Network Security in Azure

Microsoft Azure has one of the world largest Software Define Network (SDN) fabrics stretches around the globe. It has its point of presence in 36 regions and expanding rapidly.
It usages its own infrastructure in order to make sure data will never leave Microsoft backbone network and encryption is put in place either in REST or in transit.

Network Security

Network and storage are the basic foundation block of any virtual environment. Azure provides complete isolated environment from tenant level, further isolated into subscription(Management prospective) and into virtual network, Subnet (Network Prospective). And, In terms of access, all its resources are tightly coupled with Azure Active Directory and different Role Based Access Control (RBAC) can be assigned to individual user's to meet/restrict access to the resources.

Azure Protection Circle

Azure Network Security Best Practices

Any network enabled device/application which requires IP address are kept inside the network in such a way so that they will able to retrieve Private IP address based on the Address Space defined within the Azure Network. They can be allocated Public IP automatically provided by Microsoft.  Allocating the network address space is like the traditional method used on-premises network. Azure reserve few initial IP of the given subnet for its management purpose. Fundamental principal remains same however implementation might be slightly different depending on the need.  

The following activities can be performed to Secure Azure Network Infrastructure.

• Logically separation of Subnet
• Network Security Group
• Control Route Flow
• Enable Force Tunnelling 
• Use of Virtual Appliances 
• Deploy DMZ’s for security zoning 
• Avoid Exposure to the Internet with dedicated WAN links 
• Optimize uptime and performance 
• Use global load balancing 
• Disable RDP Access to Azure VM machine 
• Enable Azure Security Center 
• Extend your data center to Azure

Logically Separation of Subnet

Dividing the larger network space into small chunk will provide larger flexibility on managing the network and provide higher degree of security. The private IP address spaces available are in the Class A (10.0.0.0/8), Class B (172.16.0.0/12) and Class C (192.168.0.0/16) ranges. By default, all subnet within the address space are open for communication within the network. Its highly recommend stopping this behaviour. It can be achieved by using the Network Security Group(NSG).

Network Security Group is a set of rules which allow or restrict any incoming or outgoing traffic to and from Azure Virtual network. We can apply NSG in subnet level and/or further restrict flow by associating it to the NIC associated to Azure Virtual machine.

Multiple rules can be inserted into the NSG. They all are evaluated based on the priority. Smallest value will get the high priority. 

Control Route Flow

When we populate resources in Azure, they started communicating with each other using the System Routes. Explicitly we do not require any further configuration even if we are running in the hybrid mode. System Routes defines, how IP traffic will be forwarded to the destination passing multiple unseen hops.

User Define Routes is used to eliminated such default system routes. It helps to provide better transparency to our routes. BGP Routes is enabled to propagate routes from on-premises network to the Azure.

Enable Force Tunneling