topic Re: Filter VNET Peering traffic in Cloud Firewall

Filter VNET Peering traffic

CP-NDA — Tue, 17 Jan 2023 11:31:33 GMT

Hi,

We are setting up some VNET Peerings between multiple subscription

VNET Peering are UP and connected however we are not able to filter traffic coming from these VNET (Peered) via the CloudGuard GW

When working with local subnet we jut change the UDR to use CloudGuard as a Gateway however that feature is not availbale with the VNET Peering.

Do we need to implement a Transit GW ?

Is there any documentation / support on this setup ?

Thank you

Re: Filter VNET Peering traffic

Nir_Shamir — Tue, 17 Jan 2023 11:45:03 GMT

Hi,

what you need to do is to add a UDR in the peered subnet (the one that is peered to the GW vNet) and forward the traffic that you need inspected to the GW IP (if its a single GW) or the Internal-LB IP (if it's a cluster or VMSS).

the peered subnet can reach that IP because of the peering and will route the traffic directly to the GWs via the peering connection.

Re: Filter VNET Peering traffic

CP-NDA — Tue, 17 Jan 2023 11:47:24 GMT

Hi @Nir_Shamir

I will do the test but in terms of security we are not managing the second tenant. So if the UDR is changed that means they will have full access to our VNET?

How can we control that setting ?

Thank you

Re: Filter VNET Peering traffic

Nir_Shamir — Tue, 17 Jan 2023 12:02:44 GMT

you can deploy NSGs on your Subnets.

Also if you Subnets have UDRs to have the return traffic go through the Firewall then even if they don't do the UDR on their end they might reach your resources directly but the return traffic will go through the Firewall which will drop those connections as Out Of State and they won't be able to reach them or open any connections to them.

Re: Filter VNET Peering traffic

CP-NDA — Tue, 17 Jan 2023 12:18:02 GMT

@Nir_Shamir Indeed we've been able to validate the Out of state during our tests but I though that it would be possible to have a more secure and best solution. the traffic should not hit the machines even if they change the UDR

I will check with NSG to only allow connection to CloudGuard from the remote tenant

Thank you !