Designing and Implementing Microsoft Azure Networking Solutions

Box 1: Application security groups Source Application security groups You can use application security groups to configure network security as natural extension of an application's structure, by arbitrarily grouping VMs and defining network security policies based on those groups. You can reuse your security policy and scale without manual maintenance of explicit IP addresses. The platform handles the complexity of explicit IP addresses and multiple rule sets, so you can focus on your business logic.

Box 2: Service Tag Destination

Service tags for NSGs Service tags simplify security for Azure Virtual Machines and Azure Virtual Networks by enabling you to easily restrict network access to just the Azure services that you use. You can use service tags in your NSG rules to allow or deny traffic *to* a specific Azure service globally or per Azure region. Azure provides the maintenance of IP addresses underlying each tag. This preview includes Storage, Sql, and AzureTrafficManager tags.

References:
https://azure.microsoft.com/en-us/updates/public-preview-features-for-nsgs/

The address spaces 10.0.3.0/24 and 10.190.0.0/24 do not overlap, so an address change is unnecessary. Provisioning virtual network gateways supplies the endpoints needed for a gateway-based VNet-to-VNet connection across the two environments. Neither VM1 nor VNet1 must be moved between subscriptions to establish that network path.

Box 1: Cloud Security Explorer in Microsoft Defender for Cloud Use

Microsoft Defender for Cloud, Build queries with cloud security explorer With the cloud security explorer, you can query all of your security issues and environment context such as assets inventory, exposure to internet, permissions, and lateral movement between resources and across multiple clouds (Azure AWS, and GCP).

Box 2: Agentless scanning for machines in Microsoft Defender for Cloud Configure Microsoft Defender for Cloud improves compute posture for Azure, AWS and GCP environments with machine scanning. For requirements and support, see the compute support matrix in Defender for Cloud.

Agentless scanning for virtual machines (VM) provides:

*-> Broad, frictionless visibility into your software inventory using Microsoft Defender Vulnerability Management. Deep analysis of operating system configuration and other machine meta data. Vulnerability assessment using Defender Vulnerability Management. Secret scanning to locate plain text secrets in your compute environment. Threat detection with agentless malware scanning, using Microsoft Defender Antivirus.

Incorrect:
* A discovery group in Microsoft Defender External Attack Surface Management (Defender EASM) Discovered assets are indexed and classified in your Defender EASM Inventory, providing a dynamic record of all web infrastructure under the organization's management. Assets are categorized as recent (currently active) or historic, and can include web applications, third party dependencies, and other asset connections.

Discovery groups Custom discoveries are organized into discovery groups. They're independent seed clusters that comprise a single discovery run and operate on their own recurrence schedules. You organize your discovery groups to delineate assets in whatever way best benefits your company and workflows. Common options include organizing by the responsible team or business unit, brands, or subsidiaries.

* An inventory filter in Microsoft Defender External Attack Surface Management (Defender EASM) Defender EASM inventory filters Filtering helps you find specific subsets of inventory assets based on selected parameters. This article outlines each filter and operator and provides guidance on input options that yield the best results. It also explains how to save queries for easy accessibility to the filtered results.

References:
https://learn.microsoft.com/en-us/azure/defender-for-cloud/how-to-manage-cloud-security-explorer
https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-agentless-data-collection
https://learn.microsoft.com/en-us/azure/external-attack-surface-management/inventory-filters

Front Door chooses the most specific configured path pattern that matches the incoming URL. The request path /abc/def/default.htm is below /abc/, so it matches RuleD's /abc/* pattern. RuleA's /abc/def path does not include the additional /default.htm segment, while the catch-all /* in RuleC is valid but less specific than /abc/*.

Box 1: Two Standard virtual WANs.
Need Standard for ExpressRoute.
Two VLANs: One for North America, and one for Europe.

Note: Virtual WAN: The virtualWAN resource represents a virtual overlay of your Azure network and is a collection of multiple resources. It contains links to all your virtual hubs that you would like to have within the virtual WAN. Virtual WANs are isolated from each other and can't contain a common hub. Virtual hubs in different virtual WANs don't communicate with each other.

Virtual WAN types
There are two types of virtual WANs: Basic and Standard. The following table shows the available configurations for each type.

* Basic
Site-to-site VPN only

* Standard
ExpressRoute
User VPN (P2S)
VPN (site-to-site)
Inter-hub and VNet-to-VNet transiting through the virtual hub Azure Firewall

NVA in a virtual WAN

Box 2: Five Virtual WAN hubs
One virtual WAN hub for each site; two in East US and three in West Europe.

Note: Hub: A virtual hub is a Microsoft-managed virtual network. The hub contains various service endpoints to enable connectivity. From your on-premises network (vpnsite), you can connect to a VPN gateway inside the virtual hub, connect ExpressRoute circuits to a virtual hub, or even connect mobile users to a point-to-site gateway in the virtual hub. The hub is the core of your network in a region. Multiple virtual hubs can be created in the same region.

A hub gateway isn't the same as a virtual network gateway that you use for ExpressRoute and VPN Gateway. For example, when using Virtual WAN, you don't create a site-to-site connection from your on-premises site directly to your VNet. Instead, you create a site-to-site connection to the hub. The traffic always goes through the hub gateway. This means that your VNets don't need their own virtual network gateway. Virtual WAN lets your VNets take advantage of scaling easily through the virtual hub and the virtual hub gateway.

Box 3: Two virtual network gateways
One virtual gateway for East US and one for West Europe.

References:
https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about

A rewrite rule can modify HTTP request or response headers, including the Host header, but it does not override a Web Application Firewall rule that is blocking the request. If access to the URL is denied by the WAF policy, rewriting the Host header will not resolve the issue. The WAF configuration must be adjusted to allow the required request while maintaining the appropriate security controls.

The Microsoft Storage service tag represents the network ranges for the storage service rather than one named storage account. An NSG rule using that tag can allow traffic to storage1, but it can also allow the same type of traffic to storage2 and storage3. It therefore cannot enforce the requirement that VM1 reach only storage1; a resource-specific service endpoint policy is needed.

Azure Application Gateway must be deployed into a virtual network subnet, so that network placement has to exist before the gateway can be created. The subnet provides addresses for the gateway instances and forms the required deployment boundary. A managed identity, certificate, or WAF policy may be needed for particular later features, but none replaces the prerequisite subnet.

The firewall log identifies rule 920300 as the matched rule and records the action as Matched for the request that lacks an Accept header. Disabling that rule removes the specific WAF check producing the HTTP 403 response, allowing the request to proceed through the application gateway. Therefore, the proposed solution meets the goal.