how to configure traffic pass through onpermis firewall to azure firewall

Rijo Joy 40 Reputation points
2024-04-02T10:32:59.5766667+00:00

hi

My Architecture design

On-premise

Sophos firewall

configuration

site to site VPN (Azure) established

static route configure

10.60.0.0/16

windows server(172.16.16.0/24)

AZURE - Hub and Spoke design

HUB VNet -Deployed (10.50.0.0/16)

  • Azure firewall - (10.50.0.0/26)
  • VPN Gateway -(10.50.1.0/27)

SPOKE VNet Deployed (10.60.0.0/16)

  • VM - (10.60.0.0/24)

Setup Configured

  • VPN-Gateway Deployed
  • Local Gateway deployed
  • Site 2 Site VPN connection established

Peering

  • Hub-VNet to Spoke VNet establish (using Gateway transits)

Routing table configuration

  • HUB -routing destination address (10.60.0.0/16) ->next hope -> azure firewall Private IP Associated Subnet HUB Gateway Subnet
  • Spoke-Routing any traffic spoke pass through Azure Firewall destination address (0.0.0.0/16) ->next hope -> azure firewall Private IP Associated Subnet Spoke Subnet VM

  • I'm trying to connect RDP (azure VM spoke 10.60.0.4) from On-premise windows server connection not establish but ping azure firewall private address working (10.50.0.4)

User's image

kindly need support how i can connect spoke VM from On-premise

Azure VPN Gateway
Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
1,535 questions
Azure Firewall
Azure Firewall
An Azure network security service that is used to protect Azure Virtual Network resources.
666 questions
Azure Virtual Network
Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
2,448 questions
0 comments No comments
{count} votes

Accepted answer
  1. GitaraniSharma-MSFT 49,601 Reputation points Microsoft Employee
    2024-04-02T11:10:31.7166667+00:00

    Hello @Rijo Joy ,

    Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

    I understand that you have a hybrid network setup with site-to-site VPN connection between Azure and on-premises and the Azure network has a hub and spoke topology. You have setup the route tables for the traffic routing from your on-premises to the spoke Vnet, but it is not working and you are unable to RDP into the spoke VM from your on-premises machine.

    This setup is documented in the below article:

    User's image

    Refer: https://learn.microsoft.com/en-us/azure/firewall/tutorial-hybrid-portal-policy

    Please validate the Prerequisites section below,

    User's image

    • You need to make sure that the Vnet peering between the hub Vnet and Spoke Vnet has "Gateway Transit" enabled.
    • To route all spoke Vnet traffic to the Azure Firewall, you need a UDR on the spoke Vnet subnets with destination 0.0.0.0/0 pointing to next hop Azure Firewall with Virtual network gateway route propagation option disabled.
    • And a UDR on the hub gateway subnet with destination as the spoke Vnet address space pointing to the next hop Azure Firewall IP address.
    • Lastly, you also need to configure network rule within the Azure Firewall to allow RDP traffic to the spoke Vnet, where source should be your on-premises network as below:
    1. Name, type AllowRDP.
    2. For Source type, select IP address.
    3. For Source, type the address space of your on-premises network.
    4. For Protocol, select TCP.
    5. For Destination Ports, type 3389.
    6. For Destination type, select IP address.
    7. For Destination, type the address space of your spoke Vnet
    8. Select Add.

    Refer: https://learn.microsoft.com/en-us/azure/firewall/tutorial-hybrid-portal-policy#configure-network-rules

    Please validate if all the above configurations have been added correctly to your setup.

    Kindly let us know if the above helps or you need further assistance on this issue.


    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.


0 additional answers

Sort by: Most helpful

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.