Azure Firewall
An Azure network security service that is used to protect Azure Virtual Network resources.
599 questions
How would I allow connections from my V-NET hosts to *.azurewebsites.net/*?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(300.8, 28.999999999999996%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJ3%3C/text%3E%3C/svg%3E)
JohnSebastian-3934
226
Reputation points
I've tried using a Network rule that allows traffic to AppService tag. My clients in the V-NET attempt to connect to something.azurewebsites.net/restofpath
So far I just get 403 errors.
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(134.4, 59%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECM%3C/text%3E%3C/svg%3E)
ChaitanyaNaykodi-MSFT 24,231 Reputation points Microsoft Employee2024-03-05T00:51:04.7266667+00:00 Thank you for reaching out.
Using Azure Firewall you can implement application rules to allow a particular FQDN as shown here.
Using service tag for AppService does allow communication to IP addresses used by an Azure Web App but depending on how the web app is designed there can be redirects lets suppose to Azure Entra for authentication etc. which will not work with Network rules.
I think it will help if you can run a fiddler trace for the web app and determine if any access to any other FQDNs is required.
Please let me know if you have any other question. Thank you!
-
JohnSebastian-3934 226 Reputation points
2024-03-05T14:18:02.59+00:00 Thank you. Yes I am using Azure Firewall with an Application Rule. In the rule I have the following FQDNs specified: .microsoft.com,login.microsoftonline.com,.azurewebsites.net
I'm still unable to reach the App Services web application.
-
ChaitanyaNaykodi-MSFT 24,231 Reputation points Microsoft Employee
2024-03-08T04:31:48.98+00:00 Thank you for getting back and apologies for the delay here.I understand that you have already defined application rule allowing specific FQDN's
In order to troubleshoot it will help if you could run the query below to look for logs within
AZFWNetworkRule and AZFWApplicationRule table, this way you will get to know if any network rule is blocking the connectivity or any other FQDN needs to be added to the
AZFWNetworkRule | where Action contains "Deny" | where DestinationPort == "443"AZFWApplicationRule | where Action contains "Deny"Please let me know if you have any questions. Thank you!
Sign in to comment