Do not let ExpressRoute, VPN and SDWAN traffic bypass your firewall

I have recently expanded my SDWAN in hub-and-spoke networks design guide to include SDWAN-to-firewall routing. Initially I didn’t have this point, but recent conversations have made me realize that not everybody understand this.

The main difficulty in this topic is related to the fact that you cannot inspect the…

25/03/2024 Article Bloggers Jose Moreno

Share:

You may be interested in

Private Link reality bites: Azure Firewall app rules
Welcome to the fourth post in the Private Link Reality Bites series! Before we begin, let me recap the existing episodes of the series: Private Link reality bite #1: endpoints…
10/02/2025
Cilium Network Policy in AKS
If you are following the Azure Kubernetes Service space, I am sure you noticed that Azure CNI powered by Cilium is Generally Available. But is this a big thing? What…
16/06/2023
Power Automate and KQL integration
If you are working with Azure, you will probably have some logs or data stored in a repository such as Azure Data Explorer or Log Analytics. Kusto Query Language (KQL)…
06/12/2024
Getting visibility into your Azure Traffic with NSG Flow Logs
In every network you want to know what traffic is using it. Networking devices offer multiple options to report on traffic, such as Netflow, sFlow or IPFIX. However, these options…
20/04/2023
Private Link reality bites – Your routes could be lying
Welcome to the second post in the Private Link Reality Bites series! After the first post where we went over the concept of private endpoints as control plane elements, in…
22/01/2025
Grafana and VNet Flow Logs
I would like to credit for this blog post to Abhishek Sharma, talking to him gave me the main inspiration for some of the concepts you are going to see…
20/03/2025
You want to use AS-path as your virtual hub routing preference
Wow, that was a long title. Let me give you another one: if you haven’t tested your High Availability (HA) or Disaster Recovery (DR) plans, you shouldn’t rely on them.…
02/05/2023
Application Gateway for Containers: a not-so-gentle intro (2)
Have you ever have the feeling that something that should be easy turns into a mine field when you start working on it? I seem to be a specialist in…
10/03/2025
DRY Terraform code for Private Link and DNS
After last week’s almost-philosophical post on network complexity, let’s move on to more mundane tasks. Today I will focus on how to write efficient Terraform code to connect private endpoints…
19/08/2023
Azure Firewall and Service Endpoints
In my recent blog series Private Link reality bites I briefly mentioned the possibility of inspecting Service Endpoints with Azure Firewall, and many have asked for more details on that…
14/04/2025
ExpressRoute traffic visibility: Flow Logs or Traffic Collector?
You might have heard about VNet Flow Logs, I posted about this new Azure feature here. One of the applications of VNet Flow Logs is to gain visibility into traffic…
25/06/2024
Azure network monitoring with synthetic traffic
Wow, that was a mouthful. But it describes what I would like to discuss in this post. Networks are at the basis of every IT infrastructure, so when they don’t…
23/01/2024