Do Azure Firewall at VNet blocks any log analytics workspace data

AzureUser-9588 141

I have a set of VMs spread across different VNets, these VMs logs data to Log Analytics workspace and these VNets are connected via Hub-Spoke topology. Looking to implement Azure Firewall at Hub to increase the security across my VNet resources.
Now I would like to understand if newly using a Azure Firewall at VNet will have any impact on underlying VMs sending logs to Log Analytics workspace? Do I need to explicitly enable any ports/URLs/IPs, which might be required for on-premises firewall scenarios? Are there any known issues with this setup?

1 answer

Roderick Bant 2,046 Reputation points

2020-11-11T12:00:07.593+00:00

According to the Log Analytics agent firewall requirements you should allow outbound traffic on port 443 to the following:

Agent Resource Ports Direction Bypass HTTPS inspection
*.ods.opinsights.azure.com Port 443 Outbound Yes
*.oms.opinsights.azure.com Port 443 Outbound Yes
*.blob.core.windows.net Port 443 Outbound Yes
*.azure-automation.net Port 443 Outbound Yes
Please sign in to rate this answer.
AzureUser-9588 141 Reputation points

2020-11-12T10:04:19.93+00:00

My infra doesn't have any on-premises firewalls. From the Microsoft documentation, I see that - in on-premises firewall scenario, to send data to Azure Log analytics there is a need to open up some ports etc., So I am trying to check if something similar has to be done even in the case of Azure Firewall or not.

Roderick Bant 2,046 Reputation points

2020-11-12T19:15:10.45+00:00

I agree the picture in the supplied documentation represents an on-prem connection and is not very clear if this also applies to Azure Virtual Machines too. I did not have the time to deploy an actual Azure Firewall service to specifically test this. But I did apply a network security group for a VM with an outgoing deny rule for destination port 443 for the destination 'Internet' and log analytics data stopped coming in to the Log Analytics workspace.

From that test I think it's safe to conclude the stated firewall requirements apply in all situations. If your environment allows all outbound connections on 443 you won't need to make any changes..

SaiKishor-MSFT 17,206 Reputation points

2020-11-23T21:12:18.683+00:00

@AzureUser-9588 Please let me know if you still have further questions regarding this after the above answers/clarifications to your question and we will be glad to assist you further. If the answers have helped you in anyway, please do accept the answer which will help other members of the community. Thank you!
Sign in to comment

Share via

Do Azure Firewall at VNet blocks any log analytics workspace data

1 answer