6.3 Network Perimeter Protection & Flow Monitoring
Key Takeaways
- Azure DDoS Protection offers IP Protection (per public IP resource) and Network Protection (per VNet scope covering all associated public IPs) with adaptive traffic baselining and cost guarantee coverage.
- Adaptive tuning uses machine learning to profile application traffic patterns dynamically, automatically adjusting L3/L4 rate-limiting thresholds without manual intervention.
- Network Watcher diagnostic utilities—including IP Flow Verify, Next Hop, Connection Troubleshoot, and Packet Capture—enable rapid troubleshooting of routing and NSG blockages.
- Traffic Analytics integrates with NSG Flow Logs v2 and Log Analytics workspaces to provide rich visibility into cross-subnet bandwidth usage, protocol traffic, and malicious IP communications.
- VNet Flow Logs capture IP traffic flows at the Virtual Network layer with support for Azure Storage, Customer-Managed Keys (CMK), and retention policies.
5.3 Network Perimeter Protection & Flow Monitoring
Distributed Denial of Service (DDoS) attacks represent one of the most persistent threats to cloud availability, seeking to exhaust network bandwidth and compute resources. Securing the network perimeter requires robust DDoS mitigation strategies combined with comprehensive deep flow monitoring. Microsoft Azure provides integrated perimeter protection through Azure DDoS Protection and operational diagnostic visibility via Azure Network Watcher, NSG Flow Logs v2, and VNet Flow Logs.
Azure DDoS Protection Tiers: Network Protection vs. IP Protection
Azure applies default platform-level Infrastructure DDoS Protection across all public IP endpoints free of charge. However, enterprise workloads require specialized application-tuned protection plans.
+---------------------------------------------------------------------------------------------------------+
| AZURE DDOS PROTECTION TIERING |
| |
| +---------------------------------------------------------------------------------------------------+ |
| | Infrastructure DDoS Protection (Basic Default - Free across all Azure Public IPs) | |
| +---------------------------------------------------------------------------------------------------+ |
| | |
| +-----------------------+-----------------------+ |
| | | |
| v v |
| +-----------------------------------------------+ +------------------------------------------------+ |
| | Network Protection Plan (VNet Scope) | | IP Protection Plan (Public IP Scope) | |
| | - Applied to Virtual Networks | | - Applied per individual Public IP address | |
| | - Protects all Public IPs within VNet | | - Cost-effective for single public IP workloads| |
| | - Includes Rapid Response (DRR) Team Support | | - Includes Adaptive Tuning & Telemetry | |
| | - Includes Financial DDoS Cost Guarantee | | - Excludes DRR Team & Cost Guarantee | |
| +-----------------------------------------------+ +------------------------------------------------+ |
+---------------------------------------------------------------------------------------------------------+
Comparative Analysis of DDoS Protection Plans
| Feature / Dimension | Infrastructure (Basic) | IP Protection Plan | Network Protection Plan |
|---|---|---|---|
| Protection Scope | Global Azure Infrastructure | Single Public IP Address | Virtual Network (covers all Public IPs in VNet) |
| Mitigation Baseline | Fixed platform-wide threshold | Adaptive machine-learning tuning | Adaptive machine-learning tuning |
| Metrics & Alerts | Basic platform metrics | Full Azure Monitor telemetry | Full Azure Monitor telemetry & Sentinel logs |
| Cost Protection Guarantee | Not Provided | Not Provided | Included (Scale-out cost credits during attack) |
| DDoS Rapid Response (DRR) | Not Provided | Not Provided | Included (24/7 direct access to Microsoft experts) |
| Billing Model | Free / Included | Flat monthly cost per IP | Flat monthly base charge (covers 10 Public IPs) |
Adaptive Tuning & Defense Mechanics
Azure DDoS Protection continuously profiles your application's normal traffic patterns using machine learning algorithms. Rather than relying on static rate-limiting thresholds, Adaptive Policy Tuning dynamically establishes baseline traffic profiles for Layer 3 (IP) and Layer 4 (TCP/UDP) protocols.
Mitigation Process Flow
- Continuous Traffic Profiling: Machine learning models monitor inbound packet volume, protocol ratios (SYN/ACK, UDP, ICMP), and source IP distributions to establish a rolling application traffic baseline.
- Automatic Threshold Adjustment: When legitimate traffic spikes (e.g., during a scheduled product launch), the adaptive engine adjusts mitigation thresholds upwards to prevent false positives.
- Inline Mitigation: If an attack exceeds baseline thresholds, traffic is instantly rerouted through Azure DDoS scrubbing centers. Malicious packets (e.g., SYN floods, UDP amplification) are dropped, while clean traffic is passed through to your workload.
- DDoS Rapid Response (DRR) Engagement: Subscribers to the Network Protection Plan can engage the Microsoft DDoS Rapid Response team during an active attack to receive specialized mitigation assistance and custom policy adjustments.
Azure Network Watcher Diagnostic Toolkit
Azure Network Watcher is a regional suite of operational tools designed to monitor, diagnose, and troubleshoot network performance and connectivity issues within Azure Virtual Networks.
+-----------------------------------------------------------------------------------------------+
| NETWORK WATCHER DIAGNOSTIC TOOLS |
+-----------------------+-----------------------------------------------------------------------+
| Tool Name | Primary Operational Function |
+-----------------------+-----------------------------------------------------------------------+
| IP Flow Verify | Tests 5-tuple packet flow to verify if an NSG allows or denies traffic|
| Next Hop | Identifies UDR routing target to diagnose incorrect gateway routing |
| Connection Troubleshoot| Evaluates TCP latency, hop-by-hop paths, and endpoint reachability |
| Packet Capture | Captures raw network interface traffic (.cap/.pcap) on Windows/Linux |
+-----------------------+-----------------------------------------------------------------------+
Key Diagnostic Tools Detailed
- IP Flow Verify: Validates whether a packet defined by a 5-tuple parameters (Source IP, Destination IP, Source Port, Destination Port, Protocol) is allowed or denied. It returns the exact security rule name and NSG location responsible for blocking or permitting the packet.
- Next Hop: Inspects Virtual Network User-Defined Routes (UDRs) and system routes for a specific destination IP address, returning the Next Hop type (
VirtualAppliance,VNetLocal,Internet, orNone) and IP address. - Connection Troubleshoot: Measures end-to-end TCP latency and analyzes intermediate network topology hops between a VM and another VM, FQDN, or external IP address.
- Packet Capture: Runs lightweight diagnostic agents on target Linux and Windows VMs to capture raw
.pcaptrace files directly to an Azure Storage Account container for Wireshark analysis.
NSG Flow Logs v2 & Traffic Analytics
Network Security Group (NSG) Flow Logs capture IP traffic flowing through NSGs. NSG Flow Logs v2 enhances raw logging by recording flow state data and byte/packet counters.
NSG Flow Log v2 Schema Attributes
- 5-Tuple Flow Data: Timestamp, Source IP, Destination IP, Source Port, Destination Port, Protocol (T/U).
- Traffic Decision:
A(Allowed by NSG) orD(Denied by NSG). - Flow State (v2):
S(Begin / Starting flow),B(Continuing flow),E(Ending flow). - Packet & Byte Counters (v2): Packets sent/received and total bytes transmitted per flow window.
Traffic Analytics Integration
Raw NSG flow logs stored in Azure Blob Storage can be ingested into Traffic Analytics, a cloud-based solution that analyzes flow logs and enriches them with Microsoft Threat Intelligence inside a Log Analytics workspace.
+---------------------------------------------------------------------------------------------------------+
| TRAFFIC ANALYTICS PIPELINE |
| |
| +-----------------------+ Flow Telemetry +-----------------------+ Structured Parsing +----+ |
| | Network Security Group|====================>| Azure Storage Account |=======================>| Log| |
| | (NSG Flow Logs v2) | | (JSON Blob Storage) | | Ana| |
| +-----------------------+ +-----------------------+ | lyt| |
| | ics| |
| +-----------------------+ Threat Enrichment +-----------------------+ KQL Visualizations | Wk | |
| | Microsoft Threat Intel|====================>| Storage Blob Ingest |=======================>| sp | |
| | (Malicious IP Feeds) | | Processing Engine | +----+ |
| +-----------------------+ +-----------------------+ |
+---------------------------------------------------------------------------------------------------------+
Key Security Insights Provided by Traffic Analytics
- Top Talkers & Bandwidth Consumers: Identifies virtual machines, subnets, and ports generating the highest traffic volume.
- Malicious External IP Detection: Cross-references public IP flows against Microsoft Threat Intelligence feeds to highlight inbound port scans, botnet command-and-control traffic, and malicious connections.
- Cross-Subnet & Cross-Region Traffic: Visualizes unencrypted internal traffic flows and cross-region bandwidth generation.
VNet Flow Logs & Customer-Managed Encryption
While NSG Flow Logs operate at individual NSG boundaries, VNet Flow Logs capture IP traffic at the Virtual Network layer, capturing traffic across subnets, NICs, and Private Endpoints even if no NSG is explicitly assigned.
Security & Storage Requirements
- Storage Location: Flow logs are exported to Azure Blob Storage accounts.
- Customer-Managed Key (CMK) Encryption: To comply with enterprise data protection standards, flow log storage accounts can be encrypted using Customer-Managed Keys (CMK) stored in Azure Key Vault.
- Retention Policies & Centralization: Configurable retention rules automatically purge expired logs or transition old log blobs to Cold/Archive storage tiers to optimize storage expenditure.
An enterprise manages 15 public IP addresses across multiple Azure Virtual Networks. The security team wants continuous adaptive traffic tuning, access to the DDoS Rapid Response (DRR) team during active attacks, and protection against resource scaling cost overruns incurred during a DDoS attack. Which DDoS Protection plan should be implemented?
A virtual machine in a spoke VNet cannot reach an Azure SQL database instance. The security engineer suspects a Network Security Group rule is silently blocking outbound traffic on port 1433. Which Azure Network Watcher tool quickly identifies the specific NSG and rule name responsible for dropping the traffic?
A security operations team wants to identify internal Azure virtual machines communicating with known malicious external IP addresses and botnet command-and-control servers. Which monitoring solution combines NSG Flow Logs v2 with Microsoft Threat Intelligence feeds to surface these insights?