fix links

Author: cachai2

articles/container-apps/firewall-integration.md

@@ -15,7 +15,7 @@ Network Security Groups (NSGs) needed to configure virtual networks closely rese
 
 You can lock down a network via NSGs with more restrictive rules than the default NSG rules to control all inbound and outbound traffic for the Container Apps environment at the subscription level.
 
-In the workload profiles environment, user-defined routes (UDRs) and [securing outbound traffic with a firewall](./using-azure-firewall.md) are supported.
+In the workload profiles environment, user-defined routes (UDRs) and [securing outbound traffic with a firewall](./use-azure-firewall.md) are supported.
 
 > [!NOTE]
 > For a guide on how to set up UDR with Container Apps to restrict outbound traffic with Azure Firewall, visit the how to for [Container Apps and Azure Firewall](user-defined-routes.md).

articles/container-apps/manage-secrets.md

@@ -212,7 +212,7 @@ Secrets Key Vault references aren't supported in PowerShell.
 ---
 
 > [!NOTE]
-> If you're using [UDR With Azure Firewall](user-defined-routes.md), you will need to add the `AzureKeyVault` service tag and the *login.microsoft.com* FQDN to the allow list for your firewall. Refer to [configuring UDR with Azure Firewall](using-azure-firewall.md) to decide which additional service tags you need.
+> If you're using [UDR With Azure Firewall](user-defined-routes.md), you will need to add the `AzureKeyVault` service tag and the *login.microsoft.com* FQDN to the allow list for your firewall. Refer to [configuring UDR with Azure Firewall](use-azure-firewall.md) to decide which additional service tags you need.
 
 #### Key Vault secret URI and secret rotation
 

articles/container-apps/networking.md

@@ -91,15 +91,15 @@ For more information about different networking scenarios, see [Ingress in Azure
 |[Cross origin resource sharing (CORS)](cors.md) | Enable CORS for your container app, which allows requests made through the browser to a domain that doesn't match the page's origin. |
 |[Path-based routing](rule-based-routing.md) | Use rules to route requests to different container apps in your environment, depending on the path of each request. |
 |[Virtual networks](custom-virtual-networks.md) | Configure the VNet for your container app environment. |
-|[DNS](dns.md) | Configure DNS for your container app environment's VNet. |
+|[DNS](private-endpoints-with-dns.md#dns) | Configure DNS for your container app environment's VNet. |
 |[Private endpoint](how-to-use-private-endpoint.md) | Use a private endpoint to securely access your Azure Container App without exposing it to the public Internet. |
 |[Integrate with Azure Front Door](how-to-integrate-with-azure-front-door.md) | Connect directly from Azure Front Door to your Azure Container Apps using a private link instead of the public internet. |
 
 ## Outbound features
 
 |Feature |Learn how to |
 |---------|---------|
-|[Using Azure Firewall](using-azure-firewall.md) | Use Azure Firewall to control outbound traffic from your container app. |
+|[Using Azure Firewall](use-azure-firewall.md) | Use Azure Firewall to control outbound traffic from your container app. |
 |[Virtual networks](custom-virtual-networks.md) | Configure the VNet for your container app environment. |
 |[Securing a existing VNet with an NSG](firewall-integration.md) | Secure your container app environment's VNet with a Network Security Group (NSG). |
 |[NAT gateway integration](custom-virtual-networks.md#nat-gateway-integration)| Use NAT Gateway to simplify outbound internet connectivity in your virtual network in a workload profiles environment. |

articles/container-apps/private-endpoints-and-dns.md renamed to articles/container-apps/private-endpoints-with-dns.md

@@ -58,7 +58,7 @@ You can use the *diagnose and solve problems* tool to find issues with your cont
 If you receive an error message when you try to deploy a new revision, verify that Container Apps is able to pull your container image.
 
 - Ensure your container environment firewall isn't blocking access to the container registry. For more information, see [Control outbound traffic with user defined routes](./user-defined-routes.md).
-- If your existing VNet uses a custom DNS server instead of the default Azure-provided DNS server, verify your DNS server is configured correctly and that DNS lookup of the container registry doesn't fail. For more information, see [DNS](./dns.md).
+- If your existing VNet uses a custom DNS server instead of the default Azure-provided DNS server, verify your DNS server is configured correctly and that DNS lookup of the container registry doesn't fail. For more information, see [DNS](./private-endpoint-with-dns.md).
 - If you used the Container Apps cloud build feature to generate a container image for you (see [Code-to-cloud path for Azure Container Apps](./code-to-cloud-options.md#new-to-containers), your image isn't publicly accessible, so this section doesn't apply.
 
 For a Docker container that can run as a console application, verify that your image is publicly accessible by running the following command in an elevated command prompt. Before you run this command, replace placeholders surrounded by `<>` with your values.

articles/container-apps/troubleshooting.md

@@ -20,7 +20,7 @@ Azure creates a default route table for your virtual networks on create. By impl
 
 You can also use a NAT gateway or any other third party appliances instead of Azure Firewall.
 
-See [configuring UDR with Azure Firewall](using-azure-firewall.md) for more information.
+See [configuring UDR with Azure Firewall](use-azure-firewall.md) for more information.
 
 ## Prerequisites
 
@@ -122,7 +122,7 @@ Your virtual networks in Azure have default route tables in place when you creat
 ## Configure firewall policies
 
 > [!NOTE]
-> When using UDR with Azure Firewall in Azure Container Apps, you will need to add certain FQDNs and service tags to the allowlist for the firewall. Please refer to [configuring UDR with Azure Firewall](using-azure-firewall.md) to determine which service tags you need.
+> When using UDR with Azure Firewall in Azure Container Apps, you will need to add certain FQDNs and service tags to the allowlist for the firewall. Please refer to [configuring UDR with Azure Firewall](use-azure-firewall.md) to determine which service tags you need.
 
 Now, all outbound traffic from your container app is routed to the firewall. Currently, the firewall still allows all outbound traffic through. In order to manage what outbound traffic is allowed or denied, you need to configure firewall policies.
 

articles/container-apps/user-defined-routes.md

@@ -407,7 +407,7 @@ Remove-AzResourceGroup -Name $ResourceGroupName -Force
 
 ## Additional resources
 
-- To use VNet-scope ingress, you must set up [DNS](./dns.md).
+- To use VNet-scope ingress, you must set up [DNS](./private-endpoint-with-dns.md).
 
 ## Next steps
 

articles/container-apps/vnet-custom.md

@@ -46,7 +46,7 @@ Azure Firewall filters traffic using either:
 
 ## Scenario 1: Hub and spoke architecture - Dedicated virtual network for private endpoints
 
-:::image type="content" source="./media/inspect-traffic-using-azure-firewall/hub-and-spoke.png" alt-text="Dedicated Virtual Network for Private Endpoints" border="true":::
+:::image type="content" source="./media/inspect-traffic-use-azure-firewall/hub-and-spoke.png" alt-text="Dedicated Virtual Network for Private Endpoints" border="true":::
 
 This scenario is the most expandable architecture to connect privately to multiple Azure services using private endpoints. A route pointing to the network address space where the private endpoints are deployed is created. This configuration reduces administrative overhead and prevents running into the limit of 400 routes.
 
@@ -56,7 +56,7 @@ For more information on charges related to connections with peered virtual netwo
 
 ## Scenario 2: Hub and spoke architecture - Shared virtual network for private endpoints and virtual machines
 
-:::image type="content" source="./media/inspect-traffic-using-azure-firewall/shared-spoke.png" alt-text="Private Endpoints and Virtual Machines in same Virtual Network" border="true":::
+:::image type="content" source="./media/inspect-traffic-use-azure-firewall/shared-spoke.png" alt-text="Private Endpoints and Virtual Machines in same Virtual Network" border="true":::
 
 This scenario is implemented when:
 
@@ -76,13 +76,13 @@ For more information on charges related to connections with peered virtual netwo
 
 ## Scenario 3: Single virtual network
 
-:::image type="content" source="./media/inspect-traffic-using-azure-firewall/single-vnet.png" alt-text="Single virtual network" border="true":::
+:::image type="content" source="./media/inspect-traffic-use-azure-firewall/single-vnet.png" alt-text="Single virtual network" border="true":::
 
 Use this pattern when a migration to a hub and spoke architecture isn't possible. The same considerations as in scenario 2 apply. In this scenario, virtual network peering charges don't apply.
 
 ## Scenario 4: On-premises traffic to private endpoints
 
-:::image type="content" source="./media/inspect-traffic-using-azure-firewall/on-premises.png" alt-text="On-premises traffic to private endpoints" border="true":::
+:::image type="content" source="./media/inspect-traffic-use-azure-firewall/on-premises.png" alt-text="On-premises traffic to private endpoints" border="true":::
 
 This architecture can be implemented if you have configured connectivity with your on-premises network using either: