Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 2 replies
  • Subscribers 27 subscribers
  • Views 789 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Static Route Bypasses Firewall Rules? Azure configuration

Kenneth Primmer

I've done a fair bit of searching and reading on this forum and cannot find answers to the behavior I'm seeing. Here's the overview followed by my questions.

I have an XG Firewall deployed in Azure. Setup is pretty much spot on the documentation for this and nothing particularly fancy. XG is the gateway for all internet traffic.

Azure VNET is simple - one 'external' on PortB (10.5.0.0/24)

Another 'internal' on PortA (10.5.1.0/24) - No resources reside in this 'DMZ' network - again per the documentation.

Two more subnets are present for resources:

'APP' - 10.5.2.0/24 - Currently a file server and an active Directory server are in this subnet

'WEB' - 10.5.255.0/24 - a front end web server is present here and needs to securely communicate with the AD server and the App server

A static route is set on the XG as per the documentation to supposedly route the subnet traffic through the LAN port. Routing tables have been properly added in Azure, again as per the sophos documentation. All servers can currently communicate with the internet and each other.

Here's the issue - I need to filter and lock down the specific traffic between the 10.5.2 and the 10.5.255 subnet and also log the traffic. I set up a firewall rule for the traffic between these subnets. To test I create a FW rule at the top to drop all traffic between those subnets. They should now no longer be able to communicate at all with each other. But that isn't the case - I can ping all day across the subnets. I see no traffic at all hitting the FW rule. Secondly, I delete the static routes in XG - no effect. Traffic still flows. So this tells me that Azure is routing the packets and NOT the XG. I genuinely don't understand what I'm missing here. This is set up according to the documentation and when I modify the Route Table in Azure everything breaks and still no traffic goes across the XG.

Has anyone successfully configured something similar or come up with a solution? Any assistance would be greatly appreciated.



This thread was automatically locked due to age.
Parents
  • +1

    This should help: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

    Per Default Azure is doing Subnet own traffic directly. You need to overwrite it. Its explained in the Azure Doc. 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    Thank you. So I had read that article already, but I went back and re-read. My previous read was coloured by the Sophos reference documentation to a degree as, while they reference multiple discreet subnets, they only ever route traffic via one with a single route table. Long and short is seems a single route table in this config will not work. The solution to push traffic from each subnet through the XG is to create a route table PER subnet, add your default internet route+internal subnet route as required and then the route for the vnet pointing to the XG/Virtual appliance. Once that is done everything is flowing as it should and can be controlled via the XG and not Azure. Thanks!

Reply
  • 0 in reply to LuCar Toni

    Thank you. So I had read that article already, but I went back and re-read. My previous read was coloured by the Sophos reference documentation to a degree as, while they reference multiple discreet subnets, they only ever route traffic via one with a single route table. Long and short is seems a single route table in this config will not work. The solution to push traffic from each subnet through the XG is to create a route table PER subnet, add your default internet route+internal subnet route as required and then the route for the vnet pointing to the XG/Virtual appliance. Once that is done everything is flowing as it should and can be controlled via the XG and not Azure. Thanks!

Children
No Data
Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?