Outbound rules for Azure platform services

AZLearner 96 Reputation points
2020-07-19T23:18:51.263+00:00

Hi,

https://video2.skills-academy.com/en-us/azure/virtual-network/security-overview#azure-platform-considerations mentions:

"Virtual IP of the host node: Basic infrastructure services like DHCP, DNS, IMDS, and health monitoring are provided through the virtualized host IP addresses 168.63.129.16 and 169.254.169.254. These IP addresses belong to Microsoft and are the only virtualized IP addresses used in all regions for this purpose. Effective security rules and effective routes will not include these platform rules. To override this basic infrastructure communication, you can create a security rule to deny traffic by using the following service tags on your Network Security Group rules: AzurePlatformDNS, AzurePlatformIMDS, AzurePlatformLKM. "

Currently my outbound rules are the 3 default rules. I plan to lock down outbound traffic. Does the last sentence above imply even if I lock down outbound traffic, these Azure platform traffic won't be affected unless I explicitly deny with AzurePlatformDNS, AzurePlatformIMDS, AzurePlatformLKM?

Thank you.

Azure Virtual Network
Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
2,264 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. GitaraniSharma-MSFT 49,256 Reputation points Microsoft Employee
    2020-07-20T09:57:48.657+00:00

    Hello @AZLearner-5762 ,

    By default the basic infrastructure services communication is not subject to the configured network security groups unless specifically targeted leveraging the AzurePlatformDNS, AzurePlatformIMDS, AzurePlatformLKM service tags. These platform tags are used for specific scenarios and each deny rule has an independent result.

    AzurePlatformDNS : The basic infrastructure (default) DNS service. You can use this tag to disable the default DNS.
    AzurePlatformIMDS : Azure Instance Metadata Service (IMDS), which is a basic infrastructure service. You can use this tag to disable the default IMDS.
    AzurePlatformLKM : Windows licensing or key management service. You can use this tag to disable the defaults for licensing.

    NOTE : Be cautious when you use these tags. It is recommended that you perform testing before you use these tags.

    So, yes even if you lock down outbound traffic, these Azure platform traffic won't be affected unless you explicitly deny these with respective service tags - AzurePlatformDNS, AzurePlatformIMDS, AzurePlatformLKM.
    Please refer : https://azure.microsoft.com/en-us/updates/network-security-group-improvements-now-available/

    Hope this helps!

    Kindly let us know if the above helps or you need further assistance on this issue.

    Please don’t forget to "Accept the answer" wherever the information provided helps you, this can be beneficial to other community members.