Does Azure S2S VPN automatically create an Access Control List in Gateway Subnet?

Question

When configuring a S2S VPN.. we would normally create an ACL to bring up the vpn.. such as the following on our on prem router/firewall....

access-list 101 permit esp host X.X.X.X host X.X.X.X

access-list 101 permit udp host X.X.X.X eq isakmp host X.X.X.X

access-list 101 permit udp host X.X.X.X eq non500-isakmp host X.X.X.X

I see there is a spot to allow an NSG on the GatewaySubnet.. but it is not recommended for it and others have commented that it will break communications for the VPN and Azure... so perhaps Azure automatically creates a similar Access-list that we don't see within the Public interface on the Gateway?

Answer 1

Hi Blackbourn, Nathan,

I understand your concern about whether an Azure Site-to-Site (S2S) VPN automatically creates an Access Control List (ACL) in the Gateway Subnet.

Azure does not create an Access Control List (ACL) in the GatewaySubnet when you create a S2S VPN connection. Instead, Azure creates a default security rule that allows all traffic from the on-premises network to the GatewaySubnet. This rule is created when you create a VPN Gateway and cannot be modified or deleted.

I see there is a spot to allow an NSG on the GatewaySubnet.. but it is not recommended for it and others have commented that it will break communications for the VPN and Azure

yes, you're correct.

If you have any further queries, do let us know.

 Thanks,
Rohith

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.