How to Establish Connectivity Between Kafka and Azure Event Hub in Cross-Tenant Subscriptions Using Private Endpoints?

Question

I have the following requirements:

Source: Kafka hosted in Azure Subscription ABC, Tenant ABC, and Region East US. Destination: Azure Event Hub configured with a private endpoint in Azure Subscription XYZ, Tenant XYZ, and Region East Asia.

Key Points and Assumptions:

I plan to follow the guidance provided in this Azure article https://learn.microsoft.com/en-us/azure/architecture/networking/guide/cross-tenant-secure-access-private-endpoints. My understanding is that I can establish connectivity between the Kafka instance and the Azure Event Hub using private endpoints without requiring VNet peering or a VPN. Is this assumption correct?

Questions:

Validation of Understanding: Can the private endpoint approach work without VNet peering or VPN? Or are there other configurations I should consider?

Kafka Configuration: What details do I need to configure connectivity from Kafka to the Event Hub? For example, do I need specific DNS settings, IP configurations, or endpoint details?

Verification of Connectivity: Once the private endpoint is set up, how can I validate the connectivity between Kafka and Event Hub at the network level without sending any actual data?

Traffic Routing via Azure Firewall: Instead of directly connecting Kafka to the Event Hub, can I route traffic through an Azure Firewall in Subscription XYZ? If yes, what are the necessary steps to configure the firewall, private endpoint, and other network components in Subscriptions ABC and XYZ?

I am looking for guidance or examples to ensure secure and efficient communication between Kafka and Event Hub in this cross-tenant setup. Any advice or recommendations would be greatly appreciated!

Answer 1

Hi @Sundarakannan M,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

Validation of Understanding: Can the private endpoint approach work without VNet peering or VPN? Or are there other configurations I should consider?

Yes, you are correct. You can establish connectivity between Kafka and Azure Event Hub using private endpoints without requiring VNet peering or a VPN. Private endpoints allow you to securely access Azure services over a private IP address within your virtual network (VNet).What is a private endpoint? - Azure Private Link | Microsoft Learn

Kafka Configuration: What details do I need to configure connectivity from Kafka to the Event Hub? For example, do I need specific DNS settings, IP configurations, or endpoint details?

When setting up the private endpoint for the Event Hub, the IP and DNS configurations are automatically handled.
https://learn.microsoft.com/en-us/azure/event-hubs/private-link-service
https://learn.microsoft.com/en-us/azure/event-hubs/event-hubs-quickstart-kafka-enabled-event-hubs?form=MG0AV3&tabs=passwordless

Note: Please ensure that the virtual network for Kafka is linked within the private DNS zone.
https://learn.microsoft.com/en-us/azure/dns/private-dns-getstarted-portal#link-the-virtual-network

Verification of Connectivity: Once the private endpoint is set up, how can I validate the connectivity between Kafka and Event Hub at the network level without sending any actual data?

Perform the nslookup using the FQDN private endpoint. Once you obtain the private IP, you can proceed to send the data.
Command:
nslookup <FQDN>

Traffic Routing via Azure Firewall: Instead of directly connecting Kafka to the Event Hub, can I route traffic through an Azure Firewall in Subscription XYZ? If yes, what are the necessary steps to configure the firewall, private endpoint, and other network components in Subscriptions ABC and XYZ?

Yes.

Refer this doc for Azure Firewall scenarios to inspect traffic destined to a private endpoint: https://learn.microsoft.com/en-us/azure/private-link/inspect-traffic-with-azure-firewall?form=MG0AV3 https://learn.microsoft.com/en-us/azure/private-link/tutorial-inspect-traffic-azure-firewall?form=MG0AV3

Note: If you want to use the Azure firewall, you'll need to set up VNet peering. https://learn.microsoft.com/en-us/azure/virtual-network/create-peering-different-subscriptions?tabs=create-peering-portal

---

If above is unclear and/or you are unsure about something add a comment below.

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Regards,

Rohith