1

We have a private Azure network configured with a Virtual Network Gateway where all traffic is passing through. Network Security Groups are not currently used.

I've tried to enable diagnostic logs on a VNG and archive to a storage account, but I don't see logs coming in the storage account blobs.

Do VNG diagnostic logs capture client IPs? How can I log IP addresses of all connections to virtual machines in Azure?

Improve this question

1 Answer 1

Reset to default
0

You need to enable NSG Flow Logging. Check the article below:

https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview

This will give you:

  • Outbound and inbound flows on a per-rule basis
  • The NIC that the flow applies to
  • 5-tuple information about the flow (source/destination IP, source/destination port, protocol)
  • Information about whether traffic was allowed or denied

I believe you need to create and associate the subnet (or individual NIC) to an NSG, even if it only has the default rules - which allows traffic in/out of VPN and within the VNet.

Once you have the logs configured, you can analyse it with Log Analytics (OMS)

Improve this answer
3
  • But we're not using an NSG (see the question), we're using a VNG.
    – Dima Korobskiy
    Jan 21, 2018 at 21:10
  • And im telling you to enable one even if it doesn't have any non default rules to be able to capture data from the VMs instead.
    – Bruno Faria
    Jan 21, 2018 at 21:13
  • Got it, thanks! I've created a new NSG with the default rules and I'll accept the answer. For some reason, Azure hangs when I drill down in Network Watcher > NSG flow logs > {our NSG}. I'll guess we can follow up on that with MS support.
    – Dima Korobskiy
    Jan 21, 2018 at 22:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .