Azure Virtual WAN
An Azure virtual networking service that provides optimized and automated branch-to-branch connectivity.
228 questions
Internet intent on Azure firewall
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(291.2, 46%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EP%3C/text%3E%3C/svg%3E)
prasantc
936
Reputation points
Enabling Internet intent on the security configuration of the vhub immediately blocked RDP access to the on premise resources using public IP address. It will probably block web using natted public IP on prem too.
Is there any remediation to it?
{count} votes
-
GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee2024-06-10T07:44:30.2766667+00:00 Hello @prasantc ,
Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.
Could you please confirm if you are trying to RDP from on-premises to Azure or Azure to on-premises?
If it is from on-premises to Azure VMs, then the traffic will go via Azure Firewall, so you would need to add DNAT rules to Azure Firewall to allow the traffic.
Refer: https://learn.microsoft.com/en-us/azure/firewall/tutorial-firewall-dnat
Regards,
Gita
-
prasantc 936 Reputation points
2024-06-10T16:17:52.9533333+00:00 on premise
-
GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee
2024-06-11T07:18:28.34+00:00 @prasantc , could you please elaborate the issue a little further?
Also, as mentioned in the documentation,
If you enable Internet routing policies on the Virtual Hub, 0.0.0.0/0 default route is advertised to all connections to the hub (Virtual Network ExpressRoute, Site-to-site VPN, Point-to-site VPN, NVA in the hub and BGP connections) where the Propagate default route or Enable internet security flag is set to true. You may set this flag to false for all connections that shouldn't learn the default route.
So, if you would like to exclude any connection from learning this default route, you should make sure that the 'Propagate Default Route' or 'Enable Internet Security' setting is set to 'false' for that particular connection.
Connections where this setting is set to 'false' won't learn the 0.0.0.0/0 route, even if Internet Routing Policies are configured.
Regards,
Gita
-
GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee
2024-06-12T07:51:16.4533333+00:00 @prasantc , could you please provide an update on this thread?
-
GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee
2024-06-13T15:14:05.13+00:00 @prasantc , could you please provide an update on this thread for further discussion on this issue?
Sign in to comment
Sign in to answer