Enhancing Cloud Security with Azure Firewall and Load Balancer Integration

In a move that underscores Microsoft's commitment to enhancing cloud security, Azure has rolled out new integration capabilities between Azure Firewall and Azure Standard Load Balancer. This exciting development is designed to help businesses create more secure and resilient network architectures tailored to their unique connectivity and security needs.

Understanding the Integration​

Azure users can now choose between public or internal load balancer configurations, which introduces a layer of flexibility and robustness to network security setups. Whether your organization opts for the visibility of a public load balancer or the simplicity of an internal setup, this integration aims to combat vulnerabilities and optimize network performance.

The Challenge of Asymmetric Routing​

At the heart of this integration lies a critical networking issue known as asymmetric routing. This problem can be particularly troublesome when deploying a public load balancer with Azure Firewall.

• What is Asymmetric Routing?
  Asymmetric routing occurs when inbound and outbound traffic takes different paths through the network. In the case of Azure Firewall, its stateful design requires that packets follow a consistent path. This becomes problematic when inbound traffic hits the load balancer but returns through a different route, causing Azure Firewall to drop these packets due to unexpected session states.

For example:

• Incoming packets arrive at the public IP address of the load balancer.
• Outbound packets utilize the firewall's private IP route.

When that happens, Azure Firewall can't match the returning packets to an existing session, leading to dropped connections.

Solutions for Asymmetric Routing​

Microsoft has provided guidance to mitigate this challenge. Here are some recommended solutions:

1. Create a Default Route: When deploying Azure Firewall, configure a default route directing packets to the firewall's private IP address within the AzureFirewallSubnet.
2. Host Route for Public IP: Establish a host route specifically for the firewall's public IP address. This route ensures that packets targeting the public IP are handled correctly, avoiding interference from the default route.

Example:

• Firewall public IP: 203.0.113.136
• Firewall private IP: 10.0.1.4

By instituting these routing protocols, you ensure that communication flows smoothly, allowing the firewall to effectively monitor and manage traffic.
To illustrate, for services like Remote Desktop Protocol (RDP), incoming traffic directed to the firewall’s public IP can be correctly routed using Network Address Translation (NAT) rules.

Simplicity with Internal Load Balancer​

For those opting for an internal load balancer, the integration proves significantly simpler and less prone to routing issues. Here’s why:

• The internal load balancer deploys a private frontend IP.
• Incoming traffic flows directly to the firewall using its public IP address, then gets translated to the load balancer's private IP.
• Outbound traffic maintains a consistent routing pathway back through the firewall.

This arrangement negates the complications associated with asymmetric routing and allows for better packet handling.

Additional Security Measures with Network Security Groups (NSGs)​

To stack even more security onto your Azure setup, it’s wise to incorporate Network Security Groups (NSGs). NSGs let you enforce specific inbound and outbound traffic rules for your subnets and virtual machines:

• You might deploy an NSG on your backend subnet housing load-balanced resources.
• Further, you can create rules that allow traffic solely from the firewall’s IP address and other designated ports.

Implementing NSGs enhances overall network security by creating an added layer of filtering and control.

Conclusion​

By integrating Azure Firewall with Azure Standard Load Balancer, Microsoft is not just enhancing security protocols but providing businesses with the tools necessary for a scalable and secure cloud infrastructure. With strategic decisions on load balancer configurations and the adoption of NSGs, Azure users can effectively navigate the complexities of network security and ensure their architectures remain resilient against emerging threats.
As you explore these new features, consider how your organization can best implement them to fortify your network against vulnerabilities in this ever-evolving digital landscape.

---

Source: Cyber Security News Microsoft Integrates Azure Firewall with Azure Standard Load Balancer to Boost Security