Company is exploring the option of connecting Azure VNET to the on premise network using either Site-to-Site or ExpressRoute. There are concerns regarding potential vulnerability of internal resources from the Web and Mobile Apps exposed to the internet. While concern is not clearly formulated there is an unease due to the fact that Azure will be responsible for securing access into our network and not our respective IT Risk and Networking teams.

Is there a good set of articles to explain the VPN and ExpressRoute security? Are there good use cases to demonstrate that even if security of the Web or Mobile application is compromised then our on premise resources are still protected by Azure VPN? We need to present network architecture that demonstrates the security of Azure VPN networks and addresses the concerns our risk, security, and governance teams might have.

2 Answers 2


While I couldn't find much on it, I did find this article that may provide some answers. Also there are vendors such as Barracuda that provide additional security on top of what exists.

That being said, if the Web or Mobile app is an Azure PaaS or IaaS service then a highly secured environment can be built using an App Service Environment with hybrid connectivity. The App Service Environment can act as a DMZ while the hybrid connection can have additional protections such as Web Application Firewalls, Firewalls and IDS.

Hope this helps!


First, having a concern of cloud security is somewhat misconception today, especially to Azure which is in top 2 in cloud market. The concern would be: "Do Azure offer enough security feature to meet my security compliance and requirement?" And we can have a look into the list of features.

There are two options to establish a hybrid connection between your on-premises network and Azure virtual network:

  • Azure VPN Gateway
  • ExpressRoute

Azure VPN Gateway offers two types: Point-to-site (P2S) and Site-to-Site. Different types are used for different scenarios. While P2S lets you create a secure connection to Azure virtual network from an individual client computer (e.g. from on-premises database server to Azure Web App), S2S is more advanced and used for cross-premises and complex hybrid connection. P2S only requires a VPN gateway setup and a certificate to import to the on-premises client computer. S2S requires VPN device located in on-premises network that has public IP address assigned to it.

When it comes to protocol supported, both VPN types support industry-standard security protocol. PS2 support IKEv2 or SSTP and S2S supports IPsec & IKE. To make it clear, Microsoft also provides cryptographic requirement for Azure VPN gateway (https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-compliance-crypto). There shouldn't be a concern when using Azure VPN. The concern would be which option (cryptographic algorithm and key strength) you use to strengthen the VPN connection. In terms of routing, S2S supports Routed Base policy to allow you to control traffic flow.

You should talk to your IT and network team, asking them about specific requirement for VPN connection, such as designated protocol, crypto requirement.

ExpressRoute is another option but this is not really designed for only security purpose. Azure ExpressRoute gives you a private connection from your on-premises directly to Microsoft datacenter via a connectivity provider. That said, connection doesn't go over the public Internet. There are number of different benefits:

  1. Since it is private, it gives a reliability and security. No one anonymously can capture your network packet (except the provider).
  2. Bandwidth is supported up to 10 Gbps.
  3. Redundancy. Each ExpressRoute circuit consists of two connections to two Microsoft Enterprise edge routers from the connectivity provider.

ExpressRoute is not available everywhere. Have a look here https://docs.microsoft.com/en-us/azure/expressroute/expressroute-locations

If you want to explain to your IT and network team about ExpressRoute, below are some good references:

For Azure App Service, you have three options today (as of this answer):

  • Hybrid connection: it allows your web app to access on-premises systems over Azure Service Bus Relay. The connection uses TLS1.2 and shared access signature. Make sure the certificate is as expected strong as possible.
  • VNET integration: allows your web app to access to on-premises system over Point-to-site VPN. Site-to-Site is not supported.
  • Dedicated virtual network: this option allows you to create an Azure virtual network for your web application. The Azure App Service plan must be Isolated. With an isolated virtual network, you can establish VPN to your on-premises network.

Are there good use cases to demonstrate that even if security of the Web or Mobile application is compromised then our on premise resources are still protected by Azure VPN?

It depends on the compromising level and how you organize identity access. If only web or mobile admin's password is compromised, chances are the web is only defaced. Your virtual network is still not compromised. The only case when your network is compromised in the hybrid environment is when your Azure global administrator account is compromised and your pre-shared key of VPN is compromised. When being compromised, your on-premises network would be accessible to an unauthorized user and he could start penetrating your network.

Also, consider two things when implementing a network security architecture in hybrid scenario:

  • Use Forced Tunneling: Azure allows you to force all Internet-bound traffic back to your on-premises via S2S VPN tunnel. This can be helpful if your environment already has Intrusion Detection System or Intrusion Protection System to inspect network. This option is only available when you use Isolated plan because Forced Tunneling works again subnet.
  • Use User-defined Routing (UDR): UDR allows you to control system routing by overwriting the route by your custom one. For example, saying the network before going out needs to be routed to a defense system (virtual appliance such as Barracuda, F5, other next-gen firwall...). UDR also works again virtual network and subnet. Hence, to use it, the App Service Plan must be Isolated.

There are more things to talk about practical network security design in Azure, including strategy and tactic. However, you only have concern about VPN to your on-premises, and the stack you use is PaaS-based so I just focus on VPN and sort of network for Web App.

If your IT and network team brings out specific security concern more than general thought, do bring here and I'd be happy to discuss.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .