Private Endpoints and DNS in Azure
ฝัง
- เผยแพร่เมื่อ 30 มิ.ย. 2024
- Private Endpoints in Azure provide a secure way to access resources over the private, internal network. But the options for configuring DNS for Private Endpoints is not as straight forward. This video goes over the options available for DNS with Private Endpoints. We start by crating a storage account with a Private Endpoint, the review the default DNS configuration. We look at The WireServer and how it can be used with a Conditional Forwarder as well as using Forward Lookup Zones for name resolution.
00:00 - Start
01:08 - Create a Private Endpoint
03:48 - View DNS
05:24 - WireServer
06:31 - Conditional Forwarder
10:59 - Forward Lookup Zones
Links:
Zero to Hero with Azure Virtual Desktop
www.udemy.com/course/zero-to-...
Hybrid Identity with Windows AD and Azure AD
www.udemy.com/course/hybrid-i...
Two Azure IP Addresses You Should Know
• Two Azure IP Addresses...
Blog Post
www.ciraltos.com/private-endp... - วิทยาศาสตร์และเทคโนโลยี
Brilliant, thank you for making it available in udemy and here ! Amazing stuff
One of the best explanations about private Links and DNS I have seen. Thanks
thanks alot Travis! you made everything clear, can`t thank you enough! Please keep this great explanation for all storage topics
Awesome, keep up the good work! Looking forward to seeing more contents on Azure Networking aspects. Thank you!
Your explanations are short and precise. Thank you.
Really like these videos. Very straightforward and I don't have to sit through a bunch of information that doesn't matter.
Thank you Travis. I struggled with this for a while, you made it happen! Thanks
fantastic, we have struggled for a while!!!
Wow, another amazing video. To the point, 100% accurate. Well done!
What a great video! thank you. There was always that confusion about DNS setup with Private Endpoints.
your Azure videos are so informative. I couldn't help myself to be your Channel subscriber.
Thanks Travis. Brilliant video, which explained things perfectly.
Perfect explanation! Thank you so much! Amazing job, best wishes for you!
It would be amazing if you did a video on how to use todays Azure Private DNS Revolvers along with DNS forwarding rulesets to access private link endpoints from on prem via VPN.
Tip: To complete this, set a Firewall rule outbound to private link internal ip/port. Finally, use psping to test this. Works for me!!!
Saved the day today when I was in a pinch. Thanks sir!
Thank you, excelent explanation!
Great video and clear explanation 👌
Amazing Stuff!!!
Good Video Travis.
Excellent. Very useful video.
Travis made things easy!
Brilliant,Thanks for making this video
Perfectly explained. Thanks
Glad it was helpful!
amazing video thanks this help me a lot with labs and understanding.
Glad it helped!
Very nice. Thank you!
thank you! great explanation :)
Glad it was helpful!
Thanks, keep it up.
Thanks a lot
Hey Travis. Great video. I watch all your videos. I have a question. If you want a GLOBAL DNS (for on premise and azure network using the same DNS SERVER). The best aproach would be the FORWARD LOOKUP ZONES. Right?
Thank you.
Would love to see a video on how to use private endpoint to do backup of Azure vm
Thanks Travis. i am curious if azure dns private resolver would work in a similar scenario where on-premises AD/clients require resolution to private endpoints in azure?
I believe so and have that on a short list for an upcoming video. One thing to note that I found after initial research is that a private resolvers are more expensive then a small VM.
Thanks!
Thank you! Be sure to check out the recent videos on DNS Private Resolver.
Do you have a video dealing with P2S VPN accessing a Azure File Share? I'm in a situation where I just need the individual Windows clients connecting to an AFS via Azure P2S VPN. I have the File Share and P2S VPN setup (Thanks for your video on P2S), but I'm confused what I need in order to facilitate client access to the share over the VPN. I assume I need to spin up a DNS server in Azure and have the VPN configured to use that as it's dns server?
Travis, Is there any kind of script or tool we can add these FQDN without adding these maul process? what about Terraform and BICEP ?
As always Travis your doing a great jobs by clearing confusions around on perm and az dns connectivity. Keep up the great work!
How about the Az Traffic Manger can we integrate to private link or no?
at 9:30, why is it that the second vnet is unable to resolve the file endpoint url? if not private dns zone, the public dns zone should be able to resolve the end point url to the public ip address, right?
Hey, the problem you mention around 10:00, would it still be a problem if the two Vnets were peered ?
+1 on this question. If the VNETs are peered, it would make sense for them to be able to have a route to the private endpoints.
Does the customer DNS DC have to be in the VNET as the PEP?
Great, I have only one question. Can we make conditional forwarding in Windows 10/11? If it cannot be done then Azure VPN Client is useless in Windows 10/11.
What if we have multiple Virtual Machines, who need to access one storage account, using a private endpoint?
How will you configure the Private DNS zone, when multiple Private End Points are connecting different Virtual networks to a single Azure Service (e.g. Azure SQL Server)?
The private DNS explicitly warns us to not integrate multiple endpoints connecting to the same Service.
Great video anyone? Y when our users connect to azure VPN it connects to AD sites instead of Azure DC?
Using a conditional forward to wire server doesn’t really make sense to use. Great video.
DC on premises with S2S VPN is much more challenging.
How can I integrate DNS proxy if I am using AD integrated DNS with proxy which points to the AD DNS hosted on the cloud. Will it cause the loop>
Hi Traviz, I have 20+ subscription to manage and i would like to setup something to monitor the drain mode status of the Session host in the hostpoool in each subscription. Could you point out some setups ?
You seem to have missed out the obvious solution to this which is Private DNS Zones. This gets around the issue with Conditional Forwarders not being able to resolve Private Endpoints in other vNETs.
Manually creating records for FWD Lookup zones isn't a feasible solution.
please d
So this means I need to create multiple Forward Lookup Zones on my DNS?
- privatelink.blob.core.windows.net
- privatelink.file.core.windows.net
- privatelink.queue.windows.net
......
Is that the case? I am trying to find a definitive answer.
@@DylanBerry Yeah unfortunately it is. What is even worth, that some of these zones change and MS also adds new ones.
Yes. This is extremely annoying. Every resource type seems to have its own domain zone as well so we're ending up with an untold number of *manually configured* conditional forwarders on our DNS servers.
Also, since these forwarders are set for the domain used for public endpoints, we're now adding failure points in our dns system. Where we'd be querying Azure public/highly available DNS servers, we're now forcing all this resolution to a private VM we must maintain in the vnet (even to resolve public endpoints for other companies hosting in Azure as well).