Ip spoofing attack in AKS

Question

Hello,

We are thinking to enable authorized IP ranges in aks to expose service only to my organisation.

If we do not add application gateway or maximum we can add the small sku of app gateway then what are the chances that our service is safe from IP spoofing attacks.

Does microsoft handles it at their level or not. Is the IP range whitelisting is enough or do we need to add any other resource to save ourselves from such attacks.

I would be grateful if someone can suggest few opensource solutions as well.

Thank you

Answer 1

@Tanul Thanks for reaching out. Azure has an integrated high-level security system to protect the customers from different network attack and malicious activity.

The IP spoofing protection also included in the whole system by applying the ACL to allow only Microsoft trusted IP being routed within Azure backbone network.

You can read more about it here : https://learn.microsoft.com/en-us/azure/security/fundamentals/production-network#connection-to-production-network-and-associated-firewalls

You can also have Azure DDos protection plan which you can read here : https://learn.microsoft.com/en-us/azure/virtual-network/ddos-protection-overview

-----------------------------------------------------------------------------------------------------------------

If the suggested response helped you resolve your issue, please do not forget to accept the response as Answer and "Up-Vote" for the answer that helped you for benefit of the community.