azureazure-functionsazure-virtual-networksubnet

Function and private storage account networking

I have made my storage account private and only allow access from selected virtual networks or IP addresses.

Since then I cant run my function and it fails with the error 500 internal server error which is not very imformative. Tried to look into Diagnostic Console for more infromative error and I found this: [Error] System.ArgumentOutOfRangeException: Index was out of range. Must be non-negative and less than the size of the collection. Not really helpfull.

Im sure its related to netowkring issue. So I would like to configure Vnet on my function app. Things I tried:

  1. I tried Outbound traffic configuration

enter image description here

  1. Then I tried to choose the virtual network and subnebt where My Private Endpoints of Storage account reside but I have this issue.

enter image description here

  1. To fix the above issues I tried to make the delegation enter image description here

But I get the error saying: Failed to save subnet ERROR: Delegations of subnet "mysubnet name" cannot be chnaged from [] to [Microsoft.Web/serverFarms] because it is being used by the resource pe-kv-nll-dev-we-01.nic.888888889-80c0.......

Then I also tried to add the service endpoint that you see above Microsfot.Web but did not work either.

Any ideas how can I do so? Im new to function apps, maybe I should add the IP address of Storage account to my function app under the Outbound addresses? if so how can I do so?

Solution

  • To resolve your networking issue in the Azure Function App, create the Virtual network with minimum two subnets where One is for inbound and the other is for outbound configuration:

    enter image description here

    Open your Storage Account > Networking >

    enter image description here

    1. Select the Option Enabled from selected virtual networks and IP addresses with subnet 1, add your device internet IP, function app inbound IP, checkmark the exceptions section.

    enter image description here
    enter image description here

    1. In the Function App, Select Networking > Select Outbound VNet Integration to Subnet2, Checkmark the Outbound internet traffic, Content Storage fields in the configuration as shown in the above screenshot.
    2. After you do, you’ll get the delegation registered in the subnet2 like below screenshot:

    enter image description here

    1. In the Function App > Networking > Inbound traffic configuration > Configure the Public Network Access field like below:

    enter image description here

    1. Configure the Service Endpoints of Subnet1:

    enter image description here

    In Simple terms,

    1. Make the one subnet for outbound connectivity and another subnet for inbound traffic to function app, storage account, etc in the Virtual Network.
    2. Subnet1 should has the service endpoints whatever the services are using it and Subnet2 should act as a dedicated outbound to the server farms.
    3. Configure the WEBSITE_VNET_ROUTE_ALL app setting to 1 in the environment variables for the function app.

    Result:
    enter image description here