Share via

Does Azure S2S VPN automatically create an Access Control List in Gateway Subnet?

Blackbourn, Nathan 0 Reputation points
Nov 20, 2024, 6:59 PM

When configuring a S2S VPN.. we would normally create an ACL to bring up the vpn.. such as the following on our on prem router/firewall....

access-list 101 permit esp host X.X.X.X host X.X.X.X

access-list 101 permit udp host X.X.X.X eq isakmp host X.X.X.X

access-list 101 permit udp host X.X.X.X eq non500-isakmp host X.X.X.X

I see there is a spot to allow an NSG on the GatewaySubnet.. but it is not recommended for it and others have commented that it will break communications for the VPN and Azure... so perhaps Azure automatically creates a similar Access-list that we don't see within the Public interface on the Gateway?

Azure VPN Gateway
Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
1,567 questions
{count} votes

1 answer

Sort by: Most helpful
  1. Rohith Vinnakota 1,245 Reputation points Microsoft Vendor
    Nov 20, 2024, 8:51 PM

    Hi Blackbourn, Nathan,

    I understand your concern about whether an Azure Site-to-Site (S2S) VPN automatically creates an Access Control List (ACL) in the Gateway Subnet.

    Azure does not create an Access Control List (ACL) in the GatewaySubnet when you create a S2S VPN connection. Instead, Azure creates a default security rule that allows all traffic from the on-premises network to the GatewaySubnet. This rule is created when you create a VPN Gateway and cannot be modified or deleted.

    I see there is a spot to allow an NSG on the GatewaySubnet.. but it is not recommended for it and others have commented that it will break communications for the VPN and Azure

    yes, you're correct.

    If you have any further queries, do let us know.

     Thanks,
    Rohith

    Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

    User's image

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.