Azure Logic App with region of North Europe routing info via US servers

Question

Azure Logic App with region of North Europe routing info via US servers

na 146

We have a logic app with a location of Northern Europe.

The Logic app uses a "Create File SFTP" Action to create a file on an SFTP server in Europe.

The owner of the server has blocked our attempts to create a file, saying that one of hops is based in the US, and they don't accept data that has landed in the U.S.

I'm not debating their policy, the question is, if the logic app is based in North Europe (Irish data center), why would the sftp file create request be routing through U.S Servers?

I thought it was maybe that once the packet hits the internet, it can go anywhere, but the vendor says the request consistently has a hop from a U.S Ip address.

MayankBargali-MSFT 70,941 Reputation points Moderator

2023-06-06T12:07:21.05+00:00

Hi @na

Following up to see if you have any queries or concerns on the answer posted by Ronen. In cas if you further need to troubleshoot further once your SFTP team response then it would be best over one on one support as there could be proxy in between the FTP server and network which would caused this obervation.

Please "Accept Answer" if the answer is helpful so that it can help others in the community.
MayankBargali-MSFT 70,941 Reputation points Moderator

2023-06-12T04:47:18.4833333+00:00

Hi @na

I hope the answer helps. Feel free to get back to us if you need any assistance.

Please "Accept Answer" if the answer is helpful so that it can help others in the community.

1 answer

Your answer

MayankBargali-MSFT 70,941 Reputation points Moderator

2023-06-06T12:07:21.05+00:00

Hi @na

Following up to see if you have any queries or concerns on the answer posted by Ronen. In cas if you further need to troubleshoot further once your SFTP team response then it would be best over one on one support as there could be proxy in between the FTP server and network which would caused this obervation.

Please "Accept Answer" if the answer is helpful so that it can help others in the community.
MayankBargali-MSFT 70,941 Reputation points Moderator

2023-06-12T04:47:18.4833333+00:00

Hi @na

I hope the answer helps. Feel free to get back to us if you need any assistance.

Please "Accept Answer" if the answer is helpful so that it can help others in the community.

Answer 1

Ronen Ariely 15,206

hi,

According to the documentation the SFTP-SSH is a managed connector and as such the outbound IP addresses should follow the list in the this document.

Your description is very strange and you should check with the owner of the SFTP server to re-check the procedure which led him to the conclusion that your logic apps uses an IP at US. It sound like an issue in his side in first glance.

If the Logic ASpp located at North Europe, then the IP that your SFTP server should see is in the ranges:

52.178.150.68, 94.245.91.93, 20.82.226.52, 20.82.224.59, 13.69.227.208 - 13.69.227.223, 13.69.231.192 - 13.69.231.223, 40.115.108.29, 20.82.246.112 - 20.82.246.127, 52.146.138.32 - 52.146.138.63

There should be NO routing through U.S Servers from the Azure side (including the connector or the API of the Azure SFTP service.

Note! This is well documented

If you have a firewall set up, make sure that you add the managed connector IP addresses for your region to the approved list.

na 146 Reputation points

2023-06-06T14:31:29.6366667+00:00

thank you @Ronen Ariely

All i can think of is that once the packet leaves the North Europe based IP used by the logic app, it is now on the internet, and can technically be routed anywhere.
The only way to guarantee a packet staying within Europe is leased line or having source and destination in Azure, or using a private link/endpoint, but as the destination SFTP is not in azure, this is also not going to mitigate the issue.
Ronen Ariely 15,206 Reputation points

2023-06-06T17:12:15.9333333+00:00

According to this story anyone and any app can be blocked by your client even if they are in the same building as they are 😀

This is not the way the internet is working or the way to secure a system. The data should be encrypted between the source and the target, using Transport Layer Security (TLS) 1.2 or above. This way the middle machine has not a lot of value and only the source and the target can use the data as long as your system well secured.

https://www.internetsociety.org/deploy360/tls/basics/

A man-in-the-middle attack can be done (attempt to be done) in any point and the profesional crackers outside US are using servers in US if they want to attack someone who count on something like you describe. By the way, anyone can use a proxy in US or open an Azure VM or any service in any region in the world as well.

You should really learn more about browsers like TOR for example ;-)

Another point to think about is that the headers which you track as sent by the servers and if someone want to prevent it then he can simply not send it (assuming he is the man-in-middle can change the packages sent from his point and hise the rout before this point).

In any case, I have a great tip for anyone who really want secure: Keep your machine off, disconnect any cable and take out the disk to a different country under full bank security. On the other side, You can secure your system rationally with a balance.

Share via

Azure Logic App with region of North Europe routing info via US servers

1 answer

Your answer