Skip to main content

Connecting Striim Cloud on Azure to data services behind Striim Forwarding Agent

Note

This topic applies only to Striim Cloud on Azure (Enterprise and Mission Critical).

If you run a Striim Forwarding Agent on-premises to push data to Striim Cloud, you can also secure its connection via Private Link Service. In this case the agent initiates the connection (egress from your network), so no inbound firewall rules are needed. Private Link enforces a one-way connection from your agent to Striim Cloud.

azure-04-striim-fwding-agent.png

For more information on the Striim Forwarding Agent, see the Using the Forwarding Agent and Striim Forwarding Agent installation and configuration topics.

Prerequisites

Before proceeding with the setup, ensure the following requirements are met:

  1. An Azure subscription with a VNet (at least two subnets) in the same region as your Striim Cloud service.

  2. A Site-to-Site VPN or ExpressRoute between your network and the Azure VNet.

  3. The agent must be able to reach the Azure VNet on TCP ports 30000, 30002, 30003, and 30010-30200.

  4. Admin rights to create resources in the Azure subscription.

  5. Your Striim Cloud instance running in the same region as the Azure VNet.

Setting up Azure Private Link for the Striim forwarding agent

Performing these steps ensures that your Striim forwarding agent securely connects to Striim Cloud over Azure Private Link, eliminating exposure to the public internet while maintaining a private, secure, and scalable connection.

Provision Private Link access from the Striim Cloud console

You can provision the Private Link Service for your service directly from the Striim Cloud console. No support ticket is required.

  1. Log in to your Striim Cloud account and open the service you want to connect the agent to.

  2. Navigate to the Secure Connection tab, then select the Service Attachments tab.

  3. Click Create Service Attachment and enter your Azure Subscription ID. Connection requests originating from this subscription are whitelisted for automatic approval.

    • Example Azure Subscription ID: 123456h9-78a2-9012-3bca-45bcde67fgh8

  4. Allow a few minutes for the Private Link Service to be provisioned. When provisioning is complete, the service attachment and its connection details are displayed in the Service Attachments tab, and an email notification containing the connection details, including the Private Link Service (PLS) alias, is sent to you.

    • Example PLS alias: identifier-1234-psc.5abc56d7-defg-8h90-1a23-4abcdefghij567h8.eastus2.azure.privatelinkservice

Create a private endpoint in Azure

  1. Log in to the Azure Portal.

  2. Search for "Private Endpoints" and choose Create.

  3. Configure the basic settings:

    • Subscription: Choose the subscription associated with the site-to-site VPN vNet. This must be the subscription you provided when creating the service attachment.

    • Resource Group: Select an existing resource group or create a new one.

    • Name: Assign a meaningful name to the private endpoint.

    • Network Interface Name: Leave as default.

    • Region: Select the region matching the site-to-site VPN vNet.

    • Click Next: Resource.

      networking_azure_fwd_agent1.png

  4. Configure the resource settings

    • Connection Method: Select "Connect to an Azure resource by resource ID or alias".

    • Enter PLS Alias: Use the PLS alias from the service attachment details in the Striim Cloud console or the email notification.

    • Request Message: Optionally, add a note identifying the connection. Because your subscription is whitelisted, the request is approved automatically and no manual review is required.

    • Click Next: Virtual Network.

      networking_azure_fwd_agent2.png

  5. Configure the virtual network settings:

    • Virtual Network: Choose the vNet configured for this setup.

    • Subnet: Select a subnet within the vNet.

    • Private IP Configuration: Leave as default (dynamic allocation).

    • Click Next: DNS.

      networking_azure_fwd_agent3.png

  6. Configure the DNS settings:

    • Leave as default (no DNS settings are required for this setup).

    • Click Next: Tags (optional: add tags for resource management).

    • Click Next: Review + Create.

    • Click Create to deploy the private endpoint.

  7. Verify that the connection is established. The endpoint connection request is accepted automatically by Striim. In the Striim Cloud console, check the Endpoint Connections table on the Service Attachments tab. When the endpoint shows an Accepted status, the service is ready for agent connectivity.

Retrieve the private IP address for the Striim forwarding agent

Once the private endpoint is successfully created, perform the following steps:

  1. Navigate to the Private Endpoints section in Azure.

  2. Select the newly created private endpoint.

  3. Under Settings, choose DNS Configuration.

  4. Locate the Private IP Address assigned to the private endpoint.

  5. Use this Private IP Address in the Striim Forwarding Agent configuration.

    networking_azure_fwd_agent4.png