Azure - Force Encryption Between Public and Private Subnets

Question

Hi, Could I get some feedback on best practicses around forcing encryption on ALL traffic between public and private subnets? Thanks.

Answer 1

@YogiBear Thanks for the info. Again, there is no concept of "Encryption". In case you feel that a specific source or destination is malicious, you can go for Azure Firewall or NVAs and "FILTER" the traffic Azure Firewall

• You can use Azure Firewall for Inbound as well as Outbound traffic.
• By configuring Rules in Azure Firewall, you can either allow or deny traffic.
• This works at Layer 4(TCP/UDP) as well as Layer 7(Application)
• Overview: https://learn.microsoft.com/en-us/azure/firewall/overview
• Configure Azure Firewall rules : https://learn.microsoft.com/en-us/azure/firewall/rule-processing
• How to : https://learn.microsoft.com/en-us/azure/firewall/tutorial-hybrid-portal
  • This talks about how to monitor traffic between 2 Spoke VNets.
  • But the same logic can be applied to 2 subnets in same VNet as well NVA + Azure Load Balancer
• To filter traffic from Internet
• 
• To filter traffic from OnPrem
• 
• Refer : Design LoadBalancer Hope this helps. Please let me know if you require more info Cheers, Kapil

Answer 2

Here are some best practices:

• Azure Private Link enables you to access Azure services over a private connection facilitated by Azure backbone network. This allows you to establish secure and private connectivity between your virtual networks and Azure services without exposing data to the public internet.
• Deploy an Azure VPN Gateway in the virtual network to create encrypted IPsec tunnels between the subnets. This will ensure that traffic between the subnets is secure, even if it has to traverse the public internet.
• Network Security Groups (NSGs) allow you to create rules that filter traffic at the network layer. Configure NSGs to only allow traffic over specific ports and protocols that support encryption, such as HTTPS (port 443) and SSH (port 22).
• Azure ExpressRoute: For a dedicated private connection between your on-premises network and Azure, consider using Azure ExpressRoute. It provides an additional layer of security by keeping your traffic off the public internet.

There are mostly network level encryption also we have another methods for application level encryption