|
| 1 | +--- |
| 2 | +title: Configure private endpoints for Azure Elastic SAN |
| 3 | +description: Learn how to configure private endpoint connections to Azure Elastic SAN volumes. |
| 4 | +author: roygara |
| 5 | +ms.service: azure-elastic-san-storage |
| 6 | +ms.topic: how-to |
| 7 | +ms.date: 06/18/2025 |
| 8 | +ms.author: rogarana |
| 9 | +ms.custom: devx-track-azurecli, devx-track-azurepowershell |
| 10 | +--- |
| 11 | + |
| 12 | +# Configure private endpoints for Azure Elastic SAN |
| 13 | + |
| 14 | +A private endpoint allows you to connect to your Elastic SAN volume group over a private IP address within your virtual network. When you use a private endpoint, traffic between your virtual network and the Elastic SAN remains entirely on Azure’s private backbone, without traversing the public internet. Once a private endpoint is configured and approved, access is granted automatically to the subnet where it resides. This configuration provides strong network isolation and is ideal for production or security-sensitive workloads. |
| 15 | + |
| 16 | +This article covers configuring your Elastic SAN volume group to use private endpoints. |
| 17 | + |
| 18 | +## Prerequisites |
| 19 | + |
| 20 | +- [Deploy an Elastic SAN](elastic-san-create.md). |
| 21 | +- Read through [Learn about networking configurations for Elastic SAN](elastic-san-networking.md) to understand whether private endpoints or service endpoints work better for your environment. |
| 22 | +- If you're using Azure PowerShell, install the [latest Azure PowerShell module](/powershell/azure/install-azure-powershell). |
| 23 | +- If you're using Azure CLI, install the [latest version](/cli/azure/install-azure-cli). |
| 24 | +- Once you've installed the latest version, run `az extension add -n elastic-san` to install the extension for Elastic SAN. |
| 25 | + |
| 26 | +## Configure a private endpoint |
| 27 | + |
| 28 | +There are two steps involved in configuring a private endpoint connection: |
| 29 | + |
| 30 | +> [!div class="checklist"] |
| 31 | +> - Creating the endpoint and the associated connection. |
| 32 | +> - Approving the connection. |
| 33 | +
|
| 34 | +You must have the [Elastic SAN Volume Group Owner](../../role-based-access-control/built-in-roles.md#elastic-san-volume-group-owner) role to create a private endpoint for an Elastic SAN volume group. To approve a new private endpoint connection, you must have permission to the [Azure resource provider operation](../../role-based-access-control/resource-provider-operations.md#microsoftelasticsan) `Microsoft.ElasticSan/elasticSans/PrivateEndpointConnectionsApproval/action`. Permission for this operation is included in the [Elastic SAN Network Admin](../../role-based-access-control/built-in-roles.md#elastic-san-owner) role, but it can also be granted via a custom Azure role. |
| 35 | + |
| 36 | +If you create the endpoint from a user account that has all of the necessary roles and permissions required for creation and approval, then you can do this in one step. Otherwise, it'll require two separate steps by two different users. |
| 37 | + |
| 38 | +When setting up Private Links, your Elastic SAN and the virtual network could be in different resource groups, regions, and subscriptions, including subscriptions that belong to different Microsoft Entra tenants. In these examples, we're creating the private endpoint in the same resource group as the virtual network. |
| 39 | + |
| 40 | +### [Portal](#tab/azure-portal) |
| 41 | + |
| 42 | +You can create a private endpoint connection to your volume group in the Azure portal either when you create a volume group or when modifying an existing volume group. You need an existing virtual network to create a private endpoint. |
| 43 | + |
| 44 | +When creating or modifying a volume group, select **Networking**, then select **+ Create a private endpoint** under **Private endpoint connections**. |
| 45 | + |
| 46 | +Fill out the values in the menu that pops up, select the virtual network and the subnet that your applications will use to connect. When you're done, select **Add**, and **Save**. |
| 47 | + |
| 48 | +:::image type="content" source="media/elastic-san-create/elastic-san-private-endpoint.png" alt-text="Screenshot of the volume group private endpoint creation experience." lightbox="media/elastic-san-create/elastic-san-private-endpoint.png"::: |
| 49 | + |
| 50 | +### [PowerShell](#tab/azure-powershell) |
| 51 | + |
| 52 | +The following script creates a private endpoint for your Elastic SAN volume group. Replace the values of `RgName`, `VnetName`, `SubnetName`, `EsanName`, `EsanVgName`, `PLSvcConnectionName`, `EndpointName`, and `Location`(Region) with your own values, and uncomment `-ByManualRequest` if you're following the two step process, then run the script. |
| 53 | + |
| 54 | +Afterwards, if you don't have all necessary permissions and need the network admin to approve the connection, make sure to also run the script in [Approve connection](#approve-connection). |
| 55 | + |
| 56 | +```powershell |
| 57 | +# Set the resource group name. |
| 58 | +$RgName = "<ResourceGroupName>" |
| 59 | +
|
| 60 | +# Set the virtual network and subnet, which is used when creating the private endpoint. |
| 61 | +$VnetName = "<VnetName>" |
| 62 | +$SubnetName = "<SubnetName>" |
| 63 | +
|
| 64 | +$Vnet = Get-AzVirtualNetwork -Name $VnetName -ResourceGroupName $RgName |
| 65 | +$Subnet = $Vnet | Select -ExpandProperty subnets | Where-Object {$_.Name -eq $SubnetName} |
| 66 | +
|
| 67 | +# Set the Elastic SAN, which is used when creating the private endpoint service connection. |
| 68 | +$EsanName = "<ElasticSanName>" |
| 69 | +$EsanVgName = "<ElasticSanVolumeGroupName>" |
| 70 | +
|
| 71 | +$Esan = Get-AzElasticSan -Name $EsanName -ResourceGroupName $RgName |
| 72 | +
|
| 73 | +# Create the private link service connection, which is input to creating the private endpoint. |
| 74 | +$PLSvcConnectionName = "<PrivateLinkSvcConnectionName>" |
| 75 | +$EsanPlSvcConn = New-AzPrivateLinkServiceConnection -Name $PLSvcConnectionName -PrivateLinkServiceId $Esan.Id -GroupId $EsanVgName |
| 76 | +
|
| 77 | +# Create the private endpoint. |
| 78 | +$EndpointName = '<PrivateEndpointName>' |
| 79 | +$Location = '<Location>' |
| 80 | +$PeArguments = @{ |
| 81 | + Name = $EndpointName |
| 82 | + ResourceGroupName = $RgName |
| 83 | + Location = $Location |
| 84 | + Subnet = $Subnet |
| 85 | + PrivateLinkServiceConnection = $EsanPlSvcConn |
| 86 | +} |
| 87 | +New-AzPrivateEndpoint @PeArguments # -ByManualRequest # (Uncomment the `-ByManualRequest` parameter if you are using the two-step process). |
| 88 | +``` |
| 89 | + |
| 90 | +#### Approve connection |
| 91 | + |
| 92 | +Use this sample code to approve the private link service connection if you're using the two-step process. Use the same variables from the previous code sample: |
| 93 | + |
| 94 | +```powershell |
| 95 | +# Get the private endpoint and associated connection. |
| 96 | +$PrivateEndpoint = Get-AzPrivateEndpoint -Name $EndpointName -ResourceGroupName $RgName |
| 97 | +$PeConnArguments = @{ |
| 98 | + ServiceName = $EsanName |
| 99 | + ResourceGroupName = $RgName |
| 100 | + PrivateLinkResourceType = "Microsoft.ElasticSan/elasticSans" |
| 101 | +} |
| 102 | +$EndpointConnection = Get-AzPrivateEndpointConnection @PeConnArguments | |
| 103 | +Where-Object {($_.PrivateEndpoint.Id -eq $PrivateEndpoint.Id)} |
| 104 | +
|
| 105 | +# Approve the private link service connection. |
| 106 | +$ApprovalDesc="<ApprovalDesc>" |
| 107 | +Approve-AzPrivateEndpointConnection @PeConnArguments -Name $EndpointConnection.Name -Description $ApprovalDesc |
| 108 | +
|
| 109 | +# Get the private endpoint connection anew and verify the connection status. |
| 110 | +$EndpointConnection = Get-AzPrivateEndpointConnection @PeConnArguments | |
| 111 | +Where-Object {($_.PrivateEndpoint.Id -eq $PrivateEndpoint.Id)} |
| 112 | +$EndpointConnection.PrivateLinkServiceConnectionState |
| 113 | +``` |
| 114 | + |
| 115 | +### [Azure CLI](#tab/azure-cli) |
| 116 | + |
| 117 | +The following script creates a private endpoint for your Elastic SAN volume group. Uncomment the `--manual-request` parameter if you're using the two-step process. Replace all example variable values with your own, then run the script. |
| 118 | + |
| 119 | +Afterwards, if you don't have all necessary permissions and need the network admin to approve the connection, make sure to also run the script in [Approve connection](#approve-connection-1). |
| 120 | + |
| 121 | +```azurecli |
| 122 | +# Define some variables. |
| 123 | +# The name of the resource group where the resources are deployed. |
| 124 | +RgName="<ResourceGroupName>" |
| 125 | +# The name of the subnet from which access to the volume group will be configured. |
| 126 | +VnetName="<VnetName>" |
| 127 | +# The name of the virtual network that includes the subnet. |
| 128 | +SubnetName="<SubnetName>" |
| 129 | +# The name of the Elastic SAN that the volume group belongs to. |
| 130 | +EsanName="<ElasticSanName>" |
| 131 | +# The name of the Elastic SAN Volume Group to which a connection is to be created. |
| 132 | +EsanVgName="<ElasticSanVolumeGroupName>" |
| 133 | +# The name of the new private endpoint |
| 134 | +EndpointName="<PrivateEndpointName>" |
| 135 | +# The name of the new private link service connection to the volume group. |
| 136 | +PLSvcConnectionName="<PrivateLinkSvcConnectionName>" |
| 137 | +# The region where the new private endpoint will be created. |
| 138 | +Location="<Location>" |
| 139 | +# The description provided for the approval of the private endpoint connection. |
| 140 | +ApprovalDesc="<ApprovalDesc>" |
| 141 | +
|
| 142 | +# Get the id of the Elastic SAN. |
| 143 | +id=$(az elastic-san show \ |
| 144 | + --elastic-san-name $EsanName \ |
| 145 | + --resource-group $RgName \ |
| 146 | + --query 'id' \ |
| 147 | + --output tsv) |
| 148 | +
|
| 149 | +# Create the private endpoint. |
| 150 | +az network private-endpoint create \ |
| 151 | + --connection-name $PLSvcConnectionName \ |
| 152 | + --name $EndpointName \ |
| 153 | + --private-connection-resource-id $id \ |
| 154 | + --resource-group $RgName \ |
| 155 | + --vnet-name $VnetName \ |
| 156 | + --subnet $SubnetName \ |
| 157 | + --location $Location \ |
| 158 | + --group-id $EsanVgName # --manual-request |
| 159 | +
|
| 160 | +# Verify the status of the private endpoint connection. |
| 161 | +PLConnectionName=$(az network private-endpoint-connection list \ |
| 162 | + --name $EsanName \ |
| 163 | + --resource-group $RgName \ |
| 164 | + --type Microsoft.ElasticSan/elasticSans \ |
| 165 | + --query "[?properties.groupIds[0]=='$EsanVgName'].name" -o tsv) |
| 166 | +
|
| 167 | +az network private-endpoint-connection show \ |
| 168 | + --resource-name $EsanName \ |
| 169 | + --resource-group $RgName \ |
| 170 | + --type Microsoft.ElasticSan/elasticSans \ |
| 171 | + --name $PLConnectionName |
| 172 | +``` |
| 173 | + |
| 174 | +#### Approve connection |
| 175 | + |
| 176 | +Use this sample code to approve the private link service connection if you're using the two-step process. Use the same variables from the previous code sample: |
| 177 | + |
| 178 | +```azurecli |
| 179 | +az network private-endpoint-connection approve \ |
| 180 | + --resource-name $EsanName \ |
| 181 | + --resource-group $RgName \ |
| 182 | + --name $PLConnectionName \ |
| 183 | + --type Microsoft.ElasticSan/elasticSans \ |
| 184 | + --description $ApprovalDesc |
| 185 | +``` |
| 186 | + |
| 187 | +--- |
| 188 | + |
| 189 | +> [!NOTE] |
| 190 | +> If your Elastic SAN and the private endpoint are in different subscriptions, register the Microsoft.ElasticSan resource provider in the subscription that contains the private endpoint. |
| 191 | +> Follow the steps in this [article](/azure/private-link/how-to-approve-private-link-cross-subscription) to approve and register private endpoints. |
| 192 | +
|
| 193 | + |
| 194 | +## Optional - network policies |
| 195 | + |
| 196 | +Virtual network rules don't apply to private endpoints. So, if you need to refine access rules and control traffic over a private endpoint, use network policies. By default, network policies are disabled for a subnet in a virtual network. To use network policies like user-defined routes and network security group support, enable network policy support for the subnet. This setting only applies to private endpoints in the subnet and affects all private endpoints in the subnet. For other resources in the subnet, access is controlled based on security rules in the network security group. For details, see [Network Policies](../../private-link/disable-private-endpoint-network-policy.md). |
| 197 | + |
| 198 | +## Configure client connections |
| 199 | + |
| 200 | +After you have enabled the desired endpoints, you're ready to configure your clients to connect to the appropriate Elastic SAN volumes. |
| 201 | + |
| 202 | +If a connection between a virtual machine (VM) and an Elastic SAN volume is lost, the connection will retry for 90 seconds until terminating. Losing a connection to an Elastic SAN volume won't cause the VM to restart. |
| 203 | + |
| 204 | +## Next steps |
| 205 | + |
| 206 | +- [Connect Azure Elastic SAN volumes to an Azure Kubernetes Service cluster](elastic-san-connect-aks.md) |
| 207 | +- [Connect to Elastic SAN volumes - Linux](elastic-san-connect-linux.md) |
| 208 | +- [Connect to Elastic SAN volumes - Windows](elastic-san-connect-windows.md) |
0 commit comments