Configure Azure Private Link for Air Gap Protect storage

Use Azure Private Link to enable private connectivity between your environment and an Azure Blob Storage account used for Air Gap Protect.

Requirements and considerations

Network connectivity

• Your on-premises environment must be connected to Azure using ExpressRoute.

• The connection must support expected workload performance.

DNS configuration

• Configure DNS so that the storage account endpoint resolves to the private endpoint IP address.

• If you use custom DNS servers, configure forwarding for Azure private link zones.

Private endpoint configuration

• The private endpoint must be deployed in a subnet reachable from your on-premises network.

• The subnet must allow private endpoint deployment.

Access and permissions

• You must have permissions to create private endpoints and manage network configuration.

• Storage account access must allow connections through the private endpoint.

Network policies

For the subnet hosting the private endpoint, disable:

• privateLinkServiceNetworkPolicies

• privateEndpointNetworkPolicies

Create a private endpoint

To create a private endpoint:

1. Log on to https://support.commvault.com and request a storage resource ID.

2. In Azure, create a private endpoint using the storage resource ID.

   For information about creating a private endpoint, see Azure documentation.

Request endpoint approval

1. Contact Commvault Support.

2. Provide the name of the private endpoint.

3. Wait for approval confirmation.

Configure DNS

1. To identify the storage account name, go to Manage > Air Gap Protect and select the storage.

2. Update your DNS server to resolve the storage account endpoint to the private endpoint IP address.

Validate connectivity

1. From a VM in your network, verify DNS resolution.

   The storage account endpoint resolves to a private IP address.

2. Access the storage account.

3. Confirm:

   • Data transfer succeeds.

   • Traffic flows through the private endpoint.