Azure Internal ASE with Firewall

0
votes

I am running a Linux container as a web app in an internal ASE. The ASE is deployed to a Vnet (secondary Vnet) which is peered to a another Vnet(Primary vnet) where an Azure firewall exists.

1.I have Enable service endpoints to SQL, Storage, and Event Hub on your ASE subnet.

2.From the Azure Firewall UI > Rules > Application rule collection, Set App Service Environment FQDN Tag and the Windows Update Tag.

3.From the Azure Firewall UI > Rules > Network rule collection, Set the ports to 123.Create another rule the same way to port 12000 to help triage any system issues.

4.Create a route table with the management addresses from App Service Environment management addresses with a next hop of Internet, set 0.0.0.0/0 directed to the network appliance ( Firewall internal IP address)

5.Create Application rules to allow HTTP/HTTPS traffic (Note: address is the IP of the ILB of the Internal ASE, since I cant find an IP for the web app itself)

I don't seem to be able to reach the web app. Any guidance will be appreciated. is the problem that I created an Internal ASE?

I am trying to isolate the ISE and control external access to it via a firewall.

MSDocs I referenced :https://docs.microsoft.com/en-us/azure/app-service/environment/firewall-integration

1
azure-web-app-service
PS: I don't have any NSGs attached to the subnet my ASE is in – Rav Salgado

1 Answers

0
votes

Yes, I think it's the problem with internal ASE. Also, the referring document is intended to lock down all egress from the ASE VNet. Inbound management traffic for an ASE can not be sent through a firewall device.

There are a number of inbound dependencies that an ASE has. The inbound management traffic cannot be sent through a firewall device. The source addresses for this traffic are known and are published in the App Service Environment management addresses document. You can create Network Security Group rules with that information to secure inbound traffic.

In addition, since it's an internal ASE, it is deployed in your VNet with ILB. You can not directly access its backend web app over the Internet, you need at least a public-facing Ip address (external VIP )or other public-facing services(Public Azure application gateway) in front of it.

It will like this, enter image description here