Azure IPAM APP URL resolution issue

[saurabhsharma080783]

we have recently deployed azure IPAM App in the environment. APP seems to be working but we are not able to resolve the IPAM APP name. we have privatezone private created and a part of private link. and we have record as well in place.

[DCMattyG]

Hi @saurabhsharma080783, this is a complicated question that really depends on how you have DNS configured in your organizations.

The short answer is that if you deploy Private Endpoints, whatever you are using for DNS resolution centrally within your organization (Windows Server, Infoblox, etc.) will need Conditional Forwarders to a DNS appliance in Azure (NVA, Azure Private Resolver, etc.) that can return the proper A-Record for your Azure IPAM App Service. Additionally, once you are able to resolve the DNS name, you will also need IP reachability to the Virtual Network you have created the Private Endpoint in through something like ExpressRoute, VPN, etc.

Do you know how DNS resolution and Azure connectivity are currently configured within your organization?

[saurabhsharma080783]

currently we have following architecture and configuration-

• our ADDC (Active directory domain controller and DNS service) VM based on Win2019 in azure. and we have hub/spoke topology and all spoke vnet's has our ADDC/DNS VM IP's configured in DNS Server (in VNet configuration).

• IPAM service is again a part of one of the spoke VNet and we have our ADDC/DNS IP configured in VNet settings. that means, IPAM is inheriting the VNet DNS settings. configured our ADDC/DNS IP configured IPAM APP service (outbound DNS).

• private zone "privatelink.azurewebsites.net" created for IPAM service.

• virtual network link configured in above mentioned private dns zone with the VNet (where we have hosted Azure IPAM service)

[HaboMaster]

I'm assuming that your clients are not able to resolve the DNS name for the IPAM app in this response.
The private DNS zone where the IPAM DNS records exist must be linked to the network where the DNS servers are, not where the app is. Then you need a conditional forwarder for privatelink.azurewebsites.net on your DNS servers pointing to the Azure DNS service (168.63.129.16).
The resolution chain would look like this: Client -> AD servers (DNS with conditional forwarder) -> Azure DNS -> private DNS zone (VNet linked to AD server vnet).
If you also have on-prem DC's they need conditional forwarders the private DNS zone that points to your Azure DC's, since they can't access the zone directly.

[DCMattyG]

I agree with @HaboMaster, at first glance it appears that the Private Endpoints are indeed linked to the Private DNS Zones, and the Private DNS Zone is linked to the Virtual Network. That said you also need to make sure that the App Service can communicate to the other required services (such as KeyVault, Cosmos DB, etc.) so you either need to have Private Endpoints created for those as well or Public communication allowed out to those endpoints.

Beyond that, @HaboMaster's comment is right on that DNS resolution and IP reachability are key. Remember that the Azure IPAM application runs in the clients browser, so they need to be able to hit the App Service Private Endpoint from whatever endpoint they are attempting to reach it from.

Hope that helps!