{"id":6071,"date":"2014-03-28T00:00:00","date_gmt":"2014-03-28T00:00:00","guid":{"rendered":"https:\/\/azure.microsoft.com\/blog\/network-isolation-options-for-machines-in-windows-azure-virtual-networks"},"modified":"2024-07-30T12:59:15","modified_gmt":"2024-07-30T19:59:15","slug":"network-isolation-options-for-machines-in-windows-azure-virtual-networks","status":"publish","type":"post","link":"https:\/\/azure.microsoft.com\/en-us\/blog\/network-isolation-options-for-machines-in-windows-azure-virtual-networks\/","title":{"rendered":"Network Isolation Options for Machines in Windows Azure Virtual Networks"},"content":{"rendered":"\n

Recently we published a Windows Network Security Whitepaper (download from here<\/a>) that gives insights on how customers can take advantage of the platform\u2019s native features to best protect their information assets.<\/p>\n\n\n\n

This post from Walter Myers<\/strong>, Principal Consultant expands on this whitepaper and describes how to isolate VMs inside a Virtual Network at the network level.<\/p>\n\n\n\n

Introduction<\/h6>\n\n\n\n

Application isolation is an important concern in enterprise environments, as enterprise customers seek to protect various environments from unauthorized or unwanted access.  This includes the classic front-end and back-end scenario where machines in a particular back-end network or sub-network may only allow certain clients or other computers to connect to a particular endpoint based on a whitelist of IP addresses.  These scenarios can be readily implemented in Windows Azure whether client applications access virtual machine application servers from the internet, within the Azure environment, or from on-premises through a VPN connection.<\/p>\n\n\n\n

Machine Isolation Options<\/h6>\n\n\n\n

There are three basic options to be discussed in this paper where machine isolation may be implemented on the Windows Azure platform:<\/p>\n\n\n\n

    \n
  1. Between machines deployed to a single virtual network<\/li>\n\n\n\n
  2. Between machines deployed to distinct virtual networks<\/li>\n\n\n\n
  3. Between machines deployed to distinct virtual networks where a VPN connection has been established from on-premises with both virtual networks<\/li>\n<\/ol>\n\n\n\n

    These options will be detailed in the sections that follow.<\/p>\n\n\n\n

    By default, Windows Server virtual machines created from the gallery will have two public endpoints, specifically RDP and Remote PowerShell connections.  There will be no other public endpoints except additional endpoints that are added by the administrator.  These endpoints and any others created by the administrator may be secured with access control lists (ACLs) on any given IaaS virtual machine.  As of this writing ACLs are available for IaaS virtual machines, but not for PaaS web or worker roles.<\/p>\n\n\n\n

    How Network ACLs Work<\/h6>\n\n\n\n

    An ACL is an object that contains a list of rules. When you create an ACL and apply it to a virtual machine endpoint, packet filtering takes place on the host node of your virtual machine. This means the traffic from remote IP addresses is filtered by the host node for matching ACL rules instead of on your virtual machine. This prevents your virtual machine from spending the precious CPU cycles on packet filtering.<\/p>\n\n\n\n

    When a virtual machine is created, a default ACL is put in place to block all incoming traffic. However, if an input endpoint is created (for example, port 3389), then the default ACL is modified to allow all inbound traffic for that endpoint.\u00a0 As discussed above, when a virtual machine is created from the Azure gallery, a PowerShell endpoint and an RDP endpoint are created using standard private ports but randomly generated public ports, as seen in the portal below.\u00a0 Inbound traffic from any remote subnet is then restricted to those endpoints and no firewall provisioning is required. All other ports are blocked for inbound traffic unless endpoints are created for those ports. Outbound traffic is allowed by default.<\/p>\n\n\n

    \"PowerShell<\/figure>\n\n\n\n

    Using Network ACLs, you can do the following:<\/p>\n\n\n\n