azureazure-cosmosdbazure-cosmosdb-mongoapiazure-private-link

Cosmos DB for MongoDB private endpoint requests blocked by network firewall

I'm trying to connect to a Cosmos DB for Mongo DB using a private endpoint.

The private endpoint creation succeeeds and is approved. The subnet configuration is working to connect to other resources such as Key Vault, SQL Server and others.

Specifically for CosmosDB, I'm getting a "Request bloked by network firewall" error.

Private Access Configuration:

enter image description here

Public Access Configuration

enter image description here

Changing the Public Access from "Disabled" to "Selected Networks" and adding the same virtual network used in the private endpoint solves the connectivity problem. But it is not possible to leave it like that because of a security policy.

The same error happens when tyring to access the database via Azure Portal, VPN or Azure services in the same network.

I'm a missing any configuration? Is there any other setting that may be conflicting with my private endpoint?

Solution

  • Cosmos DB for MongoDB private endpoint requests blocked by network firewall

    The Request bloked by network firewall is error your encountered via private endpoint is mainly due to Azure Private DNS zone.

    I also encountered the same error when I disabled the Private DNS zone and tried to access the cosmos DB via private endpoint from a VM within the same VNet and subnet.

    enter image description here

    Cosmos DB Network configuration

    enter image description here

    Make sure to enable the Private DNS in the private endpoint configuration. Once enabled, it will automatically create a DNS record and virtual network link

    enter image description here

    Once I enabled the private DNS zone in the private endpoint and created a VM within the same VNet and subnet with Cosmos DB public access disabled, the Cosmos DB connection was successful.

    enter image description here