1

Hey all,

I have a few clients that we have migrated to Azure to host their servers, DC, file server, and a phone app server.

We simply spun up a simple vnet and connected it back to on prem with a S2S VPN.

None of these VMs have public IPs assigned and we wanted to treat it as a simple setup to a private DC like we would do with any other providers.

While setting this up and researching, I came to the conclusion that since none of the servers are internet facing, NSGs were sufficient to block everything except the VNET to VNET traffic.

One that I did notice is that these VMs are allowed internet outbound access, as in I can reach all the websites.

In this scenario, do I need to put in an Azure firewall? I know the basic SKUs are not that expensive any more but I am not sure if it is really needed or not.

9 Spice ups
2

It depends on your needs. I have done similar setups with a simple VNet and NSGs to control access. I have also used firewall appliances. If you have a simple environment, and NSGs provide the ACLs that you need, then a firewall appliance may be excessive. If you need more advanced routing, NAT, and/or logging and monitoring, then a firewall appliance would be useful. You’ll need to determine if the extra features are worth the extra costs of running a firewall appliance.

1 Spice up
3

Thanks again for the reply.

When I was first reviewing this setup, it was really a simple setup. Just a few VMs in Azure as an extension of the current subnets via S2S VPN.

Since there is no public IP and anything and everything is blocked via NSG (only default rule to allow traffic from Vnet to Vnet and load balancers allowed).

We don’t have any load balancers as there is no public IP incoming for any of the servers.

As far as I can tell, this is as secure as it gets but I get bombarded with warnings/notices all the time about security and it just has me on edge…

I must be overthinking this but this is starting to give me anxiety about everything in Azure. lol

1 Spice up
4

I realize this posted is a bit dated but your comments resonate with me still today:

I get bombarded with warnings/notices all the time about security and it just has me on edge

and

give me anxiety about everything in Azure

We are currently moving from an NSG only model to an Azure Firewall and I am hopeful that will provide the added monitoring and geolocation tools to help us more granularly control what comes in and out of our Azure web servers. It’s a whackamole affair to Deny CIDR blocks manually, which is what we’ve been doing until we get approval to spend the money to implement Azure FW. Did you already put the Azure FW in place, and if so how did it go, and what were some of the gotchas?

Thank you for your post.

1 Spice up