Can we block RDP between two Azure VM's using Checkpoint Firewall?

Nidhi Priya 446

Hello experts!

I am working on a checkpoint firewall to block RDP from VM01 to VM02 which is in the same network in Azure.

And I have not block the RDP port from Azure:

User's image

My question is can we block the RDP of the Azure Virtual machine in the same network using third-party application i.e., a Checkpoint firewall?

Below is the screenshot for the rule I created in Checkpoint smart console.

User's image

KapilAnanth-MSFT 45,111 Reputation points Microsoft Employee

2023-09-20T04:03:31.98+00:00
@Nidhi Priya

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I see Tushar Kumar has addressed your queries.

You can use a third party Firewall to block traffic between two VMs provided traffic actually routes via the third party Firewall.

Leverage a user defined route(UDR) and forward the traffic from both the VMs to the Firewall

Make sure the nextHop is third party Firewall's Private IP and the address prefix is that of the subnet.

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
KapilAnanth-MSFT 45,111 Reputation points Microsoft Employee

2023-09-21T05:52:05.77+00:00

@Nidhi Priya

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,

Kapil
Nidhi Priya 446 Reputation points

2023-09-21T10:13:32.08+00:00

@KapilAnanth-MSFT ,

I have tried creating UDR and route the traffic of both the VMs to the Gateway IP address. but whenever I associate the subnet with the Route table, my checkpoint server loses its connection and I got the message "Unable to connect to the server".

And the minute I remove the subnet the server is working fine.

I have also created NSG to route traffic. Same error I am facing with the NSG.

Please let me know why this is happening.

Thanks!
KapilAnanth-MSFT 45,111 Reputation points Microsoft Employee

2023-09-24T06:37:13.8533333+00:00
@Nidhi Priya

As stated by Tushar Kumar , the NVA should not be in the same subnet as the other two VMs.

In fact, generally, the NVA should be in a dedicated subnet that does not have any Route table attached to it.

Can you share a network diagram of your VMs and NVA (Firewall) ?

Are they in the same subnet?

If so, kindly move the NVA to a dedicated subnet with no route table.

Cheers,

Kapil
Nidhi Priya 446 Reputation points

2023-09-24T08:41:27.7066667+00:00

Thanks @KapilAnanth-MSFT and Tushar Kumar,

Now I am able to route the traffic of Virtual machines to the gateway. The fact that I don't know is that the NVA should be in a dedicated subnet that does not have any Route table attached to it.

Thanks!

Nidhi
KapilAnanth-MSFT 45,111 Reputation points Microsoft Employee

2023-09-24T11:11:52.0666667+00:00

@Nidhi Priya

You are most welcome.

I am glad you were able to resolve the issue.

Cheers,

Kapil
Jeff Engel-Check Point 5 Reputation points

2023-09-27T18:06:52.4033333+00:00

Hi @Nidhi Priya

This is Jeff with Check Point. Please let us know if you need any more help or have any additional questions.

Best Regards!
Nidhi Priya 446 Reputation points

2023-09-29T07:34:36.3866667+00:00

Hi @Jeff Engel-Check Point ,

Can you let me know the pricing or cost of the Checkpoint firewall or any link where this part is described in detail?

And also the SKU of the checkpoint firewall. (This is something that I have been asked in the presentation).

Thanks!

Nidhi
Jeff Engel-Check Point 5 Reputation points

2023-10-03T02:24:56.0133333+00:00

Hi @Nidhi Priya

Cost is based on consumption at 1.6 cents per processed GB. The offering is also MACC eligible. Hope this helps!

Accepted answer

Tushar Kumar 3,326 Reputation points MVP

2023-09-19T11:22:21.1666667+00:00

Hi Nidhi Priya,

Thank you for asking your quesitoion in QnA!

Definetly you can manage your traffic between 2 VMs using your Checkpoint Firewall the Scenario is called East-West traffic

You need to create user defined route(UDR) making sure all the traffic is routed through the firewall.

https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

You can take refrerence form following link to create a route table to route traffic through NVA(Your checkpoint Fw)

Please click "Accept as answer" if this helps.
Please sign in to rate this answer.
Nidhi Priya 446 Reputation points

2023-09-21T10:04:53.61+00:00

@KapilAnanth-MSFT ,

I have tried creating UDR and route the traffic of both the VMs to the Gateway IP address. but whenever I associate the subnet with the Route table, my checkpoint server loses its connection and I got the message "Unable to connect to the server".

And the minute I remove the subnet the server is working fine.

I have also created NSG to route traffic. Same error I am facing with the NSG.

Please let me know why this is happening.

Thanks!

Tushar Kumar 3,326 Reputation points MVP

2023-09-21T10:15:25.4033333+00:00

Hi Nidhi Priya,

That is totally a routing issue which is breaking your connectivity I would recommed https://support.checkpoint.com/results/sk/sk109360 reading this article to get understanding of how the UDR needs to be setup.

I would recommend creating a similar diagram for your environment once you have setup your routes and post as seperate thread we will be able to help you better.

Nidhi Priya 446 Reputation points

2023-09-21T10:29:54.8733333+00:00

I have also gone through this architecture, but I have a different scenario to work on and set up the rules to block RDP for the Virtual machines which are in same network.

Tushar Kumar 3,326 Reputation points MVP

2023-09-21T10:39:30.06+00:00

Hi Nidhi, That's great! The concept remain the same. I f I am understanding it correctly you are loosing connection to the firewall which should not be the case. Unless you attach the UDR to firewall subnet. You need to attach the UDR to your workload subnet ( with your 2 VMs ) and add a route to traffic going to your subnet next hop Virtual appliance.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Can we block RDP between two Azure VM's using Checkpoint Firewall?

0 additional answers

Your answer