This article covers common troubleshooting checks for Turbo360 private networking. Run the diagnostic commands below via Kudu > Debug console > CMD on the relevant App Service resource.
Overview
Connectivity failures in a private Turbo360 deployment typically fall into three categories: DNS resolution returning a public IP instead of a private one, a port being blocked by an NSG or firewall rule, and SCM endpoints not resolving through the private endpoint. The checks in this article let you isolate which layer is failing.
Business value
Targeted diagnostic commands reduce mean time to resolution by confirming exactly where connectivity breaks down — DNS, port, or SCM endpoint — without requiring access to Azure network infrastructure logs.
How it works
All commands are run from inside the App Service process via Kudu's debug console. This positions the diagnostic at the same network boundary as the application itself, so results reflect what the app actually sees — not what an external client or Azure portal would see.
Check DNS from App Service to private PaaS resources
Use these commands to verify that Azure PaaS services (database, storage) resolve to their private IP addresses from within the App Service:
:: SQL logical server (expects CNAME → *.privatelink.database.windows.net → private IP)
nameresolver myserver.database.windows.net
:: Storage blob endpoint (expects CNAME → *.privatelink.blob.core.windows.net → private IP)
nameresolver mystorageacct.blob.core.windows.net
:: (Optional) Queue/File/Table if used
nameresolver mystorageacct.queue.core.windows.net
nameresolver mystorageacct.file.core.windows.net
nameresolver mystorageacct.table.core.windows.netPort reachability
Use these commands to verify that the storage account and SQL database are reachable on their expected ports:
:: SQL over 1433
tcpping myserver.database.windows.net 1433
:: Storage over 443
tcpping mystorageacct.blob.core.windows.net 443Check SCM endpoint for web app and function apps
Use this command to verify that the SCM endpoint used for deployment resolves to the private endpoint:
nameresolver myapp.scm.azurewebsites.net
Expect CNAME → *.scm.privatelink.azurewebsites.net → private IP.Slow DNS resolution
If you are using a custom DNS server, ensure you have configured auto-forwarders to forward appropriate queries to Azure DNS. Slow or failing DNS resolution is most commonly caused by a forwarder not being set, or by the forwarder not having a route to 168.63.129.16 (Azure's internal DNS resolver).