When enterprises run workloads on a cloud service, they need to monitor and manage both inbound and outbound network traffic for security purposes. Show
Microsoft Azure provides two security options to control inbound and outbound traffic:
Both services provide security, but at different network levels. Below, learn what each service is and its main features, as well as how the two compare. What is Azure Firewall?Azure Firewall is a managed, cloud network security service. This stateful firewall service deploys on any virtual network and protects Azure Virtual Network (VNet) resources by filtering both network and application-level traffic. Also, it enables admins to create traffic filtering rules, which they can enforce across multiple subscriptions and networks. Azure Firewall has built-in high availability and admins can configure it to span multiple Availability Zones for a 99.99% uptime. Also, with unrestricted cloud scalability, it can scale based on changing flows of inbound and outbound traffic. Other top Azure Firewall features include:
What is Network Security Group?An NSG is Microsoft's service to simplify virtual network security; it enforces and controls network traffic. NSGs are associated with subnets and network interfaces of an Azure VM. NSGs contain security rules and provide a way to activate a rule or access a control list. With these rules, IT teams can organize, filter and route different types of network traffic. These rules, which filter inbound and outbound traffic, deny or allow traffic based on 5-tuple information:
A comparison of Azure Firewall and NSGsWhen comparing Azure Firewall vs. NSGs, look at what Open Systems Interconnection (OSI) layer each service has. This information helps IT teams understand how data is sent or received over a network. It begins at Layer 1, which is the physical layer then goes up to 7, which is the application layer. Azure Firewall is an OSI L4 and L7, while NSG is L3 and L4.  While Azure Firewall is a comprehensive and robust service with several features to regulate traffic, NSGs act as more of a basic firewall that filters traffic at the network layer. Azure Firewall is adept at analyzing and filtering L3, L4 and L7 traffic. Azure Firewall also provides support for threat-intelligence-based filtering, which NSG can't do. Both options use service tags to define network access controls. Service tags are groups of IP addresses for particular services, and they protect Azure resources, as well as achieve network isolation. Unlike NSGs, Azure Firewall also supports application FQDN tags, which are used together with application rules to allow the required outbound traffic through the firewall. In real world cases, enterprises typically use Azure Firewall when they need to filter traffic to a VNet with its threat intelligence-based filtering capabilities. NSGs are typically used to protect traffic flowing in and out of a subnet. These two network security services can work together to provide defense-in-depth network security in which multiple defensive measures are put in place. That way, if one element fails, another security measure stands in its place. How can you keep your entire Azure Virtual Network easily accessible and secure at the same time? Many an IT professional has had sleepless nights trying to figure it out. Now, let us help you avoid them! Luckily there are some great solutions like Just-In-Time VM Access without risking port scanning and brute force attacks. We will cover the Azure VM connectivity options – including the new Azure Bastion – here. Contact Us The Azure cloud services have helped companies around the world move from on premises servers to Virtual Machines available at a moments notice. This has undoubtedly made it possible for a lot of small & medium businesses to scale fast and saved established companies fortunes. But with new solutions come new challenges. Hackers are always searching for vulnerabilities via ports connected to public IP addresses. So when you need to connect to your Azure Virtual Machines to manage them, there are a range of security and connectivity issues. Remote Desktop Protocol (RDP) is well-known and commonly used to access remote computers and servers. This lets IT administrators support a huge organization from the comforts of their own desk. Microsoft developed RDP and includes two administrator accounts for simultaneous RDP onto a server in Windows Server. For more users you can add CALs (RDS Client Access Licenses). There are several challenges facing the IT professionals who need to expose their virtual machines to the public internet by opening ports (RDP/SSH): 1) Brute force attacks target management ports
as a means to gain access to a VM So let’s look at the different options for connecting to your VMs with RDP and how you can mitigate these risks RDP using a Private IP address across a Site to Site VPNThe ideal form of RDP connection is RDP across a Site to Site VPN connection. This keeps your communication with the Virtual Machine off the public internet granting protection against port scanning, brute force and DdoS attacks. With a VPN gateway from the Azure network to the on premises network Azure VMs can be RDP’ed using a private IP address – protected from the prying eyes of the public internet. The public IP address can be removed all together if you don’t need it. If you do need to use it for something, the RDP port (usually 3389) will be closed. This is an effective and seamless approach to connect to Azure VM without public IP addresses, reducing the threat of attacks. However, if you don’t have a Site to Site VPN to your Azure network, there are other options. Lock down RDP to a source IP or IP RangeThe default RDP port – 3389 – allows RDP connection from any IP in the world. When enabled it is therefore a security risk. You can mitigate this by restricting RDP access to a specified source IP address or range with Azure NSG’s (Network Security Groups). Every Virtual Machine will have its own NSG when deployed through Azure. You should apply these two Inbound Port rules:
Pros: This effectively reduces outside threats by only allowing the specified on premises machines to RDP into the Azure Virtual Machines. Cons: The port is still visible on the internet. This method is best suited for smaller organizations and also involves management of Network Security Group Port rules Just-in-time VM access:Brute force attacks can take days and even weeks to complete. An astounding number of attempts need to be made to connect through the RDP/SSH ports. So if
you only have the port open when you need it, you reduce the vulnerability. Just-in-time (JIT) VM access only opens the ports when you need them and locks them down to your IP address / range. After you have finished what you were doing on the VM, it closes the port again. Pros: Reduces the risk of succesfull brute force attacks as the port is only open when you need it Cons: You still need to open port 3389 to public internet leaving you vulnerable within the allotted time frame. Public Load Balancer with Network Address Translation (NAT)A Public Load Balancer has a public IP address, and a Network Address Translation (NAT) rule forwards traffic from a specific port of the front-end IP address to a specific port of a back-end VM on its Private IP. So, the VM you want to access with RDP doesn’t have to have a Public IP and its private IP isn’t visible. Pros: Minimizes the number of Azure Public IP addresses, obfuscates management ports of virtual machines, load balances traffic across the virtual machines configured under it Cons: This approach has certain limitations so it may not be suitable in some scenarios. The load-balancing rules and inbound NAT rules support TCP and UDP but not other IP protocols like ICMP. The load balancer doesn’t terminate, respond or interact with the payload of a UDP or TCP flow. Provision a Jumphost VMRather than exposing all your virtual machines to public internet, you can use the Jumphost solution. This creates a single VM – called the Jumphost – in Azure with RDP connection to the internet. From this box you connect to your other VMs in your virtual network. An NSG can be used to restrict the IP addresses that can communicate with the Jumphost. Monitoring and logging can also only be done on this one VM. You can easily turn it off to stop all RDP when needed. Jumphosts are easy to deploy and greatly increase security on the overall Azure VM infrastructure maintenance. You can find CIS Hardened images ready for easy deployment and management in the Microsoft Azure marketplace. Pros: Access your VMs through one locked down, hardened jumphost. Your VMs don’t need Public IPs. Cons: Jumphost still involves opening one VM to public internet without eliminating outside threats completely. The additional cost of one VM, configuration, ACLs, monitoring and auditing can make this a costly solution. Azure Bastion – a jump host PaaS serviceIn late 2019 Microsoft released Azure Bastion into General Availability. It is a new fully platform-managed PaaS service which provides secure and seamless RDP/SSH connectivity to your virtual machines directly in the Azure portal over SSL. Azure Bastion provisions directly in your Azure Virtual Network acting like a jump server as-a-service. You don’t need Public IPs to access your VMs over RDP/SSH. Additionally, Azure Bastion provides integrated connectivity using RDP/SSH directly from your browser and the Azure portal experience. You don’t need an additional client, agent, or piece of software. Deployment of Azure Bastion is per virtual network, thus, once deployed in a virtual network, it is available to all VMs in the virtual network. Bastion host servers are designed and configured to withstand attacks. Azure Bastion is also reinforced by automatic patching, handled by Microsoft, to best guard customers against zero-day exploits. Pros: You don’t need public IP addresses on your virtual machines, get the benefits of a jumphost without the overhead, RDP and SSH directly in Azure portal. Cons: The disadvantages of Azure Bastion are hard to find. This PaaS Service is not yet available worldwide, but can currently be used in 29 regions. Please ask one of our consultants for the current availability outside the UK, if this is relevant to your business. Overall Azure Bastion is the ideal solution that IT professionals have been waiting for. It provides an easy and fool proof solution to eliminate outside threats with minimal maintenance overhead. You get all the benefits of RDP but connect to Azure VM without Remote Desktop client. Future capabilities and features of Azure Bastion Microsoft is still developing Azure Bastion to meet user needs. Along with the expansion to all regions the following updates are expected:
Want to know more? Get in touch Let's Talk Want to keep in touch?If you’ve enjoyed reading this blog, then sign up to receive our monthly newsletter where we share new blogs, technical updates, product news, case studies, company updates, Microsoft and Cloud news. We promise that we won’t share your email address with other business or parties, and will keep your details safe. You can choose to unsubscribe at any time. Newsletter Sign Up f Back to Blog posts What should you use to prevent traffic from an Azure virtual network from being routed to an?Explanation: Azure Firewall is one of the cloud-based, managed network security services that protect Azure Virtual Network resources. Azure firewall enables the clients to filter inbound and outbound traffic for Azure Resources.
What should you use to prevent traffic from an Azure virtual network from being routed az900?You can restrict traffic to multiple virtual networks with a single Azure firewall. Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources.
What is used to control traffic to a virtual network?A software application, called a virtual switch or vSwitch, controls and directs communication between the existing physical network and virtual parts of the network, like virtual machines.
Which Azure tool helps to prevent a network from being flooded with illegitimate traffic?Use Azure Firewall Threat intelligence-based filtering to alert or to deny traffic to and from known malicious IP addresses and domains.
|
