Splunk Add-on for Microsoft Cloud Services Unable to connect with Azure Private Endpoint over EventHub.

Applicability

Description

Unable to fetch data from Azure EventHub when Private Endpoint enabled via Splunk Add-on for Microsoft Cloud Services 

Investigation

While discussing issue with engineering team they confirmed that Splunk Add-on for Microsoft Cloud Services does not support Private end-point for EventHub integration. 

Resolution

Workaround is use a Virtual Network (VNet) Service Endpoint instead of Private Endpoint for EventHub integration.

A Private Endpoint is a network interface that uses a private IP address from your virtual network to connect privately and securely to an Azure service, effectively bringing the service into your VNet. With a Private Endpoint, the service is accessed via a private IP, and its public endpoint can often be disabled for maximum isolation.

Setting up virtual network service endpoint.

• A Virtual Network (VNet) Service Endpoint extends your Azure virtual network's private address space to Azure platform-as-a-service (PaaS) services, such as Azure Event Hubs.

• When enabled, traffic from your virtual network to the Event Hubs namespace travels directly over the Azure backbone network, bypassing the public internet, even though the Event Hubs service itself still has a public IP address.

• This provides a secure and optimized route for communication within Azure.

To limit access, you need to integrate the virtual network service endpoint for this Event Hubs namespace."

• By integrating a VNet Service Endpoint, you can configure the Event Hubs namespace to only accept connections from specific subnets within your Azure virtual network. This significantly enhances security by restricting access.

IP Firewall Rules within the Event Hubs networking settings further restricting access to a set of IP addresses.

• When you choose Selected networks for public network access on an Event Hubs namespace, you can specify individual IP addresses or IP ranges (CIDR notation) that are allowed to connect.

• This means that in addition to (or instead of, depending on the full configuration) restricting access to specific virtual network subnets via service endpoints, you can also allowlist specific public IP addresses, such as those belonging to your Splunk servers if they are outside the VNet or have specific public egress IPs.