Control PaaS Network Communications with Network Security Perimeter

Network Security Perimeter Feature Deep Dive

Key Concepts:

• Network Security Perimeter (NSP): A new Azure resource that provides centralized network security controls for PaaS resources.
• Profiles: Sets of inbound and outbound rules within an NSP that can be applied to specific resources.
• Managed Identity: A requirement for resources within an NSP to authenticate and authorize communication.
• Learning Mode: An initial state where the NSP logs traffic but doesn't enforce rules, allowing for policy refinement.
• Enforced Mode: A state where only traffic matching NSP rules is allowed, overriding resource-level firewall settings.
• Secured by Perimeter: A setting on resources that blocks all inbound and outbound traffic until associated with an NSP.

1. Introduction to Network Security Perimeter (NSP)

The video introduces the Network Security Perimeter (NSP) feature in Azure, designed to enhance network security for Platform-as-a-Service (PaaS) resources. Traditionally, controlling network traffic to and from PaaS resources has been challenging, especially for those that don't integrate directly with virtual networks (VNets). NSP aims to address these limitations by providing a centralized and consistent way to manage inbound, outbound, and PaaS-to-PaaS communication.

2. Challenges with Existing PaaS Network Security

The video highlights several challenges with the existing approach to PaaS network security:

• Incomplete Controls: Missing inbound, outbound, and PaaS-to-PaaS controls across different Azure services. Azure Monitor was given as an example of a service that lacks inbound control.
• Inconsistent Configuration: Network configuration is performed at a per-resource level, varying by resource type and leading to inconsistencies.
• Difficult Auditing: It's hard to audit access in a consistent manner due to the per-resource configuration.
• Data Exfiltration: Stopping data exfiltration is difficult due to limited outbound controls.
• PaaS-to-PaaS Access: Controlling which PaaS resources can communicate with each other has been limited, often only available at the resource provider level (e.g., all storage accounts).

3. How Network Security Perimeter Solves the Problems

NSP addresses these challenges by:

• Centralized Control: Creating a network security perimeter resource to associate different Azure resources.
• Simplified Service-to-Service Communication: PaaS resources within the same NSP instance can communicate with each other by default.
• Inbound and Outbound Rules: Defining inbound and outbound rules for all resources within the NSP, providing a consistent experience.
• Full Logging: Providing comprehensive logging for allowed and denied traffic, enabling auditing and monitoring.

4. NSP Configuration and Operation

The video outlines the following steps for configuring and using NSP:

1. Create an NSP Instance: Create a new instance of the network security perimeter resource.
2. Associate Azure Resources: Associate specific instances of Azure resources (e.g., storage accounts, key vaults) with the NSP.
3. Enable Managed Identity: Ensure that any resource within the NSP that supports it has a managed identity assigned (either system-assigned or user-assigned). The token from the managed identity is populated with the NSP ID.
4. Configure Profiles: Define profiles within the NSP, each containing inbound and outbound rules. At least one profile (default profile) is required.
5. Define Inbound Rules: Specify source IP ranges or subscriptions allowed to access resources within the NSP. NSP cannot be specified as a source today.
6. Define Outbound Rules: Specify fully qualified domain names (FQDNs) that resources within the NSP are allowed to access.
7. Set Access Mode: Configure the access mode for each resource within the NSP:
   • Learning Mode (Transition): Logs traffic and evaluates against NSP rules, but doesn't enforce them. Traffic is allowed if either the NSP rules or the resource's own firewall configuration allows it.
   • Enforced Mode: Only traffic matching NSP rules is allowed, overriding the resource's own firewall configuration.
8. Configure Diagnostic Settings: Enable diagnostic settings to collect logs of allowed and denied traffic. Send logs to a Log Analytics workspace, storage account, or event hub. The Log Analytics workspace must be in the same NSP.
9. Analyze Logs: Use the NSP access logs table in Log Analytics to analyze traffic patterns and refine NSP rules.

5. Key Considerations and Best Practices

• Managed Identity is Crucial: Resources must have a managed identity enabled to participate in the NSP.
• One NSP per Resource: A resource can only belong to one NSP at a time.
• Least Privilege: Apply the principle of least privilege when defining NSP rules, granting only the necessary access.
• Learning Mode First: Always start in learning mode to understand traffic patterns before enforcing rules.
• Service Endpoints vs. Private Endpoints: Service endpoints will not work with NSP. Use private endpoints instead. Private endpoints will continue to function without any special configuration.
• Secured by Perimeter: Use the "secured by perimeter" setting on new resources to block all traffic until the resource is associated with an NSP.
• Azure Policy: Use Azure Policy to automatically configure the "secured by perimeter" setting on new resources and associate them with a default NSP.

6. Demonstration and Examples

The video demonstrates the NSP configuration process in the Azure portal, including:

• Creating an NSP instance.
• Adding resources to the NSP.
• Configuring inbound and outbound rules.
• Setting the access mode.
• Viewing NSP access logs in Log Analytics.
• Setting "secured by perimeter" on a storage account.

7. Conclusion

The Network Security Perimeter feature provides a powerful and consistent way to enhance network security for PaaS resources in Azure. By centralizing network controls, simplifying service-to-service communication, and providing comprehensive logging, NSP helps organizations protect their data and prevent data exfiltration. The key takeaways are to understand the importance of managed identities, start with learning mode, and apply the principle of least privilege when configuring NSP rules.