EDIT: This question was originally asked during the legacy ASM days. Things are significantly different and the introduction of Network Security Groups makes this trivial to implement in a modern Azure environment.
I have a three-tier application running in Azure VMs.
This application has two back-end tiers and a web tier. This is split up into three cloud services - one for each tier.
The two back-end tiers use Azure Internal Load Balancing.
The web-tier only needs to communicate to the back-end on port 443.
Is it feasible to create a second VNet and use VNet-to-VNet connectivity for the front-end servers and put an ACL on it, so that it can only communicate with the back-end servers over 443? If so, where do I configure this ACL? Under no circumstances should the back-end servers be exposed to the Internet directly.