I'm designing an Azure hub-and-spoke network with several spoke VNets connected to a hub VNet. The hub contains network virtual appliances (NVAs), and user-defined routes send spoke traffic through those appliances. I'm planning to add another VNet, but standard VNet peering makes the full address spaces of the peered VNets reachable at the virtual network level.
I want the new VNet to communicate only with specific IP prefixes that are routed through the NVA, while preventing direct access to other subnets and address ranges in the peered VNets. The NVA firewall can filter traffic that actually passes through it, but I'm concerned that this does not control traffic that can travel directly within the peered VNets.
Subnet peering might help by limiting the peering relationship to the NVA subnet, although its current limitation of allowing a subnet to participate in only one subnet peering relationship may not fit this design. NSGs are another possibility, but applying them consistently across every subnet could add management overhead.
What architecture or Azure networking feature would you recommend for enforcing connectivity only to selected prefixes?
4 Answers
Subnet peering is worth evaluating here. Instead of peering the entire virtual network, you may be able to peer only the subnet that contains the NVA. That can reduce the directly reachable scope, but check the current preview limitations carefully—particularly the restriction that a subnet can participate in only one subnet peering relationship.
NSGs can provide the prefix-level enforcement you’re looking for. Keep the existing UDRs to send traffic toward the NVA, then use NSG rules to allow the required source and destination ranges and deny the rest. The drawback is operational: you may need consistent rules on multiple subnets, and maintaining separate NSGs can become cumbersome as the environment grows.
If you use Azure Virtual Network Manager, review its security configuration and default security rules as another layer of centralized control. It may help apply consistent deny or allow policies across the relevant virtual networks, although you should validate that the available rules meet your exact prefix-filtering and routing requirements.
The NVA firewall should be used to control traffic that is deliberately routed through it. It can allow only the approved prefixes and block unwanted flows, but it is not by itself a guarantee that all traffic between peered virtual networks must traverse the appliance. You still need routing and subnet-level controls to prevent direct paths around the NVA.
Exactly. The NVA can filter transit traffic, but I’m looking for a design that also prevents unauthorized direct connectivity within the peered address spaces.
That’s my concern as well. Applying one shared NSG everywhere may be too restrictive, while managing a separate NSG for every subnet adds a fair amount of infrastructure overhead.