オンプレにおけるAzure Private linkの名前解決について / Name resolution of Azure Private link on DNS on-prem

(Followed by English translation)

オンプレ（を模した環境）から、Azure Private linkを経由して閉域網にてAzure blobにアクセスする環境を試しました

前提

Azure Private Link を使うとblobやSQL等にPrivate Ip addressでアクセスできますが、アクセス元がオンプレミスのサーバーの場合、名前解決が課題です。

Private linkはTLS利用が必須で、よってIPアドレスでは無くFQDN宛にアクセスする必要があり、かつこのFQDNがPrivate linkのprivate IPアドレスに名前解決される必要があります。Private link作成時にAzureのデフォルトDNSに設定がされるので、同一regionのAzureリソースからのアクセスの場合気にしなくていいのですが、それ以外の場合は名前解決にひと手間必要です

オンプレからの場合、hostsを使うかDNS forwardingかの2択です
https://docs.microsoft.com/azure/private-link/private-endpoint-dns

手順

今回はAzure JapanEast regionのblob にprivate linkを設定し、オンプレの代わりにJapanWest regionのVMからVPN経由でアクセスを試しました。private linkの名前解決は当該VMのhostsを使っています。手順は以下です

• VPN
  https://docs.microsoft.com/ja-jp/azure/vpn-gateway/vpn-gateway-howto-vnet-vnet-resource-manager-portal

• Private link for Azure Storage
  https://docs.microsoft.com/ja-jp/azure/storage/common/storage-private-endpoints?toc=/azure/storage/blobs/toc.json

blobの設定はこんな感じになります

環境の構成図はこちら

VM at JapanWest -> blob at JapanEastのテストはazcopyを使いました

• ./azcopy copy "./hoge.txt" "https://yoaraistorage1.blob.core.windows.net/con1/1.txt?<SAS token>
• ./azcopy list "https://yoaraistorage1.blob.core.windows.net/con1/?<SAS token>
• ./azcopy copy "https://yoaraistorage1.blob.core.windows.net/con1/1.txt?<SAS token> "./download_1.txt"

ご参考になれば幸いです

---

Let me share how to access Azure blob from on-prem through closed network with private link.

Background

Azure Private Link allows you to access Azure blob, SQL etc via a private IP address. However, if you access Azure from On-prem, name resolution becomes a matter.

TLS is required to access private link, hence you need to access not IP address but FQDN of the private link, and the FQDN should be resolved to private IP address of the private link. Azure default DNS Server in the same region is automatically updated when creating a private links, but you need to take action by yourself in other case.

From on-prem, hosts or DNS forwarding are solutions. See below doc about more detail.
https://docs.microsoft.com/azure/private-link/private-endpoint-dns

Procedure

I checked this by creating a private link on a blob at Azure JapanEast, then accessing there from VM at JapanWest via VPN. Name resolution was based on host of the VM. Related docs are below:

• VPN
  https://docs.microsoft.com/ja-jp/azure/vpn-gateway/vpn-gateway-howto-vnet-vnet-resource-manager-portal

• Private link for Azure Storage
  https://docs.microsoft.com/ja-jp/azure/storage/common/storage-private-endpoints?toc=/azure/storage/blobs/toc.json

Please check the architecture diagram and test procedure by using AzCopy in Japanese section above.

Hope it helps you. Thank you.