Azure Application Gateways do not resolve Private Endpoints of Keyvault via custom DNS servers

Question

Hi,

We've hit the same issue that @Cat Mucius faced in this thread: https://learn.microsoft.com/en-us/answers/questions/714888/azure-application-gateways-do-not-resolve-private.html but for key vault.

Specifically the Application Gateway doesn't resolve the Private Endpoint of the Key Vault using the custom DNS configured for the VNET but uses the Azure DNS, which causes it to attempt to connect towards the public endpoint and failing to do so since it's blocked.

The error ERR_SSL_UNRECOGNIZED_NAME_ALERT points to this document, which does not cover this specific issue because Application Gateway Health remains green: https://learn.microsoft.com/en-us/azure/application-gateway/disabled-listeners

After internal analysis we opened a ticket with Microsoft and the amazing support agent identified the issue and provided us the solution in the form of attaching the Private DNS zone to the VNET in which the Application Gateway is deployed, but that's a workaround.

As the previous issue concerning the Storage Accounts has been provided a permanent fix by @Jack Stromberg I'm opening a new thread asking whether there is a permanent fix planned for the Key vault as well.

Answer 1

If Key Vault is being used as a backend target (part of your backend pool), specify the <yourvault>.privatelink.vaultcore.azure.net address as the fqdn for the backend target. Within your corresponding backend HTTP Setting, configure Override with new host name with the value of yes and check Override with specific domain name for Host name override. For the hostname to override, use the FQDN provided by keyvault (i.e. <yourvault>.vault.azure.net).

If Key Vault is being referenced via private endpoint for a listener, you must associate the private dns zone to the virtual network. I will work on clarifying these items via our docs.

Hope this helps!
Jack

Answer 2

Hi,

I have exactly the same problem as Sergio Padure.

The 2 solutions are :

• In keyvault firewall, you use service endpoint with appgw subnet
• You attach private zone to vnet spoke where appgw exist...

I don't try to create a listener to redirect to the keyvault as mentionned Jack but if you are severals keyvault, you dont create X listener.

is there a permanent fix planned for the Key vault ?

Thank you

Answer 3

We are currently in contact with Microsoft support as we have exactly the same issue. Application gateway is resolving public addresses for privatized services. In our case the services are primarily WebApps.

I have just double checked, the agw is in the same vnet as all the privatelink dns zones as well as our dns forwarders/server. The ip addresses of those dns servers are configured on all the vnets as custom dns servers.

The faulty resolution comes and goes as for now and interrupts access to web sites at least once a for approx 30min.

If there is anyone with an idea, I would really be interested.

g,

chris