Error Message

Cause of this issue

Resolution/Workaround

“VNet not found”

This error can occur if The specified VNet entity could not be found in the topology

To resolve this error:

Check if the Sync was triggered for the subscription and is SUCCESSFUL

Check if VNet is deleted.

"VNet is in different subscription (%s) than storage account (%s)."

This error can occur if the VNet is in a different subscription than the storage account (cross-subscription VNets).

Select a VNet configured in the same Azure subscription as your storage account.

"VNet is in different region (%s) than storage account (%s)."

This error can occur if the VNet is in a different region than the storage account.

Select a VNet configured in the same region as your storage account.

"Subnet name %s is reserved"

This error can occur if the selected subnet name is a reserved Azure subnet name (e.g., GatewaySubnet, AzureFirewallSubnet).

"Microsoft.Storage service endpoint provisioning state is %s."

This error can occur if the provisioning state of the Microsoft.Storage service endpoint on the subnet is not "Succeeded."

"Subnet has only %d available IPs. Use a larger subnet for better capacity."

This error can occur if the subnet has fewer IPs than MinAvailableIPsWarningThreshold (e.g., 10)

To resolve this error, use a subnet with higher capacity.

"Selected VNet/subnet not found in storage account firewall rules."

This error can occur if the selected VNet/subnet is not present in the storage account's firewall rules.

To resolve this error, select the VNets which are allowed in the storage accounts.

"Private endpoint connection state is %s. Approve the private endpoint connection in Azure portal."

This error can occur if the private endpoint connection state is not "Approved".

“Cross-region private endpoint detected.”

This error can occur if the private endpoint's VNet is in a different region than the storage account (cross-region PE).

"Private subnet. Attach a NAT Gateway for outbound connectivity."

This error can occur if the subnet is identified as a private subnet, and a NAT Gateway is not verified to be attached (warning for PE approach).

"Private endpoint target sub-resource is '%s' but workload type is '%s'."

This error can occur if the private endpoint's target sub-resource does not match the expected sub-resource for the given workload type.

To resolve this error, select the correct private endpoint.

Outbound traffic blocked by NSG. OUTBOUND CONNECTIVITY

This error can occur if the NSG has a security rule that explicitly denies outbound traffic to the "Internet" destination address prefix.

To resolve this error, reduce the priority of this rule and open port 443.

Outbound traffic blocked by NSG. OUTBOUND CONNECTIVITY

This error can occur if the NSG has a security rule that denies all outbound traffic (* protocol, * port, * destination).

To resolve this error add exception to this rule by allowing port 443 traffic.

Outbound traffic blocked by NSG.

This error can occur if the NSG allows outbound port 443 only to a specific Azure service tag (e.g., "Storage") but denies general Internet access.

Only restricted service are allowed to bypass the port 443. Ensure that you have allowed all the necessary URLs. Learn More.

Outbound traffic blocked by NSG.

This error can occur if the NSG has a security rule that explicitly denies outbound TCP/443 traffic to the Internet or a wildcard destination.

To resolve this error, allow outbound access from Port 443.

Azure Firewall '%s' detected in VNet.

This error can occur if an Azure Firewall is detected in the VNet, and its policy blocks outbound port 443.

To resolve this error remove port 443 from the block list of the firewall attached to the VNet.

Hub firewall is blocking traffic.

This error can occur if Hub-spoke topology is detected, and the Azure Firewall in the hub VNet blocks outbound port 443.

To resolve this error, enable Port 443 in the Azure firewall.

Private subnet without NAT Gateway.

This error can occur if the subnet is a private subnet and does not have a NAT Gateway attached, preventing outbound internet access.

To resolve this error, attach NAT Gateway to enable communication with Druva services.

Subnet delegated to incompatible service.

This error can occur if the subnet is delegated to an incompatible service, preventing deployment of Druva Quantum Bridge VMs.

To resolve this error, select a different subnet.

"NSG on subnet has outbound Deny rule (priority) blocking port 443.

Druva Quantum Bridge VMs require outbound HTTPS (port 443). Add an Allow rule for port 443/TCP with higher priority.

This error can occur if outbound access from Port 443 is denied.

To resolve this error, remove Port 443 from the outbound deny rule.