Check if network connectivity for Azure Connected Machine Agent is blocked - Azure Arc
Tags: azure
Published: 2024-01-25 13:54:28

 ![Check if network connectivity for Azure Connected Machine Agent is blocked - Azure Arc](https://www.techielass.com/content/images/2024/01/Check-if-network-connectivity-for-Azure-Connected-Machine-Agent-is-blocked---Azure-Arc.png)

To onboard a server to [<u>Azure Arc</u>](https://www.techielass.com/tag/azure-arc) and utilise its capabilities you need to install the Azure Connected Machine agent.  

The Azure Connected Machine agent communicates from your non-Azure environment to Azure using several URLs.  For more information on those URLs please refer to the [<u>official documentation</u>](https://learn.microsoft.com/azure/azure-arc/servers/network-requirements?tabs=azure-cloud&ref=techielass.com#urls).

If outbound connectivity from your environment is restricted by your firewall or proxy server, you need to ensure that the correct URLs are not blocked. 

At the very minimum, the agent needs to be able to communicate with URLs such as: 

- \*.guestconfiguration.azure.com (Extension management and guest configuration services)
- \*his.arc.azure.com (Metadata and Hybrid Identity Service)
- login.microsoftonline.com (Microsoft Entra ID)
- login.windows.net (Microsoft Entra ID)
- pas.windows.net (Microsoft Entra ID)
- management.azure.com (Azure Resource Manager)

To check if network connectivity for the Azure Connected Machine agent is blocked you can use the [<u>azcmagent CLI tool</u>](https://learn.microsoft.com/azure/azure-arc/servers/azcmagent?ref=techielass.com).

The azcmagent CLI is installed with the Azure Connected Machine agent and controls actions specific to the server where it's running.

One of the switches available with the azcmagent is _check_.   This runs a series of network connectivity checks to see if the agent can successfully communicate with required network endpoints. 

## Check Azure Arc connectivity using public endpoints

To use the azcmagent CLI tool log onto a server that has the Azure Connected Machine agent installed on it. 

Launch a command prompt or PowerShell terminal window. 

Type in

```
azcmagent check --location “ukwest”

```

The command outputs a table showing connectivity test results for each required endpoint.  In this example, all URLs are reachable and are going directly to the URLs. 

![Check if network connectivity for Azure Connected Machine Agent is blocked - Azure Arc](https://lh7-us.googleusercontent.com/LBOOPQlkKL0Wpojf25gi7fNMTx03P-r5azgxSN_emFeFatDNNOrr7tH0C6roVYkBzrD_s-MFtBIP3ACh9NDbxGqEICPdhcamtR09NPeHM-9LdIc809XuRBbYgetnnhWkbRMYRV0NvJrYC_vemZakU4o)
_Azcmagent check output_

💡

If you are using a different Azure region, ensure you input the correct name for your region. If you are unsure of the region name you can run the command _az account list-locations -o table_ from Azure CLI to get a list. 

## Check Azure Arc connectivity using private endpoints

If you are using private endpoints for connectivity you can use the following command to check:

```
azcmagent check --location "useast" --enable-pls-check

```

💡

If you are using a different Azure region, ensure you input the correct name for your region. If you are unsure of the region name you can run the command _az account list-locations -o table_ from Azure CLI to get a list. 

## Check Azure Arc connectivity using a proxy

If you are using a proxy to route traffic the command you would check network connectivity is the same as if you are using public endpoints. 

```
azcmagent check –location “westeurope”

```

![Check if network connectivity for Azure Connected Machine Agent is blocked - Azure Arc](https://lh7-us.googleusercontent.com/LgsNY4w95IyFNDiYEthp4MPIuZCm7_ImiNF6WANYfOKUlH4boKt4MY4DEgi_O7UnojAVSczxCYIkNo-1nfFRMa3lzo-axz0hGGCFbmQn5ATuFMQgWxdGg9U3qBiIqTY8_OwM4vvOsib6RZRLiBGjfmE)
_azcmagent output_

In this example, you can see from the table the traffic is going through a proxy server and some of the URLs are unreachable. 

## Conclusion

In conclusion, ensuring seamless connectivity for the Azure Connected Machine agent is crucial for a successful onboarding process to Azure Arc. 

This involves verifying the accessibility of specific URLs through either public or private endpoints, with additional considerations for environments employing proxy servers. 

Utilizing the azcmagent CLI tool provides a straightforward means to conduct network connectivity checks, allowing users to address any potential restrictions or blockages, and ensuring a smooth integration of servers into the Azure Arc ecosystem.