Creating an SFTP server with firewall on Azure (Non Native)

Question

My client organization is using checkpoint firewall. They want us to create an SFTP server with the checkpoint firewall between sftp client and blob storage. Note I know how to setup Azure native SFTP with Azure firewall. It is low maintenance and low effort. But I want to present all the options with client so that we can take an informed decision. So here are some of the questions.

1. How do I approach this problem (Non native SFTP)?
2. Before Azure introduced native support for SFTP on BLOB storage, how did the Azure community created SFTP servers?
3. What would be the cost benefit analysis of the two options - Option 1: Native SFTP support on Azure BLOB Storage, Option 2: Non native SFTP server with a 3rd party firewall.

I believe these can help me take informed decision.

Thanks!

Answer 1

HI @Shashwat Tiwary

We noticed that you rated an answer as not helpful. We value your feedback and want to help you further and share a detailed answer If the below response answered your query, please click "Accept as answer" as a token of appreciation.

Historical approach before native SFTP Support i.e., before Azure introduced native support for SFTP on Blob storage, the Azure community typically created SFTP servers by:

1. Setting Up VMs: Creating VMs on Azure to host SFTP server software.
2. Installing and Configuring SFTP Software: Installing and configuring SFTP server software on these VMs.
3. Managing Firewalls: Configuring firewalls to allow inbound SFTP traffic.
4. Maintaining Infrastructure: Regularly updating, patching, managing, and scaling the VMs and associated infrastructure.

You can refer to https://www.infoq.com/news/2022/11/sftp-azure-blob-storage/

Cost-Benefit Analysis

Option 1: Native SFTP Support on Azure Blob Storage

Pros:

• Low Maintenance: No need to manage VMs or firewalls.
• Scalability: Easily scalable without additional infrastructure.
• Security: Inherits Azure Blob Storage’s security features.
• Cost Saving: Enabling SFTP has an hourly cost.

Cons:

• Limited Customization: Less flexibility in configuring the SFTP server compared to a VM-based setup.

Option 2: Non-Native SFTP Server with 3rd Party Firewall

Pros:

• Customization: Full control over the SFTP server configuration.
• Integration: Can integrate with existing security infrastructure like Checkpoint firewall.

Cons:

• Higher Maintenance: Requires managing VMs, firewalls, and regular updates.
• Complexity: More complex to set up and maintain.
• Cost: Costs for VM instances, firewall management, and potential additional licensing fees for third-party software

Conclusion:

The native SFTP support on Azure Blob Storage is generally more cost-effective and easier to manage, making it suitable for most use cases. However, if your client requires specific configurations or integrations with existing security infrastructure, a non-native SFTP server with a Checkpoint firewall might be the better option.

Would you like more details on any specific aspect of these options?

(Non-Native SFTP), as suggested in the earlier response by Vikas

To create a non-native SFTP server with a Checkpoint firewall between the SFTP client and Blob storage, you need to follow below steps:

1. Create a Virtual Machine (VM): Set up a VM on Azure.
2. Install SFTP Server Software: Install an SFTP server software like OpenSSH, FileZilla, or WinSCP on the VM.
3. Configure Firewall on VM: Allow inbound traffic on port 22 (or your chosen SFTP port) using the built-in Windows Firewall or a third-party firewall software.
4. Set Up Network Security Group (NSG): Associate an NSG with the VM and allow inbound traffic on port 22 from the desired IP addresses or ranges.
5. Configure Checkpoint Firewall: Allow inbound traffic on port 22 from the VM’s public IP address.
6. Test the SFTP Server: Use an SFTP client like FileZilla or WinSCP to connect to the SFTP server using the VM’s public IP address and SFTP port.

Hope this helps! Please feel free to comment and tag me in your comments. and Accept Answer and hit Yes for "was this answer helpful" if this helps.

Answer 2

Hello Shashwat Tiwary

Welcome to Microsoft Q&A Platform, thanks for posting your query here.

To approach this problem of creating an SFTP server with a Checkpoint firewall between the SFTP client and Blob storage, you can follow these steps:

Create a virtual machine (VM) on Azure and install an SFTP server software on it. There are several SFTP server software options available, such as OpenSSH, FileZilla, and WinSCP.

Configure the firewall on the VM to allow inbound traffic on port 22 (or the port you have chosen for SFTP). You can use the built-in Windows Firewall or install a third-party firewall software.

Create a network security group (NSG) on Azure and associate it with the VM. In the NSG, allow inbound traffic on port 22 (or the port you have chosen for SFTP) from the IP addresses or IP ranges that you want to allow.

Configure the Checkpoint firewall to allow inbound traffic on port 22 (or the port you have chosen for SFTP) from the VM's public IP address.

Finally, you can test the SFTP server by connecting to it from a client software, such as FileZilla or WinSCP, using the VM's public IP address and the SFTP port number.

Before Azure introduced native support for SFTP on Blob storage, I assume that the Azure community created SFTP servers using the same approach as described above. They would create a VM on Azure, install an SFTP server software on it, and configure the firewall to allow inbound traffic on the SFTP port.

In terms of cost-benefit analysis, the native SFTP support on Azure Blob storage is a low-maintenance and low-effort option, as you mentioned. It eliminates the need for a separate VM and firewall configuration, and it provides a more secure and scalable solution. However, if your client organization requires a Checkpoint firewall between the SFTP client and Blob storage, then the non-native SFTP server with a 3rd party firewall may be the only option.

In this case, the cost and effort of setting up and maintaining the VM and firewall should be considered, as well as the potential security risks and scalability limitations of this approach.

Hope this helps.
If the suggested response helped you resolve your issue, please 'Accept as answer', so that it can help others in the community looking for help on similar topics.