E%3C%2FP%3E%0A%3CP%3EI%E2%80%99ve%20seen%20a%20number%20of%20customers%20open%20support%20incidents%20because%20they%20couldn%E2%80%99t%20connect%20to%20their%20SQL%20Database%20server%20which%20was%20ultimately%20due%20to%20the%20incorrect%20assumption%20that%20the%20server%E2%80%99s%20IP%20address%20is%20static.%20In%20fact%2C%20the%20IP%20address%20of%20your%20logical%20server%20is%20not%20static%20and%20is%20subject%20to%20change%20at%20any%20time.%20All%20connections%20should%20be%20made%20using%20the%20fully%20qualified%20DNS%20name%20(FQDN)%20rather%20than%20the%20IP%20address.%3C%2FP%3E%0A%3CP%3EThe%20following%20picture%20from%20the%20%3CA%20href%3D%22http%3A%2F%2Fsocial.technet.microsoft.com%2Fwiki%2Fcontents%2Farticles%2F1541.windows-azure-sql-database-connection-management.aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EWindows%20Azure%20SQL%20Database%20Connection%20Management%20%3C%2FA%3ETechnet%20article%20shows%20the%20network%20topology%20for%20a%20SQL%20Database%20cluster.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20711px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F68061i79219A7D2B92EF86%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EYour%20logical%20server%20(e.g.%2C%20with%20a%20FQDN%20of%20xyz.database.windows.net)%20resides%20on%20a%20SQL%20Database%20cluster%20in%20one%20of%20the%20backend%20SQL%20Server%20nodes.%20Within%20a%20given%20region%20(e.g.%2C%20North%20Central%20US%2C%20South%20Central%20US%2C%20North%20Europe%2C%20etc)%20there%20are%20generally%20many%20SQL%20Database%20clusters%2C%20as%20required%20to%20meet%20the%20aggregate%20capacity%20of%20all%20customers.%26nbsp%3B%20All%20logical%20servers%20within%20a%20cluster%20are%20accessed%20through%20the%20network%20load%20balancer%20(the%20single%20blue%20block%20with%20the%20note%20saying%20%E2%80%9CLoad%20balancer%20forwards%20%E2%80%98sticky%E2%80%99%20sessions%E2%80%A6%E2%80%9D%20in%20the%20diagram)%20via%20a%20virtual%20IP%20address.%3C%2FP%3E%0A%3CP%3EIf%20you%20do%20a%20reverse%20name%20lookup%20from%20your%20server%E2%80%99s%20IP%20address%20you%20will%20actually%20see%20the%20name%20of%20the%20cluster%20load%20balancer.%20For%20example%2C%20if%20I%20try%20to%20ping%20one%20of%20my%20servers%20(whose%20actual%20server%20name%20starts%20with%20ljvt%20in%20the%20screenshot%20below)%20you%20will%20see%20that%20the%20displayed%20name%20associated%20with%20the%20IP%20address%20is%20instead%20data.sn3-1.database.windows.net%2C%20where%20the%20sn3-1%20portion%20of%20the%20name%20maps%20to%20the%20specific%20cluster%20in%20the%20region%20(South%20Central)%20hosting%20this%20server.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20450px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F68062i081EF9C60482B653%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EMicrosoft%20may%20do%20an%20online%20migration%20of%20your%20logical%20server%20between%20clusters%20within%20a%20region%2C%20load%20balancing%20capacity%20across%20the%20clusters%20within%20the%20region.%20This%20move%20is%20a%20live%20operation%20and%20there%20is%20no%20loss%20of%20availability%20to%20your%20database%20during%20the%20operation.%20When%20the%20migration%20completes%2C%20existing%20connections%20to%20your%20logical%20server%20are%20terminated%20and%20upon%20reconnecting%20via%20fully%20qualified%20domain%20name%20your%20app%20will%20be%20directed%20to%20the%20new%20cluster.%26nbsp%3B%20However%2C%20if%20your%20application%20caches%20or%20connects%20by%20IP%20address%20instead%20of%20FQDN%20then%20your%20connection%20attempts%20will%20fail.%3C%2FP%3E%0A%3CP%3EA%20migration%20moves%20all%20of%20your%20settings%2C%20including%20any%20SQL%20Database%20firewall%20rules%20that%20you%20have.%26nbsp%3B%20Consequently%20there%20are%20no%20Azure-specific%20changes%20that%20are%20required%20in%20order%20to%20connect.%26nbsp%3B%20However%2C%20if%20your%20on-premise%20network%20infrastructure%20blocks%2Ffilters%20%3CI%3Eoutgoing%20%3C%2FI%3ETCP%2FIP%20traffic%20to%20port%201433%E2%80%94the%20port%20used%20for%20SQL%20connections%E2%80%94and%20you%20had%20it%20restricted%20to%20a%20fixed%20IP%20address%20then%20you%20may%20need%20to%20adjust%20your%20client%20firewall%2Frouter.%26nbsp%3B%20The%20IP%20address%20of%20your%20SQL%20Database%20server%20will%20always%20be%20a%20part%20of%20the%20address%20ranges%20listed%20in%20the%20%3CA%20href%3D%22http%3A%2F%2Fmsdn.microsoft.com%2Fen-us%2Flibrary%2Fwindowsazure%2Fdn175718.aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EWindows%20Azure%20Datacenter%20IP%20Ranges%20%3C%2FA%3Elist.%26nbsp%3B%20You%20should%20allow%20outgoing%20traffic%20for%20port%201433%20to%20these%20address%20ranges%20rather%20than%20a%20specific%20IP%20address.%3C%2FP%3E%0A%3CP%3EKeith%20Elmore%20%E2%80%93%20Principal%20Escalation%20Engineer%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-318238%22%20slang%3D%22en-US%22%3E%3CP%3EFirst%20published%20on%20MSDN%20on%20Mar%2027%2C%202014%20I%E2%80%99ve%20seen%20a%20number%20of%20customers%20open%20support%20incidents%20because%20they%20couldn%E2%80%99t%20connect%20to%20their%20SQL%20Database%20server%20which%20was%20ultimately%20due%20to%20the%20incorrect%20assumption%20that%20the%20server%E2%80%99s%20IP%20address%20is%20static.%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-318238%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Econnectivity%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Version history
Last update:
‎Aug 08 2019 06:35 AM
Updated by: