Azure VNet setup

This document describes the requirements and resources (subnets, security-groups) to be created in your VNet so that you can create Multicloud Defense Gateways in the VNet.

A subnet is a segmented network part that:

• divides an IP network into connected sub-networks,

• manages data paths within a network, and

• efficiently organizes network traffic.

When configuring your gateway deployment, the Multicloud Defense Controller will prompt you for the management and datapath subnet information.

Management subnet

• Public subnet associated with a route table having a default route to the Internet.

• Interface attached is used only for policy, management, and telemetry activities.

• Application traffic does not use this interface.

• Associated with the management security group.

Datapath Subnet

• Public subnet with a similar route table setup for Internet access.

• Houses a network load balancer (NLB) created by the Cisco Multicloud Defense Controller.

• Handles customer application traffic through its interface.

• Traffic ingress is subject to security policies from the datapath security group.

For detailed information, refer to the Security Groups section.

A security group is a network configuration component that:

• filters traffic based on predetermined security rules,

• operates at the instance level, and

• acts as a virtual firewall for your instance to control inbound and outbound traffic.

The management and datapath security groups are associated with the respective interfaces on the Multicloud Defense Gateway instance, as described in the subnets section.

Management Security Group

The management security group must permit outbound traffic, allowing the gateway instance to communicate with the controller. Optionally, for inbound rules, enable port 22 (SSH) to allow SSH access to the gateway instance, although it is not mandatory.

Datapath Security Group

The datapath security group is attached to the datapath interface allowing traffic from the Internet to the Multicloud Defense Gateway. Currently, the Multicloud Defense Controller does not manage this security group. An outbound rule must exist, allowing the traffic to egress this interface. Inbound ports must be opened for each port that is configured in the Multicloud Defense Controller security policy and used by the Multicloud Defense Gateway.

For example, if an application operates on port 3000 and is proxied by the Multicloud Defense Gateway on port 443, then port 443 must be open on the datapath security group. This ensures that port 3000 is open on the security group attached to your application.