Virtual Appliance Scenarios The following series of scenarios have been developed and are currently being turned into reference implementations. The diagrams show the scenario network connectivity. NSGs are represented at the subnet level with a shield . UDR are represented at the subnet level using a symbol. Scenario Name Type Appliances Description Protect On premises Ingress Firewalls Leverage NVAs to firewall off ingress access to Azure and restrict resources routing of traffic to on premises destinations. Typically used when the customer has applications that exist in one or more public clouds and want to use Azure as the guardian to on premises. Monolithic Ingress Firewalls Leverage NVAs to control ingress traffic via Azure. Traffic is allowed to Application flow to the UI tier of the monolithic application, but any traffic flow between the layers of the app leverage NSGs to control flow Monolithic Ingress Firewalls Leverage NVAs to control ingress traffic via Azure. The NVAs are also Application with connected to every subnet tier of the application and all traffic flow NVA flow must go through the NVAs. This can be implemented with a single backend NIC or multiple, the preferred approach is multiple NICs to ensure performance. Multiple NVA Stack Ingress Firewalls Expanded version of the Protect On Premises Resources scenario where additional NVA are added in series to provide additional IPS/IDS protection. Public Peering Egress Layer 7 Web Leverage L7 WAF devices to control what Azure based traffic can Application connect to on premises or via a public Peering connection. This is Firewall focused on data loss prevention and requires any system in Azure to flow through the L7 appliances to get to public peering. This allows the customer to control what traffic can flow and to what Azure public services via FQDN limitations. Shared Security Ingress Firewalls Leverages a multi-tier security stack in Azure to provide a Stack replacement to an on premises security stack. This allows customers IPD/IDS to monitor, log, and control all ingress traffic. This is a highly complex Load Balancers implementation and requires multiple vendor solutions typically. L7 Web Application Firewalls
Virtual Appliance Scenarios The following series of scenarios have been developed and are currently being turned into reference implementations. The diagrams show the scenario network connectivity. NSGs are represented at the subnet level with a shield . UDR are represented at the subnet level using a symbol. Scenario Name Type Appliances Description Protect On premises resources Ingress Firewalls Leverage NVAs to firewall off ingress access to Azure and restrict routing of traffic to on premises destinations. Typically used when the customer has applications that exist in one or more public clouds and want to use Azure as the guardian to on premises. Monolithic Application Ingress Firewalls Leverage NVAs to control ingress traffic via Azure. Traffic is allowed to flow to the UI tier of the monolithic application, but any traffic flow between the layers of the app leverage NSGs to control flow Monolithic Application with NVA flow Ingress Firewalls Leverage NVAs to control ingress traffic via Azure. The NVAs are also connected to every subnet tier of the application and all traffic flow must go through the NVAs. This can be implemented with a single backend NIC or multiple, the preferred approach is multiple NICs to ensure performance. Multiple NVA Stack Ingress Firewalls IPS/IDS Expanded version of the Protect On Premises Resources scenario where additional NVA are added in series to provide additional protection. Public Peering Egress Layer 7 Web Application Firewall Leverage L7 WAF devices to control what Azure based traffic can connect to on premises or via a public Peering connection. This is focused on data loss prevention and requires any system in Azure to flow through the L7 appliances to get to public peering. This allows the customer to control what traffic can flow and to what Azure public services via FQDN limitations. Shared Security Stack Ingress Firewalls IPD/IDS Load Balancers L7 Web Application Firewalls Leverages a multi-tier security stack in Azure to provide a replacement to an on premises security stack. This allows customers to monitor, log, and control all ingress traffic. This is a highly complex implementation and requires multiple vendor solutions typically.
Hybrid%20Cloud%20-%20Azure%20Reference%20Architecture%20-%20Partner.docx