Azure VNet ignores route table

Christian van Eickelen 1 Reputation point
2023-04-24T13:30:47.6466667+00:00

Hello guys, I would like to ask for assistance for an issue, which shouldn't be an issue. ;) I've just deployed a Fortigate Firewall to my Azure infrastructure which relies on a route table. The default route is set "Virtual Appliance" for the next hop and has configured the IP 172.16.0.132 on the internal interface. And there is an additional route for each subnet for inner VNet communication. The subnets use the IP ranges 172.16.1.128/25 and 172.16.2.0/24. And of course the route table is associated to each subnet. Due to the mentioned configuration my expectation was that the VMs can't communicate with each other because no firewall rules were configured. But the machines can ping vice versa and it seems that the traffic doesn't flow through the firewall because I can't see any log entries that show the ping. Here ist an output of the route table configuration: 2023-04-24 15_28_20-vmfgt-RouteTable-VNET_DRaaS_FGT_DMZ - Microsoft Azure and 7 more pages - Persona

Does anyone have any hint or advice? Thank you, Christian

Azure Virtual Machines
Azure Virtual Machines
An Azure service that is used to provision Windows and Linux virtual machines.
7,295 questions
Azure Virtual Network
Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
2,204 questions
{count} votes

2 answers

Sort by: Most helpful
  1. Alistair Ross 7,101 Reputation points Microsoft Employee
    2023-04-24T14:11:51.9566667+00:00

    Hello

    When you say your expectation is that the VM's cannot communicate, are these VM's that are all in the same subnet?

    By default, virtual machines in the same subnet can communicate based on a default NSG rule allowing intra-subnet traffic. If you want to force two VMs in a subnet to communicate via a firewall and not directly to each other, you can add a rule to the Network Security Group (NSG) that denies all inbound and outbound traffic between the two VMs. This will prevent them from communicating directly with each other.

    You can then configure your firewall to route traffic between the two VMs.

    I hope this clarifies things

    Alistair


  2. aidanfinn 0 Reputation points
    2023-05-03T07:52:16.2933333+00:00

    Can you share a diagram of the network(s), including the route tables/user-defined routes? There's a who world of possibilities without knowing exactly what you have.

    0 comments No comments