Tutorial: integrate Functions with an Azure virtual network

This tutorial shows you how to use Azure Functions to connect to resources in an Azure virtual network. you'll create a function that has access to both the internet and to a VM running WordPress in virtual network.

  • Create a function app in the Premium plan
  • Deploy a WordPress site to VM in a virtual network
  • Connect the function app to the virtual network
  • Create a function proxy to access WordPress resources
  • Request a WordPress file from inside the virtual network

Topology

The following diagram shows the architecture of the solution that you create:

UI for virtual network integration

Functions running in the Premium plan have the same hosting capabilities as web apps in Azure App Service, which includes the VNet Integration feature. To learn more about VNet Integration, including troubleshooting and advanced configuration, see Integrate your app with an Azure virtual network.

Prerequisites

For this tutorial, it's important that you understand IP addressing and subnetting. You can start with this article that covers the basics of addressing and subnetting. Many more articles and videos are available online.

If you don’t have an Azure subscription, create a free account before you begin.

Create a function app in a Premium plan

First, you create a function app in the Premium plan. This plan provides serverless scale while supporting virtual network integration.

  1. From the Azure portal menu or the Home page, select Create a resource.

  2. In the New page, select Compute > Function App.

  3. On the Basics page, use the function app settings as specified in the following table:

    Setting Suggested value Description
    Subscription Your subscription The subscription under which this new function app is created.
    Resource Group myResourceGroup Name for the new resource group in which to create your function app.
    Function App name Globally unique name Name that identifies your new function app. Valid characters are a-z (case insensitive), 0-9, and -.
    Publish Code Option to publish code files or a Docker container.
    Runtime stack Preferred language Choose a runtime that supports your favorite function programming language. Choose .NET for C# and F# functions.
    Region Preferred region Choose a region near you or near other services your functions access.

    Basics page

  4. Select Next: Hosting. On the Hosting page, enter the following settings:

    Setting Suggested value Description
    Storage account Globally unique name Create a storage account used by your function app. Storage account names must be between 3 and 24 characters in length and may contain numbers and lowercase letters only. You can also use an existing account, which must meet the storage account requirements.
    Operating system Preferred operating system An operating system is pre-selected for you based on your runtime stack selection, but you can change the setting if necessary.
    Plan Premium Hosting plan that defines how resources are allocated to your function app. Select Premium, and then select the defaults for Windows Plan and Sku and size.

    Hosting page

  5. Select Next: Monitoring. On the Monitoring page, enter the following settings:

    Setting Suggested value Description
    Application Insights Default Creates an Application Insights resource of the same App name in the nearest supported region. By expanding this setting, you can change the New resource name or choose a different Location in an Azure geography to store your data.

    Monitoring page

  6. Select Review + create to review the app configuration selections.

  7. On the Review + create page, review your settings, and then select Create to provision and deploy the function app.

  8. Select the Notifications icon in the upper-right corner of the portal and watch for the Deployment succeeded message.

  9. Select Go to resource to view your new function app. You can also select Pin to dashboard. Pinning makes it easier to return to this function app resource from your dashboard.

    Deployment notification

You can pin the function app to the dashboard by selecting the pin icon in the upper right-hand corner. Pinning makes it easier to return to this function app after you create your VM.

Create a VM inside a virtual network

Next, create a preconfigured VM that runs WordPress inside a virtual network (WordPress LEMP7 Max Performance by Jetware). A WordPress VM is used because of its low cost and convenience. This same scenario works with any resource in a virtual network, such as REST APIs, App Service Environments, and other Azure services.

  1. In the portal, choose + Create a resource on the left navigation pane, in the search field type WordPress LEMP7 Max Performance, and press Enter.

  2. Choose Wordpress LEMP Max Performance in the search results. Select a software plan of Wordpress LEMP Max Performance for CentOS as the Software Plan and select Create.

  3. In the Basics tab, use the VM settings as specified in the table below the image:

    Basics tab for creating a VM

    Setting Suggested value Description
    Subscription Your subscription The subscription under which your resources are created.
    Resource group myResourceGroup Choose myResourceGroup, or the resource group you created with your function app. Using the same resource group for the function app, WordPress VM, and hosting plan makes it easier to clean up resources when you're done with this tutorial.
    Virtual machine name VNET-Wordpress The VM name needs to be unique in the resource group
    Region (Europe) West Europe Choose a region near you or near the functions that access the VM.
    Size B1s Choose Change size and then select the B1s standard image, which has 1 vCPU and 1 GB of memory.
    Authentication type Password To use password authentication, you must also specify a Username, a secure Password, and then Confirm password. For this tutorial, you won't need to sign in to the VM unless you need to troubleshoot.
  4. Choose the Networking tab and under Configure virtual networks select Create new.

  5. In Create virtual network, use the settings in the table below the image:

    Networking tab of create VM

    Setting Suggested value Description
    Name myResourceGroup-vnet You can use the default name generated for your virtual network.
    Address range 10.10.0.0/16 Use a single address range for the virtual network.
    Subnet name Tutorial-Net Name of the subnet.
    Address range (subnet) 10.10.1.0/24 The subnet size defines how many interfaces can be added to the subnet. This subnet is used by the WordPress site. A /24 subnet provides 254 host addresses.
  6. Select OK to create the virtual network.

  7. Back in the Networking tab, choose None for Public IP.

  8. Choose the Management tab, then in Diagnostics storage account, choose the Storage account you created with your function app.

  9. Select Review + create. After validation completes, select Create. The VM create process takes a few minutes. The created VM can only access the virtual network.

  10. After the VM is created, choose Go to resource to view the page for your new VM, then choose Networking under Settings.

  11. Verify that there's no Public IP. Make a note the Private IP, which you use to connect to the VM from your function app.

    Networking settings in the VM

You now have a WordPress site deployed entirely within your virtual network. This site isn't accessible from the public internet.

Connect your function app to the virtual network

With a WordPress site running in a VM in a virtual network, you can now connect your function app to that virtual network.

  1. In your new function app, select Networking in the left menu.

  2. Under VNet Integration, select Click here to configure.

    Choose networking in the function app

  3. On the VNET Integration page, select Add VNet.

    Add the VNet Integration preview

  4. In Network Feature Status, use the settings in the table below the image:

    Define the function app virtual network

    Setting Suggested value Description
    Virtual Network MyResourceGroup-vnet This virtual network is the one you created earlier.
    Subnet Create New Subnet Create a subnet in the virtual network for your function app to use. VNet Integration must be configured to use an empty subnet. It doesn't matter that your functions use a different subnet than your VM. The virtual network automatically routes traffic between the two subnets.
    Subnet name Function-Net Name of the new subnet.
    Virtual network address block 10.10.0.0/16 Choose the same address block used by the WordPress site. You should only have one address block defined.
    Address range 10.10.2.0/24 The subnet size restricts the total number of instances that your Premium plan function app can scale out to. This example uses a /24 subnet with 254 available host addresses. This subnet is over-provisioned, but easy to calculate.
  5. Select OK to add the subnet. Close the VNet Integration and Network Feature Status pages to return to your function app page.

The function app can now access the virtual network where the WordPress site is running. Next, you use Azure Functions Proxies to return a file from the WordPress site.

Create a proxy to access VM resources

With VNet Integration enabled, you can create a proxy in your function app to forward requests to the VM running in the virtual network.

  1. In your function app, select Proxies from the left menu, and then select Add. Use the proxy settings in the table below the image:

    Define the proxy settings

    Setting Suggested value Description
    Name Plant The name can be any value. It's used to identify the proxy.
    Route Template /plant Route that maps to a VM resource.
    Backend URL http://<YOUR_VM_IP>/wp-content/themes/twentyseventeen/assets/images/header.jpg Replace <YOUR_VM_IP> with the IP address of your WordPress VM that you created earlier. This mapping returns a single file from the site.
  2. Select Create to add the proxy to your function app.

Try it out

  1. In your browser, try to access the URL you used as the Backend URL. As expected, the request times out. A timeout occurs because your WordPress site is connected only to your virtual network and not the internet.

  2. Copy the Proxy URL value from your new proxy and paste it into the address bar of your browser. The returned image is from the WordPress site running inside your virtual network.

    Plant image file returned from the WordPress site

Your function app is connected to both the internet and your virtual network. The proxy is receiving a request over the public internet, and then acting as a simple HTTP proxy to forward that request to the connected virtual network. The proxy then relays the response back to you publicly over the internet.

Clean up resources

In the preceding steps, you created Azure resources in a resource group. If you don't expect to need these resources in the future, you can delete them by deleting the resource group.

From the Azure portal menu or Home page, select Resource groups, and on the Resource groups page, select myResourceGroup.

On the myResourceGroup page, make sure that the listed resources are the ones you want to delete.

Select Delete resource group, type myResourceGroup in the text box to confirm, and then select Delete.

Next steps

In this tutorial, the WordPress site serves as an API that is called by using a proxy in the function app. This scenario makes a good tutorial because it's easy to set up and visualize. You could use any other API deployed within a virtual network. You could also have created a function with code that calls APIs deployed within the virtual network. A more realistic scenario is a function that uses data client APIs to call a SQL Server instance deployed in the virtual network.

Functions running in a Premium plan share the same underlying App Service infrastructure as web apps on PremiumV2 plans. All the documentation for web apps in Azure App Service applies to your Premium plan functions.