How to prevent IP spoofing for Azure VMs?

Question

I have an Azure web app which talks to the Azure VMs via Azure Load balancer. The VMs have NSG rules setup. The VMs are also being used by other servers/web apps. How do I prevent someone impersonating the IP and trying to get access to the VMs? Or how do I add another layer of security other than whitelisting the client IPs in the NSG of the VMs?

Answer 1

To secure Azure VMs, please try the following workarounds:

• Make use of Azure Bastion, to securely connect to virtual machines from Azure Portal over TLS. If you are using Azure Bastion there is no need to create public IP on the Azure VM.

• Try creating DDoS protection plan and enable it to your virtual network. DDoS protection plan is a paid service that offers enhanced DDoS mitigation capabilities.

• Make use of Azure Firewall which filters IPs by denying traffic from known malicious IP addresses.

Enable all the above options in your virtual network like below:

Otherwise,

• Make use of JIT (just-in-time) VM access that allows only legitimate users to access the VM when necessary by reducing the attack.
• Try using VPN gateways which send encrypted traffic between Azure virtual networks. Please note that each virtual network can have only one VPN gateway.

For more information, please refer below links:

How to secure a Windows Server virtual machine in Azure (microsoft.com).

Best practices for defending Azure Virtual Machines - Microsoft Security Blog.