I’m facing the following issue:

I’m establishing a connection from a local system to a remote Azure SQL database. This connection is running through our firewall and needs to be whitelisted specifically for source and target. This works fine when we whitelist the server IPs, until the server IP changes, which I cannot influence (Azure).

What we’d like to do to prevent the issue, is whitelist the URL instead of the IP in the firewall. But apparently the SQL driver (or whatever part of the system actually establishes the connection) has already resolved the URL into an IP and is using this IP before the connection goes out to the FW. So the Firewall only sees a connection request to an IP, never to a URL.

Other connections do not do this and we can see the target URL here. This issue occurs with different Windows systems and different software establishing the connection (MS SQL Managemt Studio, Tableau). In neither software we’re entering an IP for the connection, always the URL.

Questions:

1. Can anyone pinpoint where the trigger to resolve the URL comes from? I can see in Wireshark that it’s resolved, but is this something that the SQL driver controls?

2. Is this something we could possibly fix with another SQL driver to force the connection via URL?

3. Is this specific to SQL connections in general?

4. Any other ideas to resolve this, maybe force the local DNS server to respond with the URL instead of the IP (ugly, but I don’t know)?

Thanks, David

Tried a wireshark trace.
Tried the connection through multiple tools (MS SQL MS, Tableau) to rule out the tool.