Internet intent on Azure firewall

prasantc 876

Enabling Internet intent on the security configuration of the vhub immediately blocked RDP access to the on premise resources using public IP address. It will probably block web using natted public IP on prem too.

Is there any remediation to it?

GitaraniSharma-MSFT 48,531 Reputation points Microsoft Employee

2024-06-10T07:44:30.2766667+00:00

Hello @prasantc ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

Could you please confirm if you are trying to RDP from on-premises to Azure or Azure to on-premises?

If it is from on-premises to Azure VMs, then the traffic will go via Azure Firewall, so you would need to add DNAT rules to Azure Firewall to allow the traffic.

Refer: https://learn.microsoft.com/en-us/azure/firewall/tutorial-firewall-dnat

Regards,

Gita
prasantc 876 Reputation points

2024-06-10T16:17:52.9533333+00:00

on premise
GitaraniSharma-MSFT 48,531 Reputation points Microsoft Employee

2024-06-11T07:18:28.34+00:00

@prasantc , could you please elaborate the issue a little further?

Also, as mentioned in the documentation,

If you enable Internet routing policies on the Virtual Hub, 0.0.0.0/0 default route is advertised to all connections to the hub (Virtual Network ExpressRoute, Site-to-site VPN, Point-to-site VPN, NVA in the hub and BGP connections) where the Propagate default route or Enable internet security flag is set to true. You may set this flag to false for all connections that shouldn't learn the default route.

So, if you would like to exclude any connection from learning this default route, you should make sure that the 'Propagate Default Route' or 'Enable Internet Security' setting is set to 'false' for that particular connection.

Connections where this setting is set to 'false' won't learn the 0.0.0.0/0 route, even if Internet Routing Policies are configured.

Refer: https://learn.microsoft.com/en-us/azure/virtual-wan/how-to-routing-policies#troubleshooting-data-path

Regards,

Gita
GitaraniSharma-MSFT 48,531 Reputation points Microsoft Employee

2024-06-12T07:51:16.4533333+00:00

@prasantc , could you please provide an update on this thread?
GitaraniSharma-MSFT 48,531 Reputation points Microsoft Employee

2024-06-13T15:14:05.13+00:00

@prasantc , could you please provide an update on this thread for further discussion on this issue?

Share via

Internet intent on Azure firewall