Cloud Disaster Recovery Server (CDRS) fails to deploy into existing VNET in Azure due to Firewall restrictions

The CDRS, as part of its deployment, runs a custom script which reaches out to Blob Storage to download the actual CDRS code and then initialize itself. When this traffic is blocked, the CDRS, despite coming up on Cloud and being accessible, is not able to proceed with its part of the deployment.

Evidence from handler.log /var/log/azure/custom-script/handler.log:     

Observe the following 403 error code resulting in failure to download the blobs:      
time=2020-09-17T19:22:44Z version=v2.1.3/git@4cd2b9f-clean operation=enable seq=0 event="creating output directory" path=/var/lib/waagent/custom-script/download/0
time=2020-09-17T19:22:44Z version=v2.1.3/git@4cd2b9f-clean operation=enable seq=0 event="created output directory"
time=2020-09-17T19:22:44Z version=v2.1.3/git@4cd2b9f-clean operation=enable seq=0 files=2
time=2020-09-17T19:22:44Z version=v2.1.3/git@4cd2b9f-clean operation=enable seq=0 file=0 event="download start"
time=2020-09-17T19:22:44Z version=v2.1.3/git@4cd2b9f-clean operation=enable seq=0 file=0 retry=0 error="unexpected status code: actual=403 expected=200"
time=2020-09-17T19:22:44Z version=v2.1.3/git@4cd2b9f-clean operation=enable seq=0 file=0 retry=0 info="downloader download.blobDownload returned 403, skipping retries"
time=2020-09-17T19:22:44Z version=v2.1.3/git@4cd2b9f-clean operation=enable seq=0 file=0 event="download failed" error="failed to download file: unexpected status code: actual=403 expected=200"
time=2020-09-17T19:22:44Z version=v2.1.3/git@4cd2b9f-clean operation=enable seq=0 event="failed to handle" error="processing file downloads failed: failed to download file[0]: failed to download file: unexpected status code: actual=403 expected=200"
Not writing a placeholder status file, already exists: /var/lib/waagent/Microsoft.Azure.Extensions.CustomScript-2.1.3/status/0.status
+ nohup /var/lib/waagent/Microsoft.Azure.Extensions.CustomScript-2.1.3/bin/custom-script-extension enable

System is blocking traffic between the CDRS and Azure. As a result, CDRS cannot download what it needs from Blob Storage during deployment and fails to initialize.

Ensure traffic between the CDRS and Blob storage is not blocked by any Firewall rules. Check that public access is allowed and not restricted.