Network Posture Beyond the Firewall Slide

The architecture deck shows a firewall icon in the hub. The auditor asks how you prevent lateral movement inside a spoke. Silence. Someone opens a drawing of NSGs from 2023 that never matched Terraform state.

Firewall is necessary. It is not the whole posture. Posture is UDRs that still exist, NSGs that mean something, private endpoints that actually resolve, and Deny policies that block the public path.

This is article five of Series 3. Networking covered the hub. Series 2 covered workload connectivity choices. This article is what you prove when someone asks whether the slide is still true.

Layers you can explain in one breath

If you cannot explain the layers without a thirty-minute preamble, the design is too clever for audit season and too clever for 3 a.m.

Edge / ingress. Azure Front Door, Application Gateway, WAF policies. Where public HTTP meets you on purpose.
Hub inspection. Azure Firewall or NVA. North-south egress and the east-west hairpins you chose to inspect.
Spoke NSG / ASG. Subnet controls for what still rides the VNet (VMs, private endpoints’ NIC path, pod network when you go that route).
Private Link. PaaS not exposed on the public Internet. DNS that resolves to the private endpoint.
Policy. Deny public IP on NICs, deny public network access on storage and Key Vault, deny open management ports from *.

Write gaps with owners. “We will add WAF later” is an accepted risk only when Risk accepted it in writing. It is not defense in depth.

Hub firewall: prove the forced tunnel

The slide claims all egress goes through the firewall. Evidence is not the icon.

Prove it with:

Route tables on spoke subnets pointing 0.0.0.0/0 to the firewall private IP
No competing default routes from unexpected peerings
Firewall policy rules that match what you claim you allow
Diagnostics to the platform workspace (AZFW* tables) so denies and allows are queryable

Logging already fought for those tables. Posture is whether the UDR still exists after someone “temporarily” attached a different route table during a migration.

ARG for missing or wrong UDRs belongs in the continuous evidence pack. If a prod subnet can reach the Internet direct, MCSB network segmentation controls are not met no matter how pretty the hub diagram is.

NSGs that earn their keep

Default deny inbound on application subnets. Allow only what the reference pattern needs. Use Application Security Groups for role membership so you are not maintaining 200 IP rules copied from an old hardware firewall.

NSGs rot when:

Rules are edited in the portal and never return to Terraform
“AllowAnyCustomAnyInbound” exists with a comment that says temporary
Every team gets Contributor on the NSG because the module interface was too strict
Platform and workload rules are mixed without a baseline

Put baseline NSGs in the spoke module. Workloads add rules through module variables or a documented extension pattern. Portal edits are drift. Drift fails the next apply or survives as a second source of truth. Both are bad.

NSGs are not a substitute for the hub firewall. They are not useless because the firewall exists. Different layer. Different question. Auditors who ask about lateral movement inside a spoke are asking about this layer, even when your deck only shows the hub.

Private Link is DNS or it is nothing

Private endpoints without private DNS zone links produce the classic Monday outage: connection times out, or worse, still resolves publicly when public access was left enabled.

Posture checklist per PaaS pattern:

Private endpoint created in the right subnet
Private DNS zone exists for that privatelink.* zone
Spoke VNet linked to the zone (platform-owned zones stay platform-owned)
Public network access disabled when the standard says so
Policy Audit/Deny aligned with that standard

Identity failed the day an app team got Contributor on the hub “so they can add a DNS record.” DNS records for private endpoints belong in a platform pipeline or a tightly scoped role on the zone.

Evidence is ARG for publicNetworkAccess == Enabled on storage, SQL, Key Vault, and the other types you care about. A firewall screenshot does not prove blobs are private.

WAF is not optional for public HTTP

If you terminate public HTTP without a Web Application Firewall, say so as accepted risk. Do not claim defense in depth on the slide.

Managed WAF rulesets (OWASP, bot protection where you enable it) need ownership:

Who tunes false positives?
Who approves exclusions?
Who gets the alert when the WAF blocks a surge that might be an attack?

Untuned WAF becomes noise. Noise gets exclusions that look like .* on a Friday. That is the same discipline failure as suppressing Defender alerts to protect a score.

Front Door and Application Gateway both can carry WAF policy. Pick the edge pattern in the spoke contract. Do not let every team invent a third.

Management plane ports are still a thing

PaaS-heavy estates still grow jump boxes, build agents, and “temporary” VMs with RDP or SSH open to the Internet. Policy should Deny inbound from * on 22/3389 at the NIC or NSG path you standardize on. Just-in-time access via Defender for Servers is a mitigation for VMs you still run, not a reason to leave permanent allow rules.

If your landing zone claims “no public management endpoints,” ARG should return zero public IPs on NICs in prod management groups. Zero means zero. Exceptions go through exemption resources with expiry.

What Deny policy proves (and what it does not)

Claim on the slide	Evidence that works	Evidence that fails
No public storage in prod	Policy Deny + ARG for public access	Firewall icon
Egress inspected	UDR presence + firewall logs	Visio hairpin
No public IPs on spokes	Deny public IP + ARG	“We use Private Link” narrative
Segmentation between tiers	NSG baseline in module + effective rules review	Flat allow between all ASGs
WAF in front of apps	WAF policy assignment on the gateway/Front Door	Marketing diagram

Deny prevents new bad configurations. It does not rewrite history. Remediate existing noncompliance, then Deny. Continuous evidence watches for stragglers and exemptions.

East-west: be honest about what you inspect

Many hubs force outbound Internet through Azure Firewall but allow spoke-to-spoke or spoke-to-hub freely on private IPs. That can be fine. It is not the same as “microsegmentation everywhere.”

Write the actual model:

Forced tunnel egress only. Common, defensible, limited lateral control.
Hairpin east-west through firewall. Higher cost, more rule churn, stronger inspection story.
NSG-heavy segmentation inside spokes. Works for VM tiers; less natural for some PaaS patterns.

MCSB network controls care that you intended a model and can show enforcement. They do not require you to pretend Azure Firewall sees every packet if your UDRs say otherwise.

Evidence queries for the weekly ritual

Keep these in the evidence repo (adjust types and tags to your estate):

Resources
| where type =~ "microsoft.network/networkinterfaces"
| where isnotempty(properties.ipConfigurations)
| mv-expand ip = properties.ipConfigurations
| where isnotempty(ip.properties.publicIPAddress.id)
| project name, resourceGroup, subscriptionId, publicIp = ip.properties.publicIPAddress.id

Resources
| where type =~ "microsoft.storage/storageaccounts"
| where properties.publicNetworkAccess =~ "Enabled"
| project name, resourceGroup, subscriptionId, tags

Resources
| where type =~ "microsoft.sql/servers"
| extend fw = properties.publicNetworkAccess
| where fw =~ "Enabled"
| project name, resourceGroup, subscriptionId

Add a query for spoke subnets missing the expected route table association. Add another for NSGs that still contain a rule named like AllowAll or with source and destination for inbound.

Run them in the same ritual as article three. Network posture that only exists during architecture reviews will not survive the first migration weekend.

Tie-back to Defender and MCSB

Defender for Cloud will recommend enabling NSG flow logs, fixing public exposure, and related network hygiene. Some recommendations overlap Policy. Prefer Policy Deny for the configurations you have already decided. Use Defender for residual exposure and for threat detections on network-adjacent plans you enabled on purpose.

MCSB network segmentation and perimeter controls should point at: hub firewall policy assignments, UDR module standards, NSG baselines, Private Link standards, and the Deny policies above. One control ID, one set of artifacts. No competing stories between network and security teams in the audit room.

Private Link DNS ownership as a posture control

Platform owns the zones. Workloads create endpoints. That split is a security control, not only an ops convenience. When app teams create duplicate privatelink.* zones, resolution becomes non-deterministic across spokes. Attackers do not need that chaos. Operators create it for you.

Publish the zone list. Add zones through the platform catalog. Link VNets through the platform pipeline. Evidence for MCSB network and data controls should include the zone inventory and ARG proof that prod storage, SQL, and Key Vault are not public.

Private endpoint NIC health and connection state belong in pre-prod checklists. A private endpoint in a failed provisioning state is not posture. It is a ticket labeled done.

Flow logs and Traffic Analytics without surprise bills

NSG flow logs and Virtual Network flow logs help investigations. They also ingest. Decide where logs land (storage vs analytics) and whether Traffic Analytics is on because someone needs it, not because a checkbox felt responsible.

Cost already taught you that dual flow-log paths bill you twice. Security posture does not require every VNet on the most expensive setting. It requires that the VNets in scope for IR have enough signal to answer “who talked to whom” in the window you claim you can investigate.

Document the standard in the same place as the spoke module. On-call should not discover flow logs during an incident by enabling them after the fact and finding empty storage.

Effective routes and effective security rules

When a ticket says “the firewall is broken,” check effective routes on the NIC or subnet before you rewrite policy. When a ticket says “NSG is blocking us,” check effective security rules. Portal effective views and az network commands beat guesswork.

Posture reviews should sample effective routes on a prod spoke quarterly. Confirm 0.0.0.0/0 still aims at the firewall private IP. Confirm no unexpected peering introduced a wider path. This is boring work. Boring work is how the slide stays true.

Next: Secure SDLC for IaC. PR gates, OIDC, policy-as-code, and break-glass PRs that return to state.

Randy Bordeaux

Azure Trainer | Veteran | Engineer

Helping IT professionals grow through cloud, leadership, and shared knowledge.