{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-389-trace-the-azure-source-address-requirement-when-rhel-updates-fail-through-a/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-389-trace-the-azure-source-address-requirement-when-rhel-updates-fail-through-a/", "slug": "dse-20260909-389-trace-the-azure-source-address-requirement-when-rhel-updates-fail-through-a", "url": "https://update.dsesecurity.com/updates/dse-20260909-389-trace-the-azure-source-address-requirement-when-rhel-updates-fail-through-a/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-389-trace-the-azure-source-address-requirement-when-rhel-updates-fail-through-a.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-389-trace-the-azure-source-address-requirement-when-rhel-updates-fail-through-a/" }, "title": "Trace the Azure source-address requirement when RHEL updates fail through a central proxy", "summary": "Why might a RHEL VM reach the internet through an on-premises proxy but still fail to reach Azure RHUI?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:25:27+00:00", "modified_at": "2026-09-10T02:01:56+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 240, "potentially_affected": "RHEL PAYG VMs using Azure-hosted Red Hat Update Infrastructure with centralized outbound traffic.", "dse_recommendation": "Review the update traffic's actual egress path before changing repositories or disabling validation.", "primary_source": { "name": "Red Hat Update Infrastructure - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/workloads/redhat/redhat-rhui", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Azure-hosted RHUI restricts access to VMs in Azure datacenter IP ranges. Microsoft warns that sending all VM traffic through an on-premises proxy may require user-defined routes for RHUI, covering every RHUI address. RHEL PAYG images are configured for this update infrastructure; golden BYOS images instead need Subscription Manager or Satellite. These are different update-source arrangements, not interchangeable troubleshooting defaults. Microsoft Learn.

\n

Applicability

\n

Use this check when a RHEL PAYG VM’s repository requests fail after an egress or proxy change. Confirm the actual image and repository configuration before treating the problem as an Azure RHUI connectivity incident.

\n

DSE recommendation

\n

Review the update traffic’s actual egress path before changing repositories or disabling validation. Ask the network owner to trace where the request leaves the environment and compare the routing and filtering configuration with the current official endpoint list. Have the Linux owner confirm which update source the VM is intended to use. Review any route change through normal network controls.

\n

Verification

\n

From a representative affected VM, test the configured repository path after the approved change and inspect the resulting package-manager evidence. Confirm that all required RHUI destinations are covered, not just the address that happened to answer one test. Record the effective route and sanitized outcome without repository credentials. Leave the issue open if ordinary web access succeeds but the intended update operation still fails.

\n

Official references

\n

Microsoft Learn: Red Hat Update Infrastructure for Azure RHEL VMs. Source reviewed September 9, 2026.

", "content_text": "Source facts\nAzure-hosted RHUI restricts access to VMs in Azure datacenter IP ranges. Microsoft warns that sending all VM traffic through an on-premises proxy may require user-defined routes for RHUI, covering every RHUI address. RHEL PAYG images are configured for this update infrastructure; golden BYOS images instead need Subscription Manager or Satellite. These are different update-source arrangements, not interchangeable troubleshooting defaults. Microsoft Learn.\nApplicability\nUse this check when a RHEL PAYG VM’s repository requests fail after an egress or proxy change. Confirm the actual image and repository configuration before treating the problem as an Azure RHUI connectivity incident.\nDSE recommendation\nReview the update traffic’s actual egress path before changing repositories or disabling validation. Ask the network owner to trace where the request leaves the environment and compare the routing and filtering configuration with the current official endpoint list. Have the Linux owner confirm which update source the VM is intended to use. Review any route change through normal network controls.\nVerification\nFrom a representative affected VM, test the configured repository path after the approved change and inspect the resulting package-manager evidence. Confirm that all required RHUI destinations are covered, not just the address that happened to answer one test. Record the effective route and sanitized outcome without repository credentials. Leave the issue open if ordinary web access succeeds but the intended update operation still fails.\nOfficial references\nMicrosoft Learn: Red Hat Update Infrastructure for Azure RHEL VMs. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nAzure-hosted RHUI restricts access to VMs in Azure datacenter IP ranges. Microsoft warns that sending all VM traffic through an on-premises proxy may require user-defined routes for RHUI, covering every RHUI address. RHEL PAYG images are configured for this update infrastructure; golden BYOS images instead need Subscription Manager or Satellite. These are different update-source arrangements, not interchangeable troubleshooting defaults. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/workloads/redhat/redhat-rhui).\n\n## Applicability\n\nUse this check when a RHEL PAYG VM’s repository requests fail after an egress or proxy change. Confirm the actual image and repository configuration before treating the problem as an Azure RHUI connectivity incident.\n\n## DSE recommendation\n\nReview the update traffic’s actual egress path before changing repositories or disabling validation. Ask the network owner to trace where the request leaves the environment and compare the routing and filtering configuration with the current official endpoint list. Have the Linux owner confirm which update source the VM is intended to use. Review any route change through normal network controls.\n\n## Verification\n\nFrom a representative affected VM, test the configured repository path after the approved change and inspect the resulting package-manager evidence. Confirm that all required RHUI destinations are covered, not just the address that happened to answer one test. Record the effective route and sanitized outcome without repository credentials. Leave the issue open if ordinary web access succeeds but the intended update operation still fails.\n\n## Official references\n\n[Microsoft Learn: Red Hat Update Infrastructure for Azure RHEL VMs](https://learn.microsoft.com/en-us/azure/virtual-machines/workloads/redhat/redhat-rhui). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-389-trace-the-azure-source-address-requirement-when-rhel-updates-fail-through-a/", "url": "https://update.dsesecurity.com/updates/dse-20260909-389-trace-the-azure-source-address-requirement-when-rhel-updates-fail-through-a/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-389-trace-the-azure-source-address-requirement-when-rhel-updates-fail-through-a/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Trace the Azure source-address requirement when RHEL updates fail through a central proxy", "item": "https://update.dsesecurity.com/updates/dse-20260909-389-trace-the-azure-source-address-requirement-when-rhel-updates-fail-through-a/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-389-trace-the-azure-source-address-requirement-when-rhel-updates-fail-through-a/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-389-trace-the-azure-source-address-requirement-when-rhel-updates-fail-through-a/", "url": "https://update.dsesecurity.com/updates/dse-20260909-389-trace-the-azure-source-address-requirement-when-rhel-updates-fail-through-a/", "headline": "Trace the Azure source-address requirement when RHEL updates fail through a central proxy", "description": "Why might a RHEL VM reach the internet through an on-premises proxy but still fail to reach Azure RHUI?", "abstract": "Why might a RHEL VM reach the internet through an on-premises proxy but still fail to reach Azure RHUI?", "articleBody": "Source facts\nAzure-hosted RHUI restricts access to VMs in Azure datacenter IP ranges. Microsoft warns that sending all VM traffic through an on-premises proxy may require user-defined routes for RHUI, covering every RHUI address. RHEL PAYG images are configured for this update infrastructure; golden BYOS images instead need Subscription Manager or Satellite. These are different update-source arrangements, not interchangeable troubleshooting defaults. Microsoft Learn.\nApplicability\nUse this check when a RHEL PAYG VM’s repository requests fail after an egress or proxy change. Confirm the actual image and repository configuration before treating the problem as an Azure RHUI connectivity incident.\nDSE recommendation\nReview the update traffic’s actual egress path before changing repositories or disabling validation. Ask the network owner to trace where the request leaves the environment and compare the routing and filtering configuration with the current official endpoint list. Have the Linux owner confirm which update source the VM is intended to use. Review any route change through normal network controls.\nVerification\nFrom a representative affected VM, test the configured repository path after the approved change and inspect the resulting package-manager evidence. Confirm that all required RHUI destinations are covered, not just the address that happened to answer one test. Record the effective route and sanitized outcome without repository credentials. Leave the issue open if ordinary web access succeeds but the intended update operation still fails.\nOfficial references\nMicrosoft Learn: Red Hat Update Infrastructure for Azure RHEL VMs. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:25:27+00:00", "dateModified": "2026-09-10T02:01:56+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-389-trace-the-azure-source-address-requirement-when-rhel-updates-fail-through-a/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-389-trace-the-azure-source-address-requirement-when-rhel-updates-fail-through-a/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Trace the Azure source-address requirement when RHEL updates fail through a central proxy" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 240, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Red Hat Update Infrastructure - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/workloads/redhat/redhat-rhui" } } ] } }