Disabling public network access of the Event Hub seems to block any access even if vnet rule is matched

Hi 中垣 茂(ESM),

Thank you for posting query in Microsoft Q&A Platform.

It is possible to disable public network access to an Event Hub and use VNet rules to allow access only from specific networks. However, it is important to ensure that the VNet rules are configured correctly to allow access from the desired networks.

Based on the information you provided, it seems that the VNet rules may not be configured correctly, which is causing the connection issues. You may need to review the VNet rules and ensure that they are configured to allow access from the networks that you want to allow.

Additionally, it is possible that the issue with the different API versions is related to the configuration of the VNet rules. You may need to review the API versions and ensure that they are compatible with the VNet rules that you have configured.

If you are still having issues after reviewing the VNet rules and API versions, you may need to review the diagnostics logs and event logs to identify the root cause of the issue. This can help you to identify any misconfigurations or issues with the network connectivity.

In summary, it is possible to disable public network access to an Event Hub and use VNet rules to allow access only from specific networks. However, it is important to ensure that the VNet rules are configured correctly and that the API versions are compatible with the VNet rules. If you are still having issues, you may need to review the diagnostics logs and event logs to identify the root cause of the issue.

Hope this helps.

Hi.

I believe VNet rules are correct because the difference between these cases are only enable / disable of public network access and function triggers can reach the Event Hub through VNet if public network access is enable.

About API version, I don't know hot to specify the version in Python. There is no argument of API version for Event Hub API (neither sender and trigger).

There are network security rule for function and private endpoint like below.

For Inbound
  direction                   = "Inbound"
  access                      = "Allow"
  protocol                    = "*"
  source_port_range           = "*"
  destination_port_range      = "*"
  source_address_prefix       = "VirtualNetwork"
  destination_address_prefix  = "VirtualNetwork"

For outbound
  direction                   = "Outbound"
  access                      = "Allow"
  protocol                    = "*"
  source_port_range           = "*"
  destination_port_range      = "*"
  source_address_prefix       = "VirtualNetwork"
  destination_address_prefix  = "VirtualNetwork"

I think these allow any communications with VNet, right?