azure-functionsazure-virtual-networkazure-redis-cache

Azure Function Running in VNet Unable to Connect to Whitelisted Azure Redis Cache

I have an Azure Function that is running in a VNet within a single subnet. I've also set up an Azure Redis Cache that is publicly accessible. Initially, the Azure Function was able to communicate with the Redis Cache without any issues. However, for security purposes, I whitelisted the outbound IPs of the Azure Function in redis cache. Since then, I've been encountering a timeout issue.

Outbound Ip's of Azure function. Function App -> Properties enter image description here

Subnet information (I don't have any security groups or route tables): enter image description here

    Method: PutKeysAsync error while inserting key: key and value: akhil, Error: The message timed out in the backlog attempting to send because no connection became available (5000ms) - Last Connection Exception: It was not possible to connect to the redis server(s). ConnectTimeout, command=SET, timeout: 5000, inst: 0, qu: 0, qs: 0, aw: False, bw: CheckingForTimeout, rs: NotStarted, ws: Initializing, in: 0, last-in: 0, cur-in: 0, sync-ops: 0, async-ops: 4, serverEndpoint: test-pr-analyzer-redis-cache.redis.cache.windows.net:6380, conn-sec: n/a, aoc: 0, mc: 1/1/0, mgr: 10 of 10 available, clientName: pd1sdwk001NH9(SE.Redis-v2.8.0.27420), IOCP: (Busy=0,Free=1000,Min=1,Max=1000), WORKER: (Busy=2,Free=32765,Min=1,Max=32767), POOL: (Threads=5,QueuedItems=0,CompletedItems=4712,Timers=12), v:

2.8.0.27420 (Please take a look at this article for some common client-side issues that can cause timeouts: https://stackexchange.github.io/StackExchange.Redis/Timeout

Please help me in fixing the issue.

Thanks in advance

Solution

  • Azure Function Running in VNet Unable to Connect to Whitelisted Azure Redis Cache.

    Below are the reasons why the Function App may not be accessing the Redis cache.

    1. If you do not add all Function App outbound IP addresses to the Redis cache firewall, it won't connect.
    2. If you are using a Consumption plan or a Premium plan, the outbound IP address can change at any time due to autoscaling behaviour. refer the MS Doc for more details

    To resolve the issue permanently, ensure you use a virtual network NAT gateway to route traffic from your Function App subnet to the Redis cache. Follow the steps below to establish the connection using the NAT Gateway.

    1. Create a Vnet and Subnet (In your case, you already created Vnet and Subnets).
    2. Create a Public IP.
    3. Create a NAT Gateway with same VNet and Subnet, and select previously created Public IP at Outbound IP Section.

    enter image description here

    Once you have created the NAT gateway, the outbound traffic will go through the NAT gateway's IP address. To establish the connection between the Azure Function App and the Redis Cache, ensure that you add the public IP address associated with the NAT gateway in Redis Cache firewall.

    NAT Gateway Details

    enter image description here

    Redis Cache Firewall Settings

    enter image description here

    After adding the public IP address to the Redis cache Firewall, the Function App is able to communicate with the Redis Cache.

    enter image description here

    Redis Cache result

    enter image description here

    Reference: Azure Functions networking options]

    Control Azure Functions outbound IP with an Azure virtual network NAT gateway