This post has been republished via RSS; it originally appeared at: New blog articles in Microsoft Tech Community.
Azure Private Link is a secure and scalable way for Azure customers to consume Azure database for MySQL server service privately from their Azure Virtual Network (VNet). Azure Private Link essentially brings Azure services inside the customer’s private VNet. The MySQL resources can be accessed using the private IP address just like any other resource in the VNet. This significantly simplifies the network configuration by keeping access rules private. You can read more about it here: Introducing Private Link for Azure Database for MySQL.
In this blog post, we will outline detailed steps on how to connect securely from an On-Premise VM to Azure Database for MySQL using Point-to-Site Gateway and Azure Private Link.
A Point-to-Site (P2S) VPN gateway connection lets you create a secure connection to your virtual network from an individual client computer. A P2S connection is established by starting it from the client computer. This solution is useful for telecommuters who want to connect to Azure VNets from a remote location, such as from home or a conference. P2S VPN is also a useful solution to use instead of S2S VPN or ExpressRoute when you have only a few clients that need to connect to a VNet.
Here is the high-level architecture diagram of how this solution works in practice:
User connects from on-premises (over Point-to-Site VPN) by specifying Private IP address for Azure Database for MySQL & port 3306.
Step by step guide to implementing this architecture
We have also created one-click-deployable ARM Templates to provision the Private Endpoints quickly:
Create Azure Virtual Network Gateway for the VNET in which private endpoints exist :
Once the Virtual Network Gateway is created successfully, we will add Point-to-Site configuration:
P2S VPN clients are authenticated using native Azure Certificate Authentication. Instructions to generate and export certificates for Point-to-Site using Powershell are here. You can either generate a self-signed root certificate or use Enterprise CA solution.
Instructions to use self-signed root certificate
1. Create a self-signed root certificate: From a computer running Windows 10 or Windows Server 2016, open a Windows PowerShell console with elevated privileges and run the following command
NOTE: Root certificate name “P2SRootCert” should be provided as input for Root Certificate Name
2. Export the root certificate public key (.cer)
NOTE: The output of the above command should be provided as input for Public Certificate Data.
3. Generate a client certificate: Each client computer that connects to a VNet using Point-to-Site must have a client certificate installed. You generate a client certificate from the self-signed root certificate, and then export and install the client certificate. If the client certificate is not installed, authentication fails.
NOTE: If you wish to connect to VNET using P2S from another client VM, copy paste clientceritifcate.pfx and install it using the password.
Create Point-to-site configuration using the certificate generated above :
Connectivity from On-Premise Client VM
You will need to install the client certificates on the On-Premise Client VM for authenticating the P2S connections
Click on the Virtual Network Gateway and click Point-to-Site Configurations.
Click on Download VPN Client to download the VPN Client Configuration Files.
Once the VPN Client is downloaded, extract the folder and run the following program as Administrator: WindowsAmd64\VpnClientSetupAmd64.exe. (For a 64-bit processor architecture, choose the 'VpnClientSetupAmd64' installer package. For a 32-bit processor architecture, choose the 'VpnClientSetupX86' installer package.)
If you see a SmartScreen popup, click More info, then Run anyway.
Click Yes on the following prompt
On the client computer, navigate to Network Settings and click VPN. The VPN connection shows the name of the virtual network that it connects to. Click Connect.
Select the checkbox and Click Continue
If connected successfully, you will see “Connected” status
Verify connection is successful using mysql command line:
You can find more details in the official documentation. You can give the Azure Private Link a try today. If you have questions, please reach out to the AskAzureDBforMySQL@service.microsoft.com alias.