Edit

Share via

Required outbound network rules

  • Article

The Azure Managed Instance for Apache Cassandra service requires certain network rules to properly manage the service. By ensuring you have the proper rules exposed, you can keep your service secure and prevent operational issues.

Warning

We recommend exercising caution when applying changes to firewall rules for an existing cluster. For example, if rules are not applied correctly, they might not be applied to existing connections, so it may appear that firewall changes have not caused any problems. However, automatic updates of the Cassandra Managed Instance nodes may subsequently fail. We recommend monitoring connectivity after any major firewall updates for some time to ensure there are no issues.

Virtual network service tags

Tip

If you use VPN then you don't need to open any other connection.

If you're using Azure Firewall to restrict outbound access, we highly recommend using virtual network service tags. The tags in the table are required to make Azure SQL Managed Instance for Apache Cassandra function properly.

Destination Service Tag Protocol Port Use
Storage HTTPS 443 Required for secure communication between the nodes and Azure Storage for Control Plane communication and configuration.
AzureKeyVault HTTPS 443 Required for secure communication between the nodes and Azure Key Vault. Certificates and keys are used to secure communication inside the cluster.
EventHub HTTPS 443 Required to forward logs to Azure
AzureMonitor HTTPS 443 Required to forward metrics to Azure
AzureActiveDirectory HTTPS 443 Required for Microsoft Entra authentication.
AzureResourceManager HTTPS 443 Required to gather information about and manage Cassandra nodes (for example, reboot)
AzureFrontDoor.Firstparty HTTPS 443 Required for logging operations.
GuestAndHybridManagement HTTPS 443 Required to gather information about and manage Cassandra nodes (for example, reboot)
ApiManagement HTTPS 443 Required to gather information about and manage Cassandra nodes (for example, reboot)

Note

In addition to the tags table, you will also need to add the following address prefixes, as a service tag does not exist for the relevant service: 104.40.0.0/13 13.104.0.0/14 40.64.0.0/10

User-defined routes

If you're using a non-Microsoft Firewall to restrict outbound access, we highly recommend configuring user-defined routes (UDRs) for Microsoft address prefixes, rather than attempting to allow connectivity through your own Firewall. See sample bash script to add the required address prefixes in user-defined routes.

Azure Global required network rules

The required network rules and IP address dependencies are:

Destination Endpoint Protocol Port Use
snovap<region>.blob.core.windows.net:443
Or
ServiceTag - Azure Storage		 HTTPS 443 Required for secure communication between the nodes and Azure Storage for Control Plane communication and configuration.
*.store.core.windows.net:443
Or
ServiceTag - Azure Storage		 HTTPS 443 Required for secure communication between the nodes and Azure Storage for Control Plane communication and configuration.
*.blob.core.windows.net:443
Or
ServiceTag - Azure Storage		 HTTPS 443 Required for secure communication between the nodes and Azure Storage to store backups. Backup feature is being revised and a pattern for storage name follows by GA
vmc-p-<region>.vault.azure.net:443
Or
ServiceTag - Azure KeyVault		 HTTPS 443 Required for secure communication between the nodes and Azure Key Vault. Certificates and keys are used to secure communication inside the cluster.
management.azure.com:443
Or
ServiceTag - Azure Virtual Machine Scale Sets/Azure Management API		 HTTPS 443 Required to gather information about and manage Cassandra nodes (for example, reboot)
*.servicebus.windows.net:443
Or
ServiceTag - Azure EventHub		 HTTPS 443 Required to forward logs to Azure
jarvis-west.dc.ad.msft.net:443
Or
ServiceTag - Azure Monitor		 HTTPS 443 Required to forward metrics Azure
login.microsoftonline.com:443
Or
ServiceTag - Microsoft Entra ID		 HTTPS 443 Required for Microsoft Entra authentication.
packages.microsoft.com HTTPS 443 Required for updates to Azure security scanner definition and signatures
azure.microsoft.com HTTPS 443 Required to get information about virtual machine scale sets
<region>-dsms.dsms.core.windows.net HTTPS 443 Certificate for logging
gcs.prod.monitoring.core.windows.net HTTPS 443 Logging endpoint needed for logging
global.prod.microsoftmetrics.com HTTPS 443 Needed for metrics
shavsalinuxscanpkg.blob.core.windows.net HTTPS 443 Needed to download/update security scanner
crl.microsoft.com HTTPS 443 Needed to access public Microsoft certificates
global-dsms.dsms.core.windows.net HTTPS 443 Needed to access public Microsoft certificates

DNS access

The system uses DNS names to reach the Azure services described in this article so that it can use load balancers. Therefore, the virtual network must run a DNS server that can resolve those addresses. The virtual machines in the virtual network honor the name server that is communicated through the DHCP protocol. In most cases, Azure automatically sets up a DNS server for the virtual network. If this doesn't occur in your scenario, the DNS names that are described in this article are a good guide to get started.

Internal port usage

The following ports are only accessible within the virtual network (or peered vnets./express routes). Azure Managed Instances for Apache Cassandra don't have a public IP and shouldn't be made accessible on the Internet.

Port Use
8443 Internal
9443 Internal
7001 Gossip - Used by Cassandra nodes to talk to each other
9042 Cassandra -Used by clients to connect to Cassandra
7199 Internal

Next steps

In this article, you learned about network rules to properly manage the service. Learn more about Azure SQL Managed Instance for Apache Cassandra with the following articles: