Deploying virtual Network Security appliances in Azure in inline mode

This topic describes how to deploy a virtual Network Security appliance in inline mode.

Note

This procedure assumes that the interface pair is configured in inline mode on the Network Security appliance.

Configuring IP routing

In a typical Network Security inline deployment, port pair A is the inline port pair. The pether3 monitoring interface is connected to the subnet that hosts the on-premises enterprise clients (the client subnet) and the pether4 monitoring interface is connected to a subnet that hosts the Network Security appliance (the server subnet). The following example addresses are used in this section:

Client subnet—10.100.1.64/27
Network Security pether3 interface—10.100.1.69
Server subnet—10.100.1.96/27
Network Security pether4 interface—10.100.1.100

Azure routes traffic from one subnet to another based on a route in each subnet's route table. You must add a table and route for each subnet.

Note

The following procedures describe how to configure IP routing for the subnets connected to the interfaces in port pair A. Repeat the procedures for each applicable port pair.

Adding a route table and route for the client subnet

This procedure shows how to add a route that sends traffic from the client subnet to the Network Security appliance.

To add the route table and route:

Select All services, and then select Route tables under Networking.
Click Add.
Enter a meaningful Name for the route table.
Make sure the correct Subscription, Resource group, and Location are selected.
Click Create.
Click the new route table.
Select Routes under Settings. The Routes page opens.
Click Add.
On the Add route page:
1. Enter a meaningful Route name.
2. For Address prefix, enter the IP address and network prefix for the destination subnet (the Network Security appliance subnet).
3. Select Virtual appliance as the Next hop type.
4. Enter the IP address of the Network Security pether3 interface as the Next hop address.
5. Click OK.

Example

The following example shows the route table for the client subnet.

Adding a route table and route for the server subnet

This procedure shows how to add a route that sends traffic from the Network Security appliance to the client subnet.

To add the route table and route:

Select All services, and then select Route tables under Networking.
Click Add.
Enter a meaningful Name for the route table.
Make sure the correct Subscription, Resource group, and Location are selected.
Click Create.
Click the new route table.
Select Routes under Settings.
Click Add.
On the Add route page:
1. Enter a meaningful Route name.
2. For Address prefix, enter the IP address and network prefix for the destination subnet (the client subnet).
3. Select Virtual appliance as the Next hop type.
4. Enter the IP address of the Network Security pether4 interface as the Next hop address.
5. Click OK.

Example

The following example shows the route table for the server subnet.