Control ingress and egress traffic for a single virtual machine Forced tunneling Default route for a gateway that send all Block outbound Internet non-local traffic to the customer's traffic in a virtual network edge router for processing. Block inbound traffic in a virtual network ExpressRoute is Can be combined with Azure Public implemented at the BGP peering to route traffic from inside a routing level. Provides VNet to Azure Public services via an defense-in-depth by role router or firewall. separation. Firewall appliances – Software-based firewall that can be Need additional firewall single network placed between virtual machines and the protection from the Internet adapter Internet. Requires all traffic to be routed Want traffic flow control of through the firewall, typically by using all virtual machine traffic agents and IPsec. Want to log and monitor traffic Firewall appliances – Software-based firewall that can be Need additional firewall dual network adapters placed between subnets or between a protection from the Internet subnet and the Internet and also need high throughput. Want packet capture and inspection Want detailed logging IPsec Traffic authentication and encryption at Want to use policy-based the server level. Requires machines to be traffic encryption domain joined, Want to control which servers can communicate with each other Hardware firewall Placing a hardware firewall appliance at Want to control ingress and appliances at the the customer’s network edge egress traffic between Azure network edge and on-premises
Control ingress and egress traffic for a single virtual machine Forced tunneling Default route for a gateway that send all non-local traffic to the customer's edge router for processing. Can be combined with Azure Public peering to route traffic from inside a VNet to Azure Public services via an router or firewall. Block outbound Internet traffic in a virtual network Block inbound traffic in a virtual network ExpressRoute is implemented at the BGP routing level. Provides defense-in-depth by role separation. Firewall appliances – single network adapter Software-based firewall that can be placed between virtual machines and the Internet. Requires all traffic to be routed through the firewall, typically by using agents and IPsec. Need additional firewall protection from the Internet Want traffic flow control of all virtual machine traffic Want to log and monitor traffic Firewall appliances – dual network adapters Software-based firewall that can be placed between subnets or between a subnet and the Internet Need additional firewall protection from the Internet and also need high throughput. Want packet capture and inspection Want detailed logging IPsec Traffic authentication and encryption at the server level. Requires machines to be domain joined, Want to use policy-based traffic encryption Want to control which servers can communicate with each other Hardware firewall appliances at the network edge Placing a hardware firewall appliance at the customer’s network edge Want to control ingress and egress traffic between Azure and on-premises
Hybrid%20Cloud%20-%20Azure%20Reference%20Architecture%20-%20Partner.docx