HYT00 timeout on pyodbc connection to data warehouse

[wouters]

Hi,

I am connection to a fabric sql endpoint for my data warehouse.

I do so using a user token obtained for database.windows.net/.default scope.
This works as intended and I can run queries using pyodbc.

However, I have a client instance, which passes a palo alto firewall.

Here I receive a HYT00 timeout. However, on firewall we allowed 1433 connection.

Is there something else that should be allowed/configured? On the firewall we do not see any denied traffic.

[V-yubandi-msft]

Hi @wouters ,

We haven’t received a response from your end yet. Please let us know whether the issue has been resolved or if you’re still facing any difficulties. Feel free to reach out if you need further assistance.

Thank you.

[V-yubandi-msft]

Hi @wouters ,

Could you please let us know whether your issue has been resolved, or if you are still facing any issues. If you need any additional details or clarification, please feel free to let us know.

Thanks.

[wouters]

Hi @V-yubandi-msft ,

Thank you for your response.
We are currently in the process of facilitating the exception. Allowing sql service tags, allows for a wider range than we initially expected would be needed for the connection to fabric.

I will keep this updated once we made the required exception.

Regards,
Wouter

[V-yubandi-msft]

Thank you for the update, @wouters . Please try the connection after adding the exception and let us know how it goes. Your update will also help other community members facing a similar situation. If the issue still continues, we can check further.

Thank You.

[V-yubandi-msft]

Hi @wouters ,

Thank you for engaging with the Microsoft Fabric Community. Since the connection works outside the Palo Alto firewall, it appears the token, driver, and Fabric SQL endpoint are functioning correctly. The HYT00 timeout when accessing through the firewall is likely due to a network restriction rather than an authentication problem.

Fabric SQL, similar to Azure SQL, uses a redirect model where the initial connection is made on port 1433, but the client is then redirected to a backend node using a dynamic port. If only port 1433 is open, the redirect can fail and cause a timeout.

Please verify that outbound traffic to *.database.windows.net is permitted, the necessary Azure SQL service tag or IP ranges are allowed, and that SSL/TLS inspection is not blocking the connection.

Let us know if the problem persists after these checks.

Regards,

Yugandhar.