75% requests to arkisit.thereforeonline.com are failing from Azure Container Apps which is routed via Azure HUB PaloAlto Firewall.

Rauno Laakso 0

Requests to arkisit.thereforeonline.com are failing from Azure Container Apps, roughly 75% of the requests are failing. If the request is successful it will be really fast, otherwise it will fail to connection timeout. Running the exactly same requests from the local workstation all request are successfull so the problem shouldn't be in the destination. Traffic is routed from Azure Container Apps to the Palo Alto firewall in Hub subscription.

TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): /tmp #
Recv failure: Connection reset by peer
OpenSSL SSL_read: Connection reset by peer, errno 104
Failed receiving HTTP2 data: 56(Failure when receiving data from the peer)
Connection #0 to host arkisit.thereforeonline.com left intact curl: (56) Recv failure: Connection reset by peer

VenkateshDodda-MSFT 23,141 Reputation points Microsoft Employee

2024-12-13T03:55:38.72+00:00
@Rauno Laakso Thanks for posting your question in Microsoft Q&A, apologize for any inconvenience caused on this.

Could you please help us with more information to understand and assist you better.

On which Azure service this fqdn is hosted "arkisit.thereforeonline.com" and also how the request flow from end-to-end which are the components involved.

Help us with architecture view of what you are trying to do.

Are the request to containers apps are getting failed or the requests beings served by container apps are getting dropped?

From where you have calculated the 75% requests are getting dropped.
Rauno Laakso 0 Reputation points

2024-12-13T06:03:54.9066667+00:00
I have no idea where Canon hosts the arkisit.thereforeonline.com, it might be Azure, AWS or on-prem.

Connection should be like this:

Azure Container App (Spoke vnet – preered against HUB) -> Azure PaloAlto Firewall -> Internet - arkisit.thereforeonline.com (public service)

Azure container App is sending a request to the arkisit.thereforeonline.com. Traffic should be routed to the destination through the Firewall in "Hub subscription".

We are sending the request from Container Apps, we have no idea what resource is serving the arkisit.thereforeonline.com.

This is just a rough calculation based on the user experience when sending the requests manually.
VenkateshDodda-MSFT 23,141 Reputation points Microsoft Employee

2024-12-13T10:12:53.26+00:00

@Rauno Laakso Thanks for sharing more details. This needs one-on-one support and might need to engage engineering team for further deeper investigations. I would suggest you raise a support ticket.

In case if you are facing any issues while raising the support ticket. Please do share the requested information over the private message to assist further on this.
Rauno Laakso 0 Reputation points

2024-12-13T10:54:24.46+00:00

Okei and thanks...

Share via

75% requests to arkisit.thereforeonline.com are failing from Azure Container Apps which is routed via Azure HUB PaloAlto Firewall.

Your answer