How to define and manage large scale connectivity rules between applications in Cloud Landing zones

Question

What are ways in Azure to define connection rules in Virtual Networks/Subnets/security Zones for different application to communicate with each other using specific attributes such as source, destination, service, protocol... on a large scale.

E.g. Let's say App1 in Production phase wants to use a database which is owned by DB1 team in another production environment in different Resource group/region/VPC/subnet/PAAS/:

source: Appname-component1

phase: one of [PROD, DEV, UAT, TEST]

Region : North_Europe

source_net: subnet_x

Destination:Appname_DB_Oracle_Global

phase: one of [ROD, DEV, UAT, TEST]

Region : South Europe

subnet: Subnet_y

Landing zone: LZ_xyz

PAAS: Openshift

Given the connection request comes from App in PROD phase to DB in PROD phase && the connection is allowed (using some approval solution like servicenow, managed DB, cloud IAM service) then the connection shall work.

On the other hand, If same APP in TST phase tries to connect to DB in PRD phase, it should not be allowed. if same APP from a subnet outside of what is allowed, tried to connect, it should also disallow

And you get the idea, all permutations and combination on n attributes (PAAS, Containers, Pods, VMs etc.)

Searched KB articles for managed services on Azure but could not find anything suitable.

Answer 1

@Nilesh Joshi

Thank you for reaching out.

I understand you are looking for ways to define connection rules in Virtual Networks/Subnets/security Zones for different applications to communicate with each other using specific attributes such as source, destination, service, protocol, etc. on a large scale.

Based on my understanding above I think you can explore the option of using Azure Virtual Network manager. Azure Virtual Network Manager is a management service that enables you to group, configure, deploy, and manage virtual networks globally across subscriptions. With Virtual Network Manager, you can define network groups to identify and logically segment your virtual networks. Then you can determine the connectivity and security configurations you want and apply them across all the selected virtual networks in network groups at once.

Below are some of the key benefits of AVNM:

• Centrally manage connectivity and security policies globally across regions and subscriptions.
• Enable direct connectivity between spokes in a hub-and-spoke configuration without the complexity of managing a mesh network.
• Highly scalable and highly available service with redundancy and replication across the globe.
• Ability to create network security rules that override network security group rules.
• Low latency and high bandwidth between resources in different virtual networks using virtual network peering.
• Roll out network changes through a specific region sequence and frequency of your choosing.

Given in your scenario above, you can use AVNM to create different network groups to meet the security requirements of your environment and its functions. For example, you can create network groups for your Production and Test environments to manage their connectivity and security rules at scale. For security rules, you'd create a security admin configuration with two security admin rule collections, each targeted on your Production and Test network groups, respectively. Once deployed, this configuration would enforce one set of security rules for network resources in your Production environment, and one set for Test environment.

Another service I think which you can explore in Azure Firewall manager. Azure Firewall Manager is a security management service that provides central security policy and route management for cloud-based security perimeters. Azure Firewall allows you to create Hierarchical policies to centrally manage Azure Firewall policies across multiple secured virtual hubs. You can deploy firewall policies based on teams in your organization as shown below.

Additional references:

https://learn.microsoft.com/en-us/azure/firewall-manager/rule-hierarchy

https://learn.microsoft.com/en-us/azure/firewall-manager/policy-overview

https://learn.microsoft.com/en-us/azure/firewall-manager/fqdn-filtering-network-rules

Hope this helps! Please let me know if you have any additional questions. Thank you!

---

​​Please "Accept the answer" if the information helped you. This will help us and others in the community as well.