Outbound traffic from VNET integrated workloads is routed through Azure Firewall

Overview

Azure Firewall provides centralized inspection, logging, and enforcement for outbound network traffic. When you don’t route outbound traffic from virtual network (VNet) integrated workloads through Azure Firewall, traffic can leave your environment without inspection or policy enforcement. VNet integrated workloads include virtual machines, AKS node pools, App Service with VNet integration, and Azure Functions in VNet.

Without routing outbound traffic through Azure Firewall:

• Threat actors can use uninspected outbound paths for data exfiltration and command-and-control communication.
• Organizations lose consistent enforcement of egress security controls such as threat intelligence filtering, intrusion detection and prevention, and TLS inspection.
• Security teams lack visibility into outbound traffic patterns, which makes it difficult to detect and investigate suspicious network activity.

Remediation

• Configure Azure Firewall routing to direct outbound traffic from workload subnets through the firewall’s private IP address.
• Manage route tables and routes to create user-defined routes for the default route (0.0.0.0/0) pointing to the Azure Firewall private IP.
• Control App Service outbound traffic with Azure Firewall for App Service VNet integration scenarios.
• Configure Azure Firewall rules to allow required outbound traffic while blocking malicious destinations.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Low
Pillar	Network
Category	Azure Network Security
Product	Azure
Feature	Network security
Area	Infrastructure hardening
ATT&CK	T1071 Application Layer Protocol, T1041 Exfiltration Over C2 Channel
Licence	Azure_Firewall_Basic, Azure_Firewall_Standard, Azure_Firewall_Premium
Tenant	Workforce, External

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.