Azure Firewall and VPN for remote user

Question

We have servers in a remote location, and I am currently able to access them through a VPN client. However, I now need to set up a firewall and VPN with a dedicated public IP. Additionally, I would like to enable site-to-site VPN. If I connect to the Azure VPN, my local laptop's public IP should match the Azure public IP. Is this feasible? Could you please help me on that

Answer 1

@network

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

Let's call the 3rd party where the 5 servers reside as "ServerProvider"

Can you establish a S2S Connection from Azure VPN to "ServerProvider"?

• If so, you can follow Silvia Wibowo's answer.
• This will work provided that ServerProvider supports S2S and BGP.

Or your intention is to use a fixed public IP to connect to the servers?

• If so, your flow becomes something like this
  Employees' laptops ---> VPN P2S---> Azure VPN Gateway ---> Azure Firewall---> ServerProvider
• In this case, you have 2 ways to configure this

#1 Use vWAN with Secured Hub and Routing Intent

• This should be straight forward to setup and does not require additional configuration and validation from your end.
• Deploy a vWAN with SecuredHub and enable "Internet Traffic Routing Policy"
• Deploy a P2S Gateway in the same vWAN (same secured Hub)
• Now, all the traffic destined to Internet will go via the Azure Firewall deployed in the Hub
• 

#2 Use Azure VPN Gateway with custom Routing and Azure Firewall

• Unlike the #1, this is complex and requires you to manually set the routing.
• Deploy a Azure VPN Gateway with P2S enabled and an Azure Firewall on the same VNET.
• In the P2S configuration, advertise the ServerProvider's IP Address - Advertise custom routes for P2S VPN clients
• In the GatewaySubnet, attach a route table to forward traffic destined to ServerProvider's IP Address to the Azure Firewall IP.

In either case, make sure there are Allow Rules configured in the Azure Firewall so as to it will not block the traffic.

All the outgoing traffic would now use the IP of the Azure Firewall.

You may wonder if you can bypass the Azure Firewall,

• Unfortunately, that is not the case
• You must have an NVA - either Azure Firewall or a 3rd party NVA if you want to make internet connectivity.
• This is because Internet connectivity is not provided through the VPN gateway. As a result, all traffic bound for the Internet is dropped.
  • See : https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-p2s-advertise-custom-routes#forced-tunneling
  • 

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

---

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.