Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
1,796 questions
Azure Firewall Traffic Logging for Route based VPN l
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(83.2, 28.000000000000004%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERS%3C/text%3E%3C/svg%3E)
Rahul S Lal
0
Reputation points
In a hub and spoke architecture in Azure where native firewalls and virtual network gateway is leveraged for datacenter and vpn connectivity to branches. Is it possible to see the Azure firewall traffic logs for a traffic generated from one on premises branch to another on premise branch location which are connected via Azure route based VPN ?
We could see the traffic on captured pcap on virtual network gateway, however traffic is not visible on firewall logs.
Thanks in Advance.
Azure VPN Gateway
Azure Firewall
Azure Firewall
An Azure network security service that is used to protect Azure Virtual Network resources.
781 questions
{count} votes
-
Sedat SALMAN 14,180 Reputation points MVP2023-07-01T09:27:06.81+00:00 The primary determinant is the routing and network configuration in place. If the traffic is configured to route through the Azure Firewall, then it should appear in the logs. However, if the traffic is being routed directly between the VPNs and bypassing the firewall, it wouldn't appear in the firewall logs.
The Azure Firewall logs traffic that passes through it and the Virtual Network Gateway logs traffic that passes through it. If the traffic between your on-premises locations is not passing through the Azure Firewall (perhaps due to the routing configurations), it would not be logged there.
-
Rahul S Lal 0 Reputation points
2023-07-03T09:57:07.54+00:00 In the scenario, the virtual network gateway have UDRs which point all branch subnets(on-premises) to Azure Firewall. Azure firewall has the respective rules also in place. Azure firewall though know that branches(on-premise) can be reached via S2S tunnels on Virtual Network Gateway. But we don't see any traffic logs, but doing a pcap from Virtual Network Gateway we see the traffic flowing.
How can this traffic bypass the firewall or inter-site S2S VPN(remote branch to another branch) will not log the traffic on Azure firewall? Any limitations ?
Do we need Virtual WAN to enable the traffic logs in Firewall?
Thanks in advance.
-
GitaraniSharma-MSFT 50,096 Reputation points Microsoft Employee Moderator2023-07-03T10:56:04.18+00:00 Hello @Rahul S Lal ,
Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.
Could you please share your configuration details?
You mentioned "the virtual network gateway have UDRs which point all branch subnets(on-premises) to Azure Firewall".
What about your Azure subnets? Do all the hub and spoke subnets have UDRs for destination on-premises network as next hop Azure Firewall?
Are both side UDRs in place?
Regards,
Gita
-
Rahul S Lal 0 Reputation points
2023-07-03T16:12:24.3266667+00:00 We have routing tables for Spokes which point to Azure Firewall and all traffic logs from/to spoke communications can viewed in firewall logs.
Remote Branch sites are connected via SDWAN. There is a S2S tunnel from SDWAN towards Virtual Network Gateway through which all routes are learned via BGP.
Also in Virtual Network Gateway, there is routing table associated with UDRs (next-hop as virtual appliance Azure Firewall IP) for all branch subnets pointing towards Azure Firewall. Azure Firewall has policies for inter-branch communication as well. The intention of this routing is to inspect and control the branch traffic using Azure Firewall.
There are also third party vendor S2S tunnels terminated on Virtual Network Gateway. The associated routing table has UDRs for these vendor subnets point towards Azure Firewall. Azure Firewall has related policies also for S2S communication. The intention again is same for this routing to inspect and control the vendor traffic using Azure Firewall.
In this scenario, we are not able to see the traffic between S2S tunnels on Azure Firewall, however same is found in pcap from Virtual Network Gateway?
We suspect the traffic is not coming to Azure Firewall and flowing directly through VNG S2S tunnels? How can we control this traffic using Azure Firewalls?
Thanks in Advance.
-
GitaraniSharma-MSFT 50,096 Reputation points Microsoft Employee Moderator
2023-07-13T15:03:46.1366667+00:00 Hello @Rahul S Lal ,
Apologies for the delay in response.
As long as the UDRs are configured correctly for both to and fro traffic, it should flow via Azure Firewall without any issues.
Could you please share the below details, so that we can validate the configuration? (We will just look at one Azure VM and one on-prem machine to begin with)
- Your Azure subnet range where the Azure VM is deployed?
- Your Azure Firewall Private IP address?
- Your VPN GatewaySubnet address range?
- Your on-premises network range?
- Screenshots of the UDRs on both the subnet and VPN GatewaySubnet?
Just share a single Azure subnet range, the UDR associated to that subnet and the UDR pointing towards that subnet.
Regards,
Gita Sharma
-
GitaraniSharma-MSFT 50,096 Reputation points Microsoft Employee Moderator
2023-07-17T15:20:42.55+00:00 @Rahul S Lal , could you please provide an update on this post and share the requested details for further discussion on this issue?
Sign in to comment
Sign in to answer