Configure Azure private endpoints for the staging storage account

This article describes how to reach the staging storage account over Azure Private Link so that Forest Recovery backup data never traverses a public Azure Storage endpoint. It applies to Cayosoft Guardian 7.4 and later, when the recovery site is deployed into customer-provided Azure resources.

Configure private endpoints if either of the following is true:

• Your security policy blocks traffic that resolves to a public Azure Storage FQDN, even when the firewall permits egress.
• You want to disable public network access on the staging storage account.

If neither applies, no action is required. Cayosoft Guardian continues to use the public storage endpoint over HTTPS on TCP 443, which is the default behavior.

How a private endpoint works

An Azure private endpoint is a network interface with a private IP address from your virtual network's address space that connects privately to a specific Blob Storage account. Traffic to it stays on the Microsoft backbone network and never traverses the public internet.

Key characteristics:

• A private endpoint is a network interface and always has a private IP address, such as 10.77.88.4.
• You need a separate private endpoint for every virtual network from which you access the storage account.
• The private endpoint must be in the same Azure region and subscription as the virtual network that it serves.

How many private endpoints Forest Recovery needs

Forest Recovery needs two private endpoints for the staging storage account:

Prerequisites

• A staging storage account in the same subscription as the recovery site. See Staging storage account overview.
• A precreated virtual network and subnet in the same region and subscription as the recovery site.
• Network connectivity between the Cayosoft Guardian-side network and Azure, for example a site-to-site VPN or ExpressRoute.
• Permission to create private endpoints, private DNS zones, and virtual network links in the target subscription.

Configure the private endpoints

Step 1: Create the private endpoint for the recovery site virtual network

1. In the Azure portal, open your staging storage account.
2. Select Networking > Private endpoint connections > + Private endpoint.
3. Enter a name and select the same region as the virtual network.
4. For Target sub-resource, select blob.
5. Select the precreated virtual network and subnet that hosts the recovery site.
6. Select Yes for private DNS integration, and select or create the privatelink.blob.core.windows.net private DNS zone.
7. Review and create the private endpoint.

To create the same endpoint with the Azure CLI:

az network private-endpoint create `
  --name <endpoint-name> `
  --resource-group <resource-group> `
  --location <region> `
  --vnet-name <vnet-name> `
  --subnet <subnet-name> `
  --private-connection-resource-id <storage-account-resource-id> `
  --group-id blob `
  --connection-name <connection-name>

If the virtual network is in a different resource group, pass the full subnet resource ID to --subnet and omit --vnet-name.

Step 2: Create the private endpoint for the Cayosoft Guardian-side virtual network

Repeat step 1, selecting the virtual network from which Cayosoft Guardian Server reaches Azure. Both endpoints connect to the same storage account and use the same blob sub-resource.

Step 3: Configure name resolution

Both the recovery site virtual machines and Cayosoft Guardian Server must resolve the storage account FQDN to the private IP address.

1. Create the privatelink.blob.core.windows.net private DNS zone, if you did not create it while creating the first private endpoint:

   Copy

   az network private-dns zone create `
     --resource-group <resource-group> `
     --name "privatelink.blob.core.windows.net"

2. Link the zone to each virtual network that uses a private endpoint:

   Copy

   az network private-dns link vnet create `
     --resource-group <resource-group> `
     --zone-name "privatelink.blob.core.windows.net" `
     --name <link-name> `
     --virtual-network <vnet-resource-id> `
     --registration-enabled false

3. For on-premises resolution, forward privatelink.blob.core.windows.net to an Azure DNS Private Resolver or another DNS forwarder in Azure. Learn more in What is Azure DNS Private Resolver.

Step 4: Verify name resolution

From a machine in each network, resolve the storage account FQDN. The answer must be a private IP address:

nslookup <storage-account>.blob.core.windows.net

Expected output:

Non-authoritative answer:
Name:    <storage-account>.privatelink.blob.core.windows.net
Address: 10.77.88.4
Aliases: <storage-account>.blob.core.windows.net

If the answer is a public IP address, name resolution is not routed through the private DNS zone. Do not disable public network access until resolution is correct.

Step 5: Disable public network access

After both private endpoints resolve correctly from both networks:

1. In the Azure portal, open the staging storage account.
2. Select Networking > Firewalls and virtual networks.
3. Set Public network access to Disabled.
4. Save the change.

Step 6: Deploy the recovery site

Deploy the recovery site with Use precreated resources selected, and select this storage account. Cayosoft Guardian checks that the storage account is accessible before deployment begins. See Deploy Forest Recovery to customer-provided Azure resources.

IMPORTANT    The private endpoints belong to your storage account, not to a recovery site. Deleting a recovery site does not delete them, and you do not need to recreate them for each recovery. They exist until you delete the storage account, which removes its private endpoints with it.

Related articles

• Staging storage account overview
• Deploy Forest Recovery to customer-provided Azure resources
• Troubleshoot private connectivity for the staging storage account
• Permissions for Forest Recovery in Cayosoft Guardian