Alternative to closing ports used by Azure Virtual Network Gateway

Question

It is to my understanding that Azure Virtual Network Gateway requires some ports to be open for Azure infrastructure communucation and that there was no way to close said ports on the Network Gateway. My question is if there is an alternative or compensating control that can be applied to close the port (Azure firewall, NSG etc.)

I came accross these similar questions but was not able to find an answer

https://learn.microsoft.com/en-us/answers/questions/1382462/how-to-deny-traffic-on-port-20000-of-the-public-ip

https://learn.microsoft.com/en-us/answers/questions/1313000/disable-port-7999-8081-for-azure-vpn-gateway

https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-vpn-faq#gatewayports

Answer 1

@jimmy cao

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to know if there are any alternatives to make the opened ports of Azure VPN Gateway inaccessible.

• Unfortunately, this is not feasible.
• The ports are in listening state so that the platform can access it via these ports. If we were to block it using Azure Firewall or NSG, that would not help the case.
• The documents and reference Q&A threads shared by you are correct.

This is by design of the product and we cannot override this.

Also, see : Gateway subnet considerations

Thanks,

Kapil

---

Please Accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer.