Azure 应用服务连接到 Azure Sql 数据库

Question

I have a Web App (Azure App Service) and I have an Azure SQL Database that this Web App talks to. I have two questions regarding communication between the two.

1. When connecting from the Web App to the Database (using the connection string), does the communication go out to the internet and then back into Azure or does Azure know to keep the traffic locally in Azure?

2. I have been looking into V-Net Service Endpoints as a possible way to improve speed of communication between the two. It is said that when connecting from a VM on V-Net with Service Endpoints enabled to a SQL Database, that Azure knows to keep the traffic internal to the Azure network and not go out to the internet, is this the same for Azure App Services?

3. Is it possible to keep traffic between an App Service and SQL Database internal to Azure?
   If so, how do I go about doing this?
   
   Any guidance on this is greatly appreciated.

Answer 1

1. It knows to keep it local on the "Azure backbone" (as per Azure doco). It doesn't go out to the public internet

2. Yes

3. Yes. It is already internal to the "Azure Backbone"

Having said that.... networks are really complicated.

As I understand it the main benefit of V-Net is that you can define your own network and add things to it like firewalls, security groups, subnets, peering between networks. Also it helps when setting up a hybrid network - ie connecting Azure resources to an on-premises network. When you can set up the same kind of structures as on premise, it's easier to 'transparently' make it part of the on-premises network. Lastly (rereading the doco), you can remove any incoming public IP firewall rules. These are "Azure backbone" IP addresses but they are also "public internet" addresses

There may be a performance improvement if the App Service and Azure SQL are on the same V-Net.

Azure SQL service endpoints are a bit mysterious. They "connect" to the VNET but you still need to connect to a public address. They don't actually take a up a local IP adress.

Depending on what you are really doing, you might want to look into private endpoint, which actually assigns a private IP to your Azure SQL.

Answer 2

是的，Azure 应用服务和 Azure SQL 数据库之间的通信是 Azure 虚拟网络中的“本地”通信，不会传到公共 Internet。