User requesting remote access to all deployed resources in a virtual network (vnet). What is the best, and most secure, way to allow these IP addresses remote access?

Question

So a user has requested that two IP groups (source) be allowed remote access (ports 22, 3389, 5985, 5986) to resources deployed in a certain VNET. I am trying to figure out the best way to allow this access through. Under the VNet in question, there are 13 different subnets and about 12 different NSGs. The subnets that are needing access are outside of the VNets IP address range, the only thing I have come up with is to configure each NSG with access from the requested subnets and ports. The subnets needed are in 2 different IP groups if that makes any difference.

Thank you!

Accepted Answer

Hi @Nicholas Dunkle

The way I recommend when a partner needs to access a resource within their environment is to use the Azure VPN Gateway. In Azure VPN Gateway, you can use site-to-site and point-to-site and limit resource access by allowing only the addresses of resources they need to access.
At least external access is encrypted.

Another way is to use the Azure firewall or an NVA to control traffic through a single point.

If you don't have the financial resources and can't spend, the way will be to use the NSG and allow and limit access by the source public IP, and you can better organize access using an ASG (Without cost).

Reference: https://video2.skills-academy.com/en-us/azure/virtual-network/application-security-groups

Get in touch if you need more help with this issue.

--please don't forget to "[Accept the answer]" if the reply is helpful

Share via

User requesting remote access to all deployed resources in a virtual network (vnet). What is the best, and most secure, way to allow these IP addresses remote access?

0 additional answers

Your answer