Skip to content

Commit a48252c

Browse files
ShannonLeavittShannonLeavitt
authored
Merge pull request #112963 from mblanco77/privatelink-dns-scenarios-p2
Privatelink dns scenarios p2
2 parents 270a40b + 0b7d5ef commit a48252c

File tree

5 files changed

+85
-39
lines changed

5 files changed

+85
-39
lines changed

‎articles/private-link/media/private-endpoint-dns/hub-and-spoke-azure-dns.png

-136 KB
Loading

‎articles/private-link/media/private-endpoint-dns/on-premise-forwarding-to-azure.png

70.7 KB
Loading

‎articles/private-link/media/private-endpoint-dns/on-premise-using-azure-dns.png

57.7 KB
Loading

‎articles/private-link/media/private-endpoint-dns/single-vnet-azure-dns.png

-139 KB
Loading

‎articles/private-link/private-endpoint-dns.md

Lines changed: 85 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -30,57 +30,58 @@ Your applications don't need to change the connection URL. When attempting to re
3030

3131
For Azure services, use the recommended zone names as described in the following table:
3232

33-
|Private Link resource type |Subresource |Zone name |
34-
|---------|---------|---------|
35-
|SQL DB (Microsoft.Sql/servers) | Sql Server (sqlServer) | privatelink.database.windows.net |
36-
|Azure Synapse Analytics (Microsoft.Sql/servers) | Sql Server (sqlServer) | privatelink.database.windows.net |
37-
|Storage Account (Microsoft.Storage/storageAccounts) | Blob (blob, blob_secondary) | privatelink.blob.core.windows.net |
38-
|Storage Account (Microsoft.Storage/storageAccounts) | Table (table, table_secondary) | privatelink.table.core.windows.net |
39-
|Storage Account (Microsoft.Storage/storageAccounts) | Queue (queue, queue_secondary) | privatelink.queue.core.windows.net |
40-
|Storage Account (Microsoft.Storage/storageAccounts) | File (file, file_secondary) | privatelink.file.core.windows.net |
41-
|Storage Account (Microsoft.Storage/storageAccounts) | Web (web, web_secondary) | privatelink.web.core.windows.net |
42-
|Data Lake File System Gen2 (Microsoft.Storage/storageAccounts) | Data Lake File System Gen2 (dfs, dfs_secondary) | privatelink.dfs.core.windows.net |
43-
|Azure Cosmos DB (Microsoft.AzureCosmosDB/databaseAccounts)|SQL |privatelink.documents.azure.com|
44-
|Azure Cosmos DB (Microsoft.AzureCosmosDB/databaseAccounts)|MongoDB |privatelink.mongo.cosmos.azure.com|
45-
|Azure Cosmos DB (Microsoft.AzureCosmosDB/databaseAccounts)|Cassandra|privatelink.cassandra.cosmos.azure.com|
46-
|Azure Cosmos DB (Microsoft.AzureCosmosDB/databaseAccounts)|Gremlin |privatelink.gremlin.cosmos.azure.com|
47-
|Azure Cosmos DB (Microsoft.AzureCosmosDB/databaseAccounts)|Table|privatelink.table.cosmos.azure.com|
48-
|Azure Database for PostgreSQL - Single server (Microsoft.DBforPostgreSQL/servers)|postgresqlServer|privatelink.postgres.database.azure.com|
49-
|Azure Database for MySQL (Microsoft.DBforMySQL/servers)|mysqlServer|privatelink.mysql.database.azure.com|
50-
|Azure Database for MariaDB (Microsoft.DBforMariaDB/servers)|mariadbServer|privatelink.mariadb.database.azure.com|
51-
|Azure Key Vault (Microsoft.KeyVault/vaults)|vault|privatelink.vaultcore.azure.net|
52-
|Azure Kubernetes Service - Kubernetes API (Microsoft.ContainerService/managedClusters) | managedCluster | {guid}.privatelink.{region}.azmk8s.io|
53-
|Azure Search (Microsoft.Search/searchServices)|searchService|privatelink.search.windows.net|
54-
|Azure Container Registry (Microsoft.ContainerRegistry/registries) | registry | privatelink.azurecr.io |
55-
|Azure App Configuration (Microsoft.Appconfiguration/configurationStores)| configurationStore | privatelink.azconfig.io|
56-
|Azure Backup (Microsoft.RecoveryServices/vaults)| vault |privatelink.{region}.backup.windowsazure.com|
57-
|Azure Event Hub (Microsoft.EventHub/namespaces)| namespace |privatelink.servicebus.windows.net|
58-
|Azure Service Bus (Microsoft.ServiceBus/namespaces) | namespace |privatelink.servicebus.windows.net|
59-
|Azure Relay (Microsoft.Relay/namespaces) | namespace |privatelink.servicebus.windows.net|
60-
|Azure Event Grid (Microsoft.EventGrid/topics) | topic | topic.{region}.privatelink.eventgrid.azure.net|
61-
|Azure Event Grid (Microsoft.EventGrid/domains) | domain | domain.{region}.privatelink.eventgrid.azure.net |
62-
|Azure WebApps (Microsoft.Web/sites) | site | privatelink.azurewebsites.net |
63-
|Azure Machine Learning(Microsoft.MachineLearningServices/workspaces) | workspace | privatelink.api.azureml.ms |
33+
| Private Link resource type / Subresource |Private DNS Zone name | Public DNS zone name |
34+
|---|---|---|---|
35+
| SQL DB (Microsoft.Sql/servers) / Sql Server | privatelink.database.windows.net | database.windows.net |
36+
| Azure Synapse Analytics (Microsoft.Sql/servers) / Sql Server | privatelink.database.windows.net | database.windows.net |
37+
| Storage Account (Microsoft.Storage/storageAccounts) / Blob (blob, blob_secondary) | privatelink.blob.core.windows.net | blob.core.windows.net |
38+
| Storage Account (Microsoft.Storage/storageAccounts) / Table (table, table_secondary) | privatelink.table.core.windows.net | table.core.windows.net |
39+
| Storage Account (Microsoft.Storage/storageAccounts) / Queue (queue, queue_secondary) | privatelink.queue.core.windows.net | queue.core.windows.net |
40+
| Storage Account (Microsoft.Storage/storageAccounts) / File (file, file_secondary) | privatelink.file.core.windows.net | file.core.windows.net |
41+
| Storage Account (Microsoft.Storage/storageAccounts) / Web (web, web_secondary) | privatelink.web.core.windows.net | web.core.windows.net |
42+
| Data Lake File System Gen2 (Microsoft.Storage/storageAccounts) / Data Lake File System Gen2 (dfs, dfs_secondary) | privatelink.dfs.core.windows.net | dfs.core.windows.net |
43+
| Azure Cosmos DB (Microsoft.AzureCosmosDB/databaseAccounts) / SQL | privatelink.documents.azure.com | documents.azure.com |
44+
| Azure Cosmos DB (Microsoft.AzureCosmosDB/databaseAccounts) / MongoDB | privatelink.mongo.cosmos.azure.com | mongo.cosmos.azure.com |
45+
| Azure Cosmos DB (Microsoft.AzureCosmosDB/databaseAccounts) / Cassandra | privatelink.cassandra.cosmos.azure.com | cassandra.cosmos.azure.com |
46+
| Azure Cosmos DB (Microsoft.AzureCosmosDB/databaseAccounts) / Gremlin | privatelink.gremlin.cosmos.azure.com | gremlin.cosmos.azure.com |
47+
| Azure Cosmos DB (Microsoft.AzureCosmosDB/databaseAccounts) / Table | privatelink.table.cosmos.azure.com | table.cosmos.azure.com |
48+
| Azure Database for PostgreSQL - Single server (Microsoft.DBforPostgreSQL/servers) / postgresqlServer | privatelink.postgres.database.azure.com | postgres.database.azure.com |
49+
| Azure Database for MySQL (Microsoft.DBforMySQL/servers) / mysqlServer | privatelink.mysql.database.azure.com | mysql.database.azure.com |
50+
| Azure Database for MariaDB (Microsoft.DBforMariaDB/servers) / mariadbServer | privatelink.mariadb.database.azure.com | mariadb.database.azure.com |
51+
| Azure Key Vault (Microsoft.KeyVault/vaults) / vault | privatelink.vaultcore.azure.net | vault.azure.net |
52+
| Azure Kubernetes Service - Kubernetes API (Microsoft.ContainerService/managedClusters) / managedCluster | privatelink.{region}.azmk8s.io | {region}.azmk8s.io |
53+
| Azure Search (Microsoft.Search/searchServices) / searchService | privatelink.search.windows.net | search.windows.net |
54+
| Azure Container Registry (Microsoft.ContainerRegistry/registries) / registry | privatelink.azurecr.io | azurecr.io |
55+
| Azure App Configuration (Microsoft.AppConfiguration/configurationStores) / configurationStore | privatelink.azconfig.io | azconfig.io |
56+
| Azure Backup (Microsoft.RecoveryServices/vaults) / vault | privatelink.{region}.backup.windowsazure.com | {region}.backup.windowsazure.com |
57+
| Azure Event Hub (Microsoft.EventHub/namespaces) / namespace | privatelink.servicebus.windows.net | servicebus.windows.net |
58+
| Azure Service Bus (Microsoft.ServiceBus/namespaces) / namespace | privatelink.servicebus.windows.net | servicebus.windows.net |
59+
| Azure Relay (Microsoft.Relay/namespaces) / namespace | privatelink.servicebus.windows.net | servicebus.windows.net |
60+
| Azure Event Grid (Microsoft.EventGrid/topics) / topic | privatelink.eventgrid.azure.net | eventgrid.azure.net |
61+
| Azure Event Grid (Microsoft.EventGrid/domains) / domain | privatelink.eventgrid.azure.net | eventgrid.azure.net |
62+
| Azure WebApps (Microsoft.Web/sites) / site | privatelink.azurewebsites.net | azurewebsites.net |
63+
| Azure Machine Learning(Microsoft.MachineLearningServices/workspaces) / workspace | privatelink.api.azureml.ms | api.azureml.ms |
64+
6465

6566

6667

6768
## DNS configuration scenarios
6869

69-
The FQDN of the services resolves a public ip address, you have to change your DNS configuration to resolve the private IP address of the private endpoint.
70+
The FQDN of the services resolves automatically to a public IP address, so in order to resolve to the private IP address of the private endpoint you must change your DNS configuration accordingly.
7071

7172
DNS is a critical component to make the application work correctly by resolving in a right manner the private endpoint IP address.
7273

7374
Based on your preferences, the following scenarios are available for DNS resolution integrated:
7475

75-
- [Virtual Network workloads without custom DNS server](#virtual-network-workloads-without-custom-dns-server)
76-
76+
- [Virtual network workloads without custom DNS server](#virtual-network-workloads-without-custom-dns-server)
77+
- [On premises workloads using a DNS forwarder](#on-premises-workloads-using-a-dns-forwarder)
7778

78-
## Virtual Network workloads without custom DNS server
79+
## Virtual network workloads without custom DNS server
7980

8081
This configuration is appropriate for virtual network workloads without custom DNS server. In this scenario the client queries for the private endpoint IP address to Azure provided DNS [168.63.129.16](../virtual-network/what-is-ip-address-168-63-129-16.md). Azure DNS will be responsible for DNS resolution of the private DNS zones.
8182

8283

83-
> [!NOTE]
84+
> [!NOTE]
8485
> This scenario is using Azure SQL database recommended Private DNS zone. For other services you can adjust the model using the following reference [Azure services DNS zone configuration](#azure-services-dns-zone-configuration).
8586
8687
To configure properly you would need the following resources :
@@ -93,16 +94,61 @@ To configure properly you would need the following resources :
9394

9495
The following diagram illustrates the DNS resolution sequence from virtual network workloads using private dns zone
9596

96-
:::image type="content" source="media/private-endpoint-dns/single-vnet-azure-dns.png" alt-text="single virtual network and azure provided dns":::
97+
:::image type="content" source="media/private-endpoint-dns/single-vnet-azure-dns.png" alt-text="Single virtual network and Azure-provided DNS":::
9798

9899
This model can be extended to multiple peered virtual networks that are associated to the same private endpoint. This can be done by [adding new virtual network links](../dns/private-dns-virtual-network-links.md) to the private DNS zone for all peered virtual networks.
99100

100-
> [!IMPORTANT]
101+
> [!IMPORTANT]
101102
> A single private DNS zone is required for this configuration, creating multiple zones with the same name for different virtual networks would need manual operations to merge the DNS records
102103
103104
In this scenario there's a [hub & spoke](https://docs.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/hub-spoke) networking topology with the spoke networks sharing a common private endpoint and all the spoke virtual network are linked to the same private dns zone.
104105

105-
:::image type="content" source="media/private-endpoint-dns/hub-and-spoke-azure-dns.png" alt-text="hub and spoke with azure provided dns":::
106+
:::image type="content" source="media/private-endpoint-dns/hub-and-spoke-azure-dns.png" alt-text="Hub and spoke with Azure-provided DNS":::
107+
108+
## On premises workloads using a DNS forwarder
109+
 
110+
For on premises workloads to be able to resolve an FQDN of a private endpoint into the private IP address, you must use a DNS forwarder to make the resolution of the Azure service [public DNS zone](#azure-services-dns-zone-configuration) deployed in Azure.
111+
112+
113+
The following scenario is appropriate for an on premises network that has a DNS forwarder in Azure, which in turn is responsible for resolving all the DNS queries via a server level forwarder to the Azure provided DNS [168.63.129.16](../virtual-network/what-is-ip-address-168-63-129-16.md)
114+
115+
> [!NOTE]
116+
> This scenario is using Azure SQL database recommended Private DNS zone. For other services you can adjust the model using the following reference [Azure services DNS zone configuration](#azure-services-dns-zone-configuration).
117+
118+
To configure properly you would need the following resources:
119+
120+
- On premises network
121+
- Virtual network [connected to on premises](https://docs.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/)
122+
- DNS forwarder deployed in Azure 
123+
- Private DNS zones [privatelink.database.windows.net](../dns/private-dns-privatednszone.md) with [type A Record](../dns/dns-zones-records.md#record-types)
124+
- Private endpoint information (FQDN record name and Private IP Address)
125+
126+
The following diagram illustrates the DNS resolution sequence from an on premise network that use a DNS forwarder deployed in Azure,
127+
where the resolution is made by an private DNS zone linked to a virtual network.
128+
129+
:::image type="content" source="media/private-endpoint-dns/on-premise-using-azure-dns.png" alt-text="On-premises using Azure DNS":::
130+
131+
This configuration can be extended for an on premise network that has already a DNS solution in place. 
132+
The on premises DNS solution needs to be configured to forward DNS traffic to the Azure DNS via a [conditional forwarder](../virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances.md#name-resolution-that-uses-your-own-dns-server) referencing the DNS forwarder deployed in Azure.
133+
134+
> [!NOTE]
135+
> This scenario is using Azure SQL database recommended Private DNS zone. For other services you can adjust the model using the following reference [Azure services DNS zone configuration](#azure-services-dns-zone-configuration).
136+
137+
To configure properly you would need the following resources :
138+
139+
140+
- On premises network with a custom DNS solution in place 
141+
- Virtual network [connected to on premises](https://docs.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/)
142+
- DNS forwarder deployed in Azure
143+
- Private DNS zones [privatelink.database.windows.net](../dns/private-dns-privatednszone.md)  with [type A Record](../dns/dns-zones-records.md#record-types)
144+
- Private endpoint information (FQDN record name and Private IP Address)
145+
146+
The following diagram illustrates the DNS resolution sequence from an on premise network that conditionally forwards DNS traffic to Azure,where the resolution is made by an private DNS zone linked to a virtual network
147+
148+
> [!IMPORTANT]
149+
> The conditional forwarding must be made to the [public DNS zone](#azure-services-dns-zone-configuration) Ex: `database.windows.net` , instead of **privatelink**.database.windows.net
150+
151+
:::image type="content" source="media/private-endpoint-dns/on-premise-forwarding-to-azure.png" alt-text="On-premises forwarding to Azure DNS":::
106152

107153

108154
## Next steps

0 commit comments

Comments
 (0)