You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/data-factory/join-azure-ssis-integration-runtime-virtual-network.md
+10-10Lines changed: 10 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -37,7 +37,7 @@ The [configuring an Azure-SQL Server Integration Services (SSIS) integration run
37
37
- If you use a network security group (NSG) on the subnet.
38
38
- If you use Azure ExpressRoute or a user-defined route (UDR).
39
39
- If you use customized Azure-SSIS IR.
40
-
- If you use Azure Powershell provisioning.
40
+
- If you use Azure PowerShell provisioning.
41
41
42
42
## Access to on-premises data stores
43
43
@@ -188,7 +188,7 @@ For example, if your Azure-SSIS IR is located at `UK South` and you want to insp
188
188
> [!NOTE]
189
189
> This approach incurs an additional maintenance cost. Regularly check the IP range and add new IP ranges into your UDR to avoid breaking the Azure-SSIS IR. We recommend checking the IP range monthly because when the new IP appears in the service tag, the IP will take another month go into effect.
190
190
191
-
To make the setup of UDR rules easier, you can run following Powershell script to add UDR rules for Azure Batch management services:
191
+
To make the setup of UDR rules easier, you can run following PowerShell script to add UDR rules for Azure Batch management services:
192
192
```powershell
193
193
$Location = "[location of your Azure-SSIS IR]"
194
194
$RouteTableResourceGroupName = "[name of Azure resource group that contains your Route Table]"
@@ -255,7 +255,7 @@ For firewall appliance to allow outbound traffic, you need to allow outbound to
255
255
256
256
- Port 1433, 11000-11999 with destination as Azure SQL Database (only required when the nodes of your Azure-SSIS IR in the virtual network access an SSISDB hosted by your server).
257
257
258
-
If you use Azure Firewall, you can specify network rule with Azure SQL Service Tag, otherwise you might allow destination as specific azure sql url in firewall appliance.
258
+
If you use Azure Firewall, you can specify network rule with Azure SQL Service Tag, otherwise you might allow destination as a specific Azure SQL URL in firewall appliance.
259
259
260
260
- Port 445 with destination as Azure Storage (only required when you execute SSIS package stored in Azure Files).
261
261
@@ -303,23 +303,23 @@ Make sure that the resource quota of your subscription is enough for the above t
303
303
304
304
If you don't want any public IP address to be exposed, consider [configuring a self-hosted IR as proxy for your Azure-SSIS IR](./self-hosted-integration-runtime-proxy-ssis.md) instead of joining your Azure-SSIS IR to a virtual network, if this applies to your scenario.
305
305
306
-
- Can I add the public IP address of my Azure-SSIS IR to the firewall's allow list for my data sources?
306
+
- Can I add the public IP address of my Azure-SSIS IR to the firewall's allowlist for my data sources?
307
307
308
-
You can now bring your own static public IP addresses for Azure-SSIS IR. In this case, you can add your IP addresses to the firewall's allow list for your data sources. You can also consider other options below to secure data access from your Azure-SSIS IR depending on your scenario:
308
+
You can now bring your own static public IP addresses for Azure-SSIS IR. In this case, you can add your IP addresses to the firewall's allowlist for your data sources. You can also consider other options below to secure data access from your Azure-SSIS IR depending on your scenario:
309
309
310
-
- If your data source is on premises, after connecting a virtual network to your on-premises network and joining your Azure-SSIS IR to the virtual network subnet, you can then add the private IP address range of that subnet to the firewall's allow list for your data source.
310
+
- If your data source is on premises, after connecting a virtual network to your on-premises network and joining your Azure-SSIS IR to the virtual network subnet, you can then add the private IP address range of that subnet to the firewall's allowlist for your data source.
311
311
- If your data source is an Azure service that supports virtual network service endpoints, you can configure a virtual network service endpoint on your virtual network subnet and join your Azure-SSIS IR to that subnet. You can then add a virtual network rule with that subnet to the firewall for your data source.
312
-
- If your data source is a non-Azure cloud service, you can use a UDR to route outbound traffic from your Azure-SSIS IR to an NVA/Azure Firewall via a static public IP address. You can then add the static public IP address of your NVA/Azure Firewall to the firewall's allow list for your data source.
313
-
- If none of the above options meets your needs, consider [configuring a self-hosted IR as proxy for your Azure-SSIS IR](./self-hosted-integration-runtime-proxy-ssis.md). You can then add the static public IP address of the machine that hosts your self-hosted IR to the firewall's allow list for your data source.
312
+
- If your data source is a non-Azure cloud service, you can use a UDR to route outbound traffic from your Azure-SSIS IR to an NVA/Azure Firewall via a static public IP address. You can then add the static public IP address of your NVA/Azure Firewall to the firewall's allowlist for your data source.
313
+
- If none of the above options meets your needs, consider [configuring a self-hosted IR as proxy for your Azure-SSIS IR](./self-hosted-integration-runtime-proxy-ssis.md). You can then add the static public IP address of the machine that hosts your self-hosted IR to the firewall's allowlist for your data source.
314
314
315
315
- Why do I need to provide two static public addresses if I want to bring my own for Azure-SSIS IR?
316
316
317
317
Azure-SSIS IR is automatically updated on a regular basis. New nodes are created during upgrade and old ones will be deleted. However, to avoid downtime, the old nodes will not be deleted until the new ones are ready. Thus, your first static public IP address used by the old nodes cannot be released immediately and we need your second static public IP address to create the new nodes.
318
318
319
319
- I have brought my own static public IP addresses for Azure-SSIS IR, but why it still cannot access my data sources?
320
320
321
-
- Confirm that the two static public IP addresses are both added to the firewall's allow list for your data sources. Each time your Azure-SSIS IR is upgraded, its static public IP address is switched between the two brought by you. If you add only one of them to the allow list, data access for your Azure-SSIS IR will be broken after its upgrade.
322
-
- If your data source is an Azure service, please check whether you have configured it with virtual network service endpoints. If that's the case, the traffic from Azure-SSIS IR to your data source will switch to use the private IP addresses managed by Azure services and adding your own static public IP addresses to the firewall's allow list for your data source will not take effect.
321
+
- Confirm that the two static public IP addresses are both added to the firewall's allowlist for your data sources. Each time your Azure-SSIS IR is upgraded, its static public IP address is switched between the two brought by you. If you add only one of them to the allowlist, data access for your Azure-SSIS IR will be broken after its upgrade.
322
+
- If your data source is an Azure service, please check whether you have configured it with virtual network service endpoints. If that's the case, the traffic from Azure-SSIS IR to your data source will switch to use the private IP addresses managed by Azure services and adding your own static public IP addresses to the firewall's allowlist for your data source will not take effect.
0 commit comments