1

EDIT: This question was originally asked during the legacy ASM days. Things are significantly different and the introduction of Network Security Groups makes this trivial to implement in a modern Azure environment.

I have a three-tier application running in Azure VMs.

This application has two back-end tiers and a web tier. This is split up into three cloud services - one for each tier.

The two back-end tiers use Azure Internal Load Balancing.

The web-tier only needs to communicate to the back-end on port 443.

Is it feasible to create a second VNet and use VNet-to-VNet connectivity for the front-end servers and put an ACL on it, so that it can only communicate with the back-end servers over 443? If so, where do I configure this ACL? Under no circumstances should the back-end servers be exposed to the Internet directly.

Improve this question
1

2 Answers 2

Reset to default
1

Edit:

This is not possible. See this: Currently, you can specify network ACLs for endpoints only. You can’t specify an ACL for a virtual network or a specific subnet contained in a virtual network. Also, the Virtual Network Security Whitepaper might be useful.

Have a look here

Basically, yes, you can have your front-end-server in one vnet, and your back-end server in another, and then restrict the access to the back-end using ACL's.

What you cannot do is restrict communication between the back-end servers using ACL's if they are in the same VNet. You need Windows Firewall or other measures for that.

To configure this, once you have your back-end servers in a VNet, use the "Endpoints" configuration of the back-end servers and add your HTTPS/443 endpoint. Then, still on this endpoint, click "MANAGE ACL" on the bottom. Now, PERMIT your front-end network or just the /32 IP Address(es), and DENY everything else (0.0.0.0/0)

See the guide for more details

Improve this answer
3
  • But I don't want to use public endpoints, as I'm using ILB.
    – MDMarra
    Aug 5, 2014 at 11:03
  • According to this, you can add ACLs to an ILB endpoint. That said, I haven't worked with ILB yet, so I can't tell you how :)
    – MichelZ
    Aug 5, 2014 at 11:21
  • You can but I want to ACL the entire tunnel between the internal VNet and the "DMZ" VNet. Forget ACLs on individual endpoints, as these will not be the only servers/applications in these VNets.
    – MDMarra
    Aug 5, 2014 at 12:03
0

yes, check this out :

enter image description here

This is a DMZ using the HUB and spoke approach.

https://mouradcloud.westeurope.cloudapp.azure.com/blog/blog/2018/07/19/build-azure-hub-and-spoke-using-pfsense-nva-udr-vnet-peering-and-vpn-on-local-router/

Now if you want a pure 3 tiers without DMZ, see there :

https://github.com/MourIdri/azureiaascodev1

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .