Охранная зона инженерных сетей \ Акты, образцы, формы, договоры \ Консультант Плюс ]]>

Подборка наиболее важных документов по запросу Охранная зона инженерных сетей (нормативно–правовые акты, формы, статьи, консультации экспертов и многое другое).

Судебная практика: Охранная зона инженерных сетей

Открыть документ в вашей системе КонсультантПлюс:
Подборка судебных решений за 2019 год: Статья 39.36 «Использование земель или земельных участков, находящихся в государственной или муниципальной собственности, для размещения нестационарных торговых объектов, рекламных конструкций, а также объектов, виды которых устанавливаются Правительством Российской Федерации» ЗК РФ
(ООО юридическая фирма «ЮРИНФОРМ ВМ»)Руководствуясь статьей 39.36 ЗК РФ и установив, что схема размещения нестационарных торговых объектов на территории города утверждена решением муниципалитета после расторжения договора аренды с заявителем; в обоснование отказа в размещении нестационарного объекта ответчик сослался на нарушение расположением спорного киоска правил благоустройства, согласно которым не допускается размещение нестационарных объектов (за исключением передвижных нестационарных объектов), в том числе в охранной зоне сетей инженерно-технического обеспечения, на расстоянии менее нормативного от сетей инженерно-технического обеспечения без согласования с владельцами данных сетей; доказательств соответствия указанным требованиям места, где расположен киоск заявителя, не представлено, арбитражные суды правомерно отказали в признании незаконным отказа во включении места размещения объекта в схему размещения нестационарных торговых объектов города, придя к выводам о том, что невключение спорного места в схему мест размещения нестационарных торговых объектов не является произвольным со стороны ответчика, отметив соответствие оспариваемого решения требованиям законодательства, действующего на момент его принятия.

Статьи, комментарии, ответы на вопросы: Охранная зона инженерных сетей

Открыть документ в вашей системе КонсультантПлюс:
Ситуация: Имеют ли граждане право на размещение металлических гаражей?
(«Электронный журнал «Азбука права», 2020)В этом случае металлический тент (гараж) размещается в шаговой доступности от места проживания такого автовладельца. Вместе с тем его установка запрещена, например, на местах прохождения подземных инженерных коммуникаций, в охранных зонах железных и автодорог, на пешеходных дорожках, на газонах, в парковых зонах и прибрежных зонах водоемов, у стен жилых домов, на детских и спортивных площадках, на территории школ и детских садов (п. п. 1, 2 разд. I, п. 1 разд. III Положения, утв. Постановлением главы городского округа Химки МО от 16.07.2007 N 1089). Открыть документ в вашей системе КонсультантПлюс:
Путеводитель по судебной практике. Аренда. Общие положенияИсследовав и оценив буквальное содержание условия договора аренды о его предмете (земельный участок общей площадью 1 549,7 кв. м, в том числе 1 199,0 кв. м — площадь ограниченного использования (охранная зона инженерных сетей), исключая размещение сооружений на земельном участке ограниченного использования, с категорией земель — земли населенных пунктов, с учетным N 0100555:0002), учитывая, что доказательства постановки земельного участка на кадастровый учет истцом не представлены, арбитражные суды пришли к выводу об отсутствии данных, позволяющих идентифицировать объект арендных правоотношений и незаключенности договора аренды.

Нормативные акты: Охранная зона инженерных сетей

90000 Network Security Zones — Utilize Windows 90001 90002 Before you start 90003 90004 90005 Objectives: 90006 Learn about different types of network security zones and when are they used. 90007 90004 90005 Prerequisites: 90006 no prerequisites. 90007 90004 90005 Key terms: 90006 intranet, extranet, LAN, private network, DMZ, NAT 90007 90016 90002 Security Zone 90003 90004 Security zone is a portion of a network that has specific security requirements set. Security zones are often separated by traffic control devices such as a firewall or a router.Examples of security zones are intranets, extranets, demilitarized zones (DMZ), and virtual local area networks (VLANs). 90007 90004 Intranet is a private network that has implemented services for internal use only. 90007 90004 An extranet is a privately controlled network located between the Internet and a private network. It is often used to grant resource access to business partners, customers or similar users outside of our organization. 90007 90004 DMZ is a border network which is partially protected and accessible from the Internet as well as from the private LAN.Access from the DMZ to the private network is prevented. DMZ provides additional layer of protection between the Internet and the LAN. DMZ usually hosts resources such as web, FTP or e-mail servers. DMZ is often bordered on both sides by a firewall. Access from the Internet to the DMZ is protected by only some restrictions on the firewall, but access into the LAN is highly restricted by the second firewall. Another way to deploy a DMZ is to have a firewall with a third interface on it. The third interface serves the DMZ.90007 90004 Virtual LANs are created using switches. VLANs are used to split broadcast domains into multiple sub-domains which decreases the broadcast traffic between network segments. Access between VLANs is restricted using routers in the same way as between subnets or distinct networks. VLANs can be used to create logical LANs regardless of the physical location of our computers. VLANs also reduces attack surface for network sniffers inside the network. 90007 90002 Network Address Translation (NAT) 90003 90004 When talking about security zones, we also have to understand the concept of NAT.NAT allows the design of the network in which we hide the internal network configuration from the public. This allows large organizations and large networks to enable Internet access without using large number of public IP addresses (public IP addresses have to be leased from Internet Service Provider). NAT allows us to use private IP addresses on our private network and still grant that private network access to the Internet by converting those addresses to public addresses when the communication to the Internet is requested.A NAT router translates a public address into a private address and port number and in that way allows private networks to share a single public IP address. 90007 90004 There are three classes or ranges of private IP addresses: 90007 90035 90036 Class A is 10.0.0.0 / 8 90037 90036 Class B is 172.16.0.0 / 12 90037 90036 Class C is 192.168.0.0 / 16 90037 90042 90004 Related topic to NAT is Port Address Translation. In this case, the ports themselves are translated from internal request to external request.NAT and IPSec are incompatible since NAT alters the packet headers (changes the source and destination address). Because of that it makes the IPSec communication impossible across the NAT server. 90007 90002 Proxy server 90003 90004 Proxy server is a border device that serves several functions. It improves performance by utilizing caching of content. It can also perform a level of access control for Internet services and applications. It can also perform filtering of content based on access rules, keywords, protocols and even domain names.In many cases, proxy server will also use NAT. 90007 90002 Like this: 90003 90004 Like Loading … 90007 90004 90002 90055 Related 90056 90003 90007.90000 Application Security News, Tutorials & Tools 90001 90002 SAVE 90003 90002 Learn design patterns quickly with Jason McDonald’s outstanding tutorial on the original 23 Gang of Four design patterns, including class diagrams, explanations, usage info, and real world examples. 90003 90002 SAVE 90003 90002 Gives you an overview of key aspects of the Java language and references on the core library, commonly used tools, and Java 8 features.90003 90002 SAVE 90003 90002 Today, Git is effectively the de-facto standard for software version control, and it is truly an expected tool in every developer’s toolbox. This quick overview demonstrates what a rich and deep DVCS Git truly is, while still being approachable for the newcomer to this collaborative approach to source code and version control.Download this Refcard to learn about the essentials of getting started with Git like cloning existing projects, pushing Git commits to subversion, branching and merging, and more. 90003 90002 SAVE 90003 90002 The Representational State Transfer (REST) ​​architectural style is a worldview that elevates information into a first-class element of architectures.REST allows us to achieve the architectural properties of performance, scalability, generality, simplicity, modifiability, and extensibility. This newly updated Refcard explains main HTTP verbs, describes response codes, and lists libraries and frameworks. It also gives additional resources to further explore each topic. 90003 90002 SAVE 90003 90002 Introduces Ajax, a group interrelated techniques used in client-side web development for creating asynchronous web applications.90003 90002 SAVE 90003 90002 Scrum is a framework that allows people to productively and creatively deliver products of the highest possible value. With over 70% of Agile teams using Scrum or Scrum hybrid, learn more about its benefits in managing complex product development. This newly updated Refcard explores the details of Scrum, including theory, values, roles, and events.It also includes a sample of a popular approach to deliver Integrated Increments in a scaled environment. 90003 90002 SAVE 90003 90002 This Refcard will help Java developers working with multi-threaded programs to understand core concurrency concepts and how to apply them. Overview the key aspects of the Java language and get references on the core library.90003 90002 SAVE 90003 90002 Catalogs the XML elements available as of Spring 2.5 and highlights those most commonly used: a handy resource for Spring context configuration. 90003 90002 SAVE 90003 90002 Covers Core principles of CSS that will expand and strengthen your professional ability to work with CSS.Part one of three. 90003 90002 SAVE 90003 90002 Introduces jQuery Selectors, which allow you to select and manipulate HTML elements as a group or as a single element in jQuery. 90003 90002 SAVE 90003 90002 Eclipse IDE is a cross-platform, multi-purpose, open-source Integrated Development Environment.It is widely used to develop projects in Java, JavaScript, PHP, C ++, Scala, and many others. This newly updated Refcard breaks down installing, setting up, and getting started with Eclipse. It also covers productivity tips, creating new projects and files, accessing Source Control Managers, and debugging configurations. 90003 90002 SAVE 90003 90002 Covers Core principles of CSS that will expand and strengthen your professional ability to work with CSS.Part two of three. 90003 .90000 Network security concepts and requirements in Azure 90001 90002 90003 90004 10/29/2018 90005 90006 90003 22 minutes to read 90006 90003 90006 90011 90012 In this article 90013 90014 Network security could be defined as the process of protecting resources from unauthorized access or attack by applying controls to network traffic.The goal is to ensure that only legitimate traffic is allowed. Azure includes a robust networking infrastructure to support your application and service connectivity requirements. Network connectivity is possible between resources located in Azure, between on-premises and Azure hosted resources, and to and from the internet and Azure. 90015 90014 This article covers some of the options that Azure offers in the area of ​​network security. You can learn about: 90015 90018 90003 Azure networking 90006 90003 Network access control 90006 90003 Azure Firewall 90006 90003 Secure remote access and cross-premises connectivity 90006 90003 Availability 90006 90003 Name resolution 90006 90003 Perimeter network (DMZ) architecture 90006 90003 Azure DDoS protection 90006 90003 Azure Front Door 90006 90003 Traffic manager 90006 90003 Monitoring and threat detection 90006 90011 90042 Azure networking 90043 90014 Azure requires virtual machines to be connected to an Azure Virtual Network.A virtual network is a logical construct built on top of the physical Azure network fabric. Each virtual network is isolated from all other virtual networks. This helps ensure that network traffic in your deployments is not accessible to other Azure customers. 90015 90014 Learn more: 90015 90042 Network access control 90043 90014 Network access control is the act of limiting connectivity to and from specific devices or subnets within a virtual network. The goal of network access control is to limit access to your virtual machines and services to approved users and devices.Access controls are based on decisions to allow or deny connections to and from your virtual machine or service. 90015 90014 Azure supports several types of network access control, such as: 90015 90018 90003 Network layer control 90006 90003 Route control and forced tunneling 90006 90003 Virtual network security appliances 90006 90011 90012 Network layer control 90013 90014 Any secure deployment requires some measure of network access control. The goal of network access control is to restrict virtual machine communication to the necessary systems.Other communication attempts are blocked. 90015 90066 Network security rules (NSGs) 90067 90014 If you need basic network level access control (based on IP address and the TCP or UDP protocols), you can use Network Security Groups (NSGs). An NSG is a basic, stateful, packet filtering firewall, and it enables you to control access based on a 5-tuple. NSGs include functionality to simplify management and reduce the chances of configuration mistakes: 90015 90018 90003 90072 Augmented security rules 90073 simplify NSG rule definition and allow you to create complex rules rather than having to create multiple simple rules to achieve the same result.90006 90003 90072 Service tags 90073 are Microsoft created labels that represent a group of IP addresses. They update dynamically to include IP ranges that meet the conditions that define inclusion in the label. For example, if you want to create a rule that applies to all Azure storage on the east region you can use Storage.EastUS 90006 90003 90072 Application security groups 90073 allow you to deploy resources to application groups and control the access to those resources by creating rules that use those application groups.For example, if you have webservers deployed to the ‘Webservers’ application group you can create a rule that applies a NSG allowing 443 traffic from the Internet to all systems in the ‘Webservers’ application group. 90006 90011 90014 NSGs do not provide application layer inspection or authenticated access controls. 90015 90014 Learn more: 90015 90066 ASC just in time VM access 90067 90014 Azure security center can manage the NSGs on VMs and lock access to the VM until a user with the appropriate role-based access control RBAC permissions requests access.When the user is successfully authorized ASC makes modifications to the NSGs to allow access to selected ports for the time specified. When the time expires the NSGs are restored to their previous secured state. 90015 90014 Learn more: 90015 90066 Service endpoints 90067 90014 Service endpoints are another way to apply control over your traffic. You can limit communication with supported services to just your VNets over a direct connection. Traffic from your VNet to the specified Azure service remains on the Microsoft Azure backbone network.90015 90014 Learn more: 90015 90012 Route control and forced tunneling 90013 90014 The ability to control routing behavior on your virtual networks is critical. If routing is configured incorrectly, applications and services hosted on your virtual machine might connect to unauthorized devices, including systems owned and operated by potential attackers. 90015 90014 Azure networking supports the ability to customize the routing behavior for network traffic on your virtual networks. This enables you to alter the default routing table entries in your virtual network.Control of routing behavior helps you make sure that all traffic from a certain device or group of devices enters or leaves your virtual network through a specific location. 90015 90014 For example, you might have a virtual network security appliance on your virtual network. You want to make sure that all traffic to and from your virtual network goes through that virtual security appliance. You can do this by configuring User Defined Routes (UDRs) in Azure. 90015 90014 Forced tunneling is a mechanism you can use to ensure that your services are not allowed to initiate a connection to devices on the internet.Note that this is different from accepting incoming connections and then responding to them. Front-end web servers need to respond to requests from internet hosts, and so internet-sourced traffic is allowed inbound to these web servers and the web servers are allowed to respond. 90015 90014 What you do not want to allow is a front-end web server to initiate an outbound request. Such requests might represent a security risk because these connections can be used to download malware. Even if you do want these front-end servers to initiate outbound requests to the internet, you might want to force them to go through your on-premises web proxies.This enables you to take advantage of URL filtering and logging. 90015 90014 Instead, you would want to use forced tunneling to prevent this. When you enable forced tunneling, all connections to the internet are forced through your on-premises gateway. You can configure forced tunneling by taking advantage of UDRs. 90015 90014 Learn more: 90015 90012 Virtual network security appliances 90013 90014 While NSGs, UDRs, and forced tunneling provide you a level of security at the network and transport layers of the OSI model, you might also want to enable security at levels higher than the network.90015 90014 For example, your security requirements might include: 90015 90018 90003 Authentication and authorization before allowing access to your application 90006 90003 Intrusion detection and intrusion response 90006 90003 Application layer inspection for high-level protocols 90006 90003 URL filtering 90006 90003 Network level antivirus and Antimalware 90006 90003 Anti-bot protection 90006 90003 Application access control 90006 90003 Additional DDoS protection (above the DDoS protection provided by the Azure fabric itself) 90006 90011 90014 You can access these enhanced network security features by using an Azure partner solution.You can find the most current Azure partner network security solutions by visiting the Azure Marketplace, and searching for «security» and «network security.» 90015 90042 Azure Firewall 90043 90014 Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources. It is a fully stateful firewall as a service with built-in high availability and unrestricted cloud scalability. Some features include: 90015 90018 90003 High availability 90006 90003 Cloud scalability 90006 90003 Application FQDN filtering rules 90006 90003 Network traffic filtering rules 90006 90011 90014 Learn more: 90015 90042 Secure remote access and cross-premises connectivity 90043 90014 Setup, configuration, and management of your Azure resources needs to be done remotely.In addition, you might want to deploy hybrid IT solutions that have components on-premises and in the Azure public cloud. These scenarios require secure remote access. 90015 90014 Azure networking supports the following secure remote access scenarios: 90015 90018 90003 Connect individual workstations to a virtual network 90006 90003 Connect your on-premises network to a virtual network with a VPN 90006 90003 Connect your on-premises network to a virtual network with a dedicated WAN link 90006 90003 Connect virtual networks to each other 90006 90011 90012 Connect individual workstations to a virtual network 90013 90014 You might want to enable individual developers or operations personnel to manage virtual machines and services in Azure.For example, let’s say you need access to a virtual machine on a virtual network. But your security policy does not allow RDP or SSH remote access to individual virtual machines. In this case, you can use a point-to-site VPN connection. 90015 90014 The point-to-site VPN connection enables you to set up a private and secure connection between the user and the virtual network. When the VPN connection is established, the user can RDP or SSH over the VPN link into any virtual machine on the virtual network.(This assumes that the user can authenticate and is authorized.) Point-to-site VPN supports: 90015 90018 90003 90014 Secure Socket Tunneling Protocol (SSTP), a proprietary SSL-based VPN protocol. An SSL VPN solution can penetrate firewalls, since most firewalls open TCP port 443, which TLS / SSL uses. SSTP is only supported on Windows devices. Azure supports all versions of Windows that have SSTP (Windows 7 and later). 90015 90006 90003 90014 IKEv2 VPN, a standards-based IPsec VPN solution.IKEv2 VPN can be used to connect from Mac devices (OSX versions 10.11 and above). 90015 90006 90003 90014 OpenVPN 90015 90006 90011 90014 Learn more: 90015 90012 Connect your on-premises network to a virtual network with a VPN 90013 90014 You might want to connect your entire corporate network, or portions of it, to a virtual network. This is common in hybrid IT scenarios, where organizations extend their on-premises datacenter into Azure. In many cases, organizations host parts of a service in Azure, and parts on-premises.For example, they might do so when a solution includes front-end web servers in Azure and back-end databases on-premises. These types of «cross-premises» connections also make management of Azure located resources more secure, and enable scenarios such as extending Active Directory domain controllers into Azure. 90015 90014 One way to accomplish this is to use a site-to-site VPN. The difference between a site-to-site VPN and a point-to-site VPN is that the latter connects a single device to a virtual network.A site-to-site VPN connects an entire network (such as your on-premises network) to a virtual network. Site-to-site VPNs to a virtual network use the highly secure IPsec tunnel mode VPN protocol. 90015 90014 Learn more: 90015 90012 Connect your on-premises network to a virtual network with a dedicated WAN link 90013 90014 Point-to-site and site-to-site VPN connections are effective for enabling cross-premises connectivity. However, some organizations consider them to have the following drawbacks: 90015 90018 90003 VPN connections move data over the internet.This exposes these connections to potential security issues involved with moving data over a public network. In addition, reliability and availability for internet connections can not be guaranteed. 90006 90003 VPN connections to virtual networks might not have the bandwidth for some applications and purposes, as they max out at around 200 Mbps. 90006 90011 90014 Organizations that need the highest level of security and availability for their cross-premises connections typically use dedicated WAN links to connect to remote sites.Azure provides you the ability to use a dedicated WAN link that you can use to connect your on-premises network to a virtual network. Azure ExpressRoute, Express route direct, and Express route global reach enable this. 90015 90014 Learn more: 90015 90012 Connect virtual networks to each other 90013 90014 It is possible to use many virtual networks for your deployments. There are various reasons why you might do this. You might want to simplify management, or you might want increased security.Regardless of the motivation for putting resources on different virtual networks, there might be times when you want resources on each of the networks to connect with one another. 90015 90014 One option is for services on one virtual network to connect to services on another virtual network, by «looping back» through the internet. The connection starts on one virtual network, goes through the internet, and then comes back to the destination virtual network. This option exposes the connection to the security issues inherent in any internet-based communication.90015 90014 A better option might be to create a site-to-site VPN that connects between two virtual networks. This method uses the same IPSec tunnel mode protocol as the cross-premises site-to-site VPN connection mentioned above. 90015 90014 The advantage of this approach is that the VPN connection is established over the Azure network fabric, instead of connecting over the internet. This provides you an extra layer of security, compared to site-to-site VPNs that connect over the internet. 90015 90014 Learn more: 90015 90014 Another way to connect your virtual networks is VNET peering.This feature allows you to connect two Azure networks so that communication between them happens over the Microsoft backbone infrastructure without it ever going over the Internet. VNET peering can connect two VNETs within the same region or two VNETs across Azure regions. NSGs can be used to limit connectivity between different subnets or systems. 90015 90042 Availability 90043 90014 Availability is a key component of any security program. If your users and systems can not access what they need to access over the network, the service can be considered compromised.Azure has networking technologies that support the following high-availability mechanisms: 90015 90018 90003 HTTP-based load balancing 90006 90003 Network level load balancing 90006 90003 Global load balancing 90006 90011 90014 Load balancing is a mechanism designed to equally distribute connections among multiple devices. The goals of load balancing are: 90015 90018 90003 To increase availability. When you load balance connections across multiple devices, one or more of the devices can become unavailable without compromising the service.The services running on the remaining online devices can continue to serve the content from the service. 90006 90003 To increase performance. When you load balance connections across multiple devices, a single device does not have to handle all processing. Instead, the processing and memory demands for serving the content is spread across multiple devices. 90006 90011 90012 HTTP-based load balancing 90013 90014 Organizations that run web-based services often desire to have an HTTP-based load balancer in front of those web services.This helps ensure adequate levels of performance and high availability. Traditional, network-based load balancers rely on network and transport layer protocols. HTTP-based load balancers, on the other hand, make decisions based on characteristics of the HTTP protocol. 90015 90014 Azure Application Gateway provides HTTP-based load balancing for your web-based services. Application Gateway supports: 90015 90018 90003 Cookie-based session affinity. This capability makes sure that connections established to one of the servers behind that load balancer stays intact between the client and server.This ensures stability of transactions. 90006 90003 TLS offload. When a client connects with the load balancer, that session is encrypted by using the HTTPS (TLS) protocol. However, in order to increase performance, you can use the HTTP (unencrypted) protocol to connect between the load balancer and the web server behind the load balancer. This is referred to as «TLS offload,» because the web servers behind the load balancer do not experience the processor overhead involved with encryption. The web servers can therefore service requests more quickly.90006 90003 URL-based content routing. This feature makes it possible for the load balancer to make decisions about where to forward connections based on the target URL. This provides a lot more flexibility than solutions that make load balancing decisions based on IP addresses. 90006 90011 90014 Learn more: 90015 90012 Network level load balancing 90013 90014 In contrast to HTTP-based load balancing, network level load balancing makes decisions based on IP address and port (TCP or UDP) numbers.You can gain the benefits of network level load balancing in Azure by using Azure Load Balancer. Some key characteristics of Load Balancer include: 90015 90018 90003 Network level load balancing based on IP address and port numbers. 90006 90003 Support for any application layer protocol. 90006 90003 Load balances to Azure virtual machines and cloud services role instances. 90006 90003 Can be used for both internet-facing (external load balancing) and non-internet facing (internal load balancing) applications and virtual machines.90006 90003 Endpoint monitoring, which is used to determine if any of the services behind the load balancer have become unavailable. 90006 90011 90014 Learn more: 90015 90012 Global load balancing 90013 90014 Some organizations want the highest level of availability possible. One way to reach this goal is to host applications in globally distributed datacenters. When an application is hosted in datacenters located throughout the world, it’s possible for an entire geopolitical region to become unavailable, and still have the application up and running.90015 90014 This load-balancing strategy can also yield performance benefits. You can direct requests for the service to the datacenter that is nearest to the device that is making the request. 90015 90014 In Azure, you can gain the benefits of global load balancing by using Azure Traffic Manager. 90015 90014 Learn more: 90015 90042 Name resolution 90043 90014 Name resolution is a critical function for all services you host in Azure. From a security perspective, compromise of the name resolution function can lead to an attacker redirecting requests from your sites to an attacker’s site.Secure name resolution is a requirement for all your cloud hosted services. 90015 90014 There are two types of name resolution you need to address: 90015 90018 90003 Internal name resolution. This is used by services on your virtual networks, your on-premises networks, or both. Names used for internal name resolution are not accessible over the internet. For optimal security, it’s important that your internal name resolution scheme is not accessible to external users. 90006 90003 External name resolution.This is used by people and devices outside of your on-premises networks and virtual networks. These are the names that are visible to the internet, and are used to direct connection to your cloud-based services. 90006 90011 90014 For internal name resolution, you have two options: 90015 90018 90003 A virtual network DNS server. When you create a new virtual network, a DNS server is created for you. This DNS server can resolve the names of the machines located on that virtual network. This DNS server is not configurable, is managed by the Azure fabric manager, and can therefore help you secure your name resolution solution.90006 90003 Bring your own DNS server. You have the option of putting a DNS server of your own choosing on your virtual network. This DNS server can be an Active Directory integrated DNS server, or a dedicated DNS server solution provided by an Azure partner, which you can obtain from the Azure Marketplace. 90006 90011 90014 Learn more: 90015 90014 For external name resolution, you have two options: 90015 90018 90003 Host your own external DNS server on-premises. 90006 90003 Host your own external DNS server with a service provider.90006 90011 90014 Many large organizations host their own DNS servers on-premises. They can do this because they have the networking expertise and global presence to do so. 90015 90014 In most cases, it’s better to host your DNS name resolution services with a service provider. These service providers have the network expertise and global presence to ensure very high availability for your name resolution services. Availability is essential for DNS services, because if your name resolution services fail, no one will be able to reach your internet facing services.90015 90014 Azure provides you with a highly available and high-performing external DNS solution in the form of Azure DNS. This external name resolution solution takes advantage of the worldwide Azure DNS infrastructure. It allows you to host your domain in Azure, using the same credentials, APIs, tools, and billing as your other Azure services. As part of Azure, it also inherits the strong security controls built into the platform. 90015 90014 Learn more: 90015 90042 Perimeter network architecture 90043 90014 Many large organizations use perimeter networks to segment their networks, and create a buffer-zone between the internet and their services.The perimeter portion of the network is considered a low-security zone, and no high-value assets are placed in that network segment. You’ll typically see network security devices that have a network interface on the perimeter network segment. Another network interface is connected to a network that has virtual machines and services that accept inbound connections from the internet. 90015 90014 You can design perimeter networks in a number of different ways. The decision to deploy a perimeter network, and then what type of perimeter network to use if you decide to use one, depends on your network security requirements.90015 90014 Learn more: 90015 90042 Azure DDoS protection 90043 90014 Distributed denial of service (DDoS) attacks are some of the largest availability and security concerns facing customers that are moving their applications to the cloud. A DDoS attack attempts to exhaust an application’s resources, making the application unavailable to legitimate users. DDoS attacks can be targeted at any endpoint that is publicly reachable through the internet. Microsoft provides DDoS protection known as 90072 Basic 90073 as part of the Azure Platform.This comes at no charge and includes always on monitoring and real-time mitigation of common network level attacks. In addition to the protections included with DDoS protection 90072 Basic 90073 you can enable the 90072 Standard 90073 option. DDoS Protection Standard features include: 90015 90018 90003 90072 Native platform integration: 90073 Natively integrated into Azure. Includes configuration through the Azure portal. DDoS Protection Standard understands your resources and resource configuration.90006 90003 90072 Turn-key protection: 90073 Simplified configuration immediately protects all resources on a virtual network as soon as DDoS Protection Standard is enabled. No intervention or user definition is required. DDoS Protection Standard instantly and automatically mitigates the attack, once it is detected. 90006 90003 90072 Always-on traffic monitoring: 90073 Your application traffic patterns are monitored 24 hour a day, 7 days a week, looking for indicators of DDoS attacks. Mitigation is performed when protection policies are exceeded.90006 90003 90072 Attack Mitigation Reports 90073 Attack Mitigation Reports use aggregated network flow data to provide detailed information about attacks targeted at your resources. 90006 90003 90072 Attack Mitigation Flow Logs 90073 Attack Mitigation Flow Logs allow you to review the dropped traffic, forwarded traffic and other attack data in near real-time during an active DDoS attack. 90006 90003 90072 Adaptive tuning: 90073 Intelligent traffic profiling learns your application’s traffic over time, and selects and updates the profile that is the most suitable for your service.The profile adjusts as traffic changes over time. Layer 3 to layer 7 protection: Provides full stack DDoS protection, when used with a web application firewall. 90006 90003 90072 Extensive mitigation scale: 90073 Over 60 different attack types can be mitigated, with global capacity, to protect against the largest known DDoS attacks. 90006 90003 90072 Attack metrics: 90073 Summarized metrics from each attack are accessible through Azure Monitor. 90006 90003 90072 Attack alerting: 90073 Alerts can be configured at the start and stop of an attack, and over the attack’s duration, using built-in attack metrics.Alerts integrate into your operational software like Microsoft Azure Monitor logs, Splunk, Azure Storage, Email, and the Azure portal. 90006 90003 90072 Cost guarantee: 90073 Data-transfer and application scale-out service credits for documented DDoS attacks. 90006 90003 90072 DDoS Rapid responsive 90073 DDoS Protection Standard customers now have access to Rapid Response team during an active attack. DRR can help with attack investigation, custom mitigations during an attack and post-attack analysis.90006 90011 90014 Learn more: 90015 90042 Azure Front Door 90043 90014 Azure Front Door Service enables you to define, manage, and monitor the global routing of your web traffic. It optimizes your traffic’s routing for best performance and high availability. Azure Front Door allows you to author custom web application firewall (WAF) rules for access control to protect your HTTP / HTTPS workload from exploitation based on client IP addresses, country code, and http parameters. Additionally, Front Door also enables you to create rate limiting rules to battle malicious bot traffic, it includes TLS offloading and per-HTTP / HTTPS request, application-layer processing.90015 90014 Front Door platform itself is protected by Azure DDoS Protection Basic. For further protection, Azure DDoS Protection Standard may be enabled at your VNETs and safeguard resources from network layer (TCP / UDP) attacks via auto tuning and mitigation. Front Door is a layer 7 reverse proxy, it only allows web traffic to pass through to back end servers and block other types of traffic by default. 90015 90014 Learn more: 90015 90042 Azure Traffic manager 90043 90014 Azure Traffic Manager is a DNS-based traffic load balancer that enables you to distribute traffic optimally to services across global Azure regions, while providing high availability and responsiveness.Traffic Manager uses DNS to direct client requests to the most appropriate service endpoint based on a traffic-routing method and the health of the endpoints. An endpoint is any Internet-facing service hosted inside or outside of Azure. Traffic manager monitors the end points and does not direct traffic to any endpoints that are unavailable. 90015 90014 Learn more: 90015 90042 Monitoring and threat detection 90043 90014 Azure provides capabilities to help you in this key area with early detection, monitoring, and collecting and reviewing network traffic.90015 90012 Azure Network Watcher 90013 90014 Azure Network Watcher can help you troubleshoot, and provides a whole new set of tools to assist with the identification of security issues. 90015 90014 Security Group View helps with auditing and security compliance of Virtual Machines. Use this feature to perform programmatic audits, comparing the baseline policies defined by your organization to effective rules for each of your VMs. This can help you identify any configuration drift. 90015 90014 Packet capture allows you to capture network traffic to and from the virtual machine.You can collect network statistics and troubleshoot application issues, which can be invaluable in the investigation of network intrusions. You can also use this feature together with Azure Functions to start network captures in response to specific Azure alerts. 90015 90014 For more information on Network Watcher and how to start testing some of the functionality in your labs, see Azure network watcher monitoring overview. 90015 90014 Note 90015 90014 For the most up-to-date notifications on availability and status of this service, check the Azure updates page.90015 90012 Azure Security Center 90013 90014 Azure Security Center helps you prevent, detect, and respond to threats, and provides you increased visibility into, and control over, the security of your Azure resources. It provides integrated security monitoring and policy management across your Azure subscriptions, helps detect threats that might otherwise go unnoticed, and works with a large set of security solutions. 90015 90014 Security Center helps you optimize and monitor network security by: 90015 90018 90003 Providing network security recommendations.90006 90003 Monitoring the state of your network security configuration. 90006 90003 Alerting you to network based threats, both at the endpoint and network levels. 90006 90011 90014 Learn more: 90015 90012 Virtual Network TAP 90013 90014 Azure virtual network TAP (Terminal Access Point) allows you to continuously stream your virtual machine network traffic to a network packet collector or analytics tool. The collector or analytics tool is provided by a network virtual appliance partner.You can use the same virtual network TAP resource to aggregate traffic from multiple network interfaces in the same or different subscriptions. 90015 90014 Learn more: 90015 90012 Logging 90013 90014 Logging at a network level is a key function for any network security scenario. In Azure, you can log information obtained for NSGs to get network level logging information. With NSG logging, you get information from: 90015 90018 90003 Activity logs. Use these logs to view all operations submitted to your Azure subscriptions.These logs are enabled by default, and can be used within the Azure portal. They were previously known as audit or operational logs. 90006 90003 Event logs. These logs provide information about what NSG rules were applied. 90006 90003 Counter logs. These logs let you know how many times each NSG rule was applied to deny or allow traffic. 90006 90011 90014 You can also use Microsoft Power BI, a powerful data visualization tool, to view and analyze these logs. Learn more: 90015 .90000 Best practices for network security — Microsoft Azure 90001 90002 90003 90004 10/02/2019 90005 90006 90003 16 minutes to read 90006 90003 90006 90011 90012 In this article 90013 90014 This article discusses a collection of Azure best practices to enhance your network security.These best practices are derived from our experience with Azure networking and the experiences of customers like yourself. 90015 90014 For each best practice, this article explains: 90015 90018 90003 What the best practice is 90006 90003 Why you want to enable that best practice 90006 90003 What might be the result if you fail to enable the best practice 90006 90003 Possible alternatives to the best practice 90006 90003 How you can learn to enable the best practice 90006 90011 90014 These best practices are based on a consensus opinion, and Azure platform capabilities and feature sets, as they exist at the time this article was written.Opinions and technologies change over time and this article will be updated on a regular basis to reflect those changes. 90015 90032 Use strong network controls 90033 90014 You can connect Azure virtual machines (VMs) and appliances to other networked devices by placing them on Azure virtual networks. That is, you can connect virtual network interface cards to a virtual network to allow TCP / IP-based communications between network-enabled devices. Virtual machines connected to an Azure virtual network can connect to devices on the same virtual network, different virtual networks, the internet, or your own on-premises networks.90015 90014 As you plan your network and the security of your network, we recommend that you centralize: 90015 90018 90003 Management of core network functions like ExpressRoute, virtual network and subnet provisioning, and IP addressing. 90006 90003 Governance of network security elements, such as network virtual appliance functions like ExpressRoute, virtual network and subnet provisioning, and IP addressing. 90006 90011 90014 If you use a common set of management tools to monitor your network and the security of your network, you get clear visibility into both.A straightforward, unified security strategy reduces errors because it increases human understanding and the reliability of automation. 90015 90032 Logically segment subnets 90033 90014 Azure virtual networks are similar to LANs on your on-premises network. The idea behind an Azure virtual network is that you create a network, based on a single private IP address space, on which you can place all your Azure virtual machines. The private IP address spaces available are in the Class A (10.0.0.0/8), Class B (172.16.0.0/12), and Class C (192.168.0.0/16) ranges. 90015 90014 Best practices for logically segmenting subnets include: 90015 90014 90053 Best practice 90054: Do not assign allow rules with broad ranges (for example, allow 0.0.0.0 through 255.255.255.255). 90055 90053 Detail 90054: Ensure troubleshooting procedures discourage or ban setting up these types of rules. These allow rules lead to a false sense of security and are frequently found and exploited by red teams. 90015 90014 90053 Best practice 90054: Segment the larger address space into subnets.90055 90053 Detail 90054: Use CIDR-based subnetting principles to create your subnets. 90015 90014 90053 Best practice 90054: Create network access controls between subnets. Routing between subnets happens automatically, and you do not need to manually configure routing tables. By default, there are no network access controls between the subnets that you create on an Azure virtual network. 90055 90053 Detail 90054: Use a network security group to protect against unsolicited traffic into Azure subnets.Network security groups are simple, stateful packet inspection devices that use the 5-tuple approach (source IP, source port, destination IP, destination port, and layer 4 protocol) to create allow / deny rules for network traffic. You allow or deny traffic to and from a single IP address, to and from multiple IP addresses, or to and from entire subnets. 90015 90014 When you use network security groups for network access control between subnets, you can put resources that belong to the same security zone or role in their own subnets.90015 90014 90053 Best practice 90054: Avoid small virtual networks and subnets to ensure simplicity and flexibility. 90055 90053 Detail 90054: Most organizations add more resources than initially planned, and re-allocating addresses is labor intensive. Using small subnets adds limited security value, and mapping a network security group to each subnet adds overhead. Define subnets broadly to ensure that you have flexibility for growth. 90015 90014 90053 Best practice 90054: Simplify network security group rule management by defining Application Security Groups.90055 90053 Detail 90054: Define an Application Security Group for lists of IP addresses that you think might change in the future or be used across many network security groups. Be sure to name Application Security Groups clearly so others can understand their content and purpose. 90015 90032 Adopt a Zero Trust approach 90033 90014 Perimeter-based networks operate on the assumption that all systems within a network can be trusted. But today’s employees access their organization’s resources from anywhere on a variety of devices and apps, which makes perimeter security controls irrelevant.Access control policies that focus only on who can access a resource are not enough. To master the balance between security and productivity, security admins also need to factor in 90092 how 90093 a resource is being accessed. 90015 90014 Networks need to evolve from traditional defenses because networks might be vulnerable to breaches: an attacker can compromise a single endpoint within the trusted boundary and then quickly expand a foothold across the entire network. Zero Trust networks eliminate the concept of trust based on network location within a perimeter.Instead, Zero Trust architectures use device and user trust claims to gate access to organizational data and resources. For new initiatives, adopt Zero Trust approaches that validate trust at the time of access. 90015 90014 Best practices are: 90015 90014 90053 Best practice 90054: Give Conditional Access to resources based on device, identity, assurance, network location, and more. 90055 90053 Detail 90054: Azure AD Conditional Access lets you apply the right access controls by implementing automated access control decisions based on the required conditions.For more information, see Manage access to Azure management with Conditional Access. 90015 90014 90053 Best practice 90054: Enable port access only after workflow approval. 90055 90053 Detail 90054: You can use just-in-time VM access in Azure Security Center to lock down inbound traffic to your Azure VMs, reducing exposure to attacks while providing easy access to connect to VMs when needed. 90015 90014 90053 Best practice 90054: Grant temporary permissions to perform privileged tasks, which prevents malicious or unauthorized users from gaining access after the permissions have expired.Access is granted only when users need it. 90055 90053 Detail 90054: Use just-in-time access in Azure AD Privileged Identity Management or in a third-party solution to grant permissions to perform privileged tasks. 90015 90014 Zero Trust is the next evolution in network security. The state of cyberattacks drives organizations to take the «assume breach» mindset, but this approach should not be limiting. Zero Trust networks protect corporate data and resources while ensuring that organizations can build a modern workplace by using technologies that empower employees to be productive anytime, anywhere, in any way.90015 90032 Control routing behavior 90033 90014 When you put a virtual machine on an Azure virtual network, the VM can connect to any other VM on the same virtual network, even if the other VMs are on different subnets. This is possible because a collection of system routes enabled by default allows this type of communication. These default routes allow VMs on the same virtual network to initiate connections with each other, and with the internet (for outbound communications to the internet only).90015 90014 Although the default system routes are useful for many deployment scenarios, there are times when you want to customize the routing configuration for your deployments. You can configure the next-hop address to reach specific destinations. 90015 90014 We recommend that you configure user-defined routes when you deploy a security appliance for a virtual network. We talk about this in a later section titled secure your critical Azure service resources to only your virtual networks. 90015 90014 Note 90015 90014 User-defined routes are not required, and the default system routes usually work.90015 90032 Use virtual network appliances 90033 90014 Network security groups and user-defined routing can provide a certain measure of network security at the network and transport layers of the OSI model. But in some situations, you want or need to enable security at high levels of the stack. In such situations, we recommend that you deploy virtual network security appliances provided by Azure partners. 90015 90014 Azure network security appliances can deliver better security than what network-level controls provide.Network security capabilities of virtual network security appliances include: 90015 90018 90003 Firewalling 90006 90003 Intrusion detection / intrusion prevention 90006 90003 Vulnerability management 90006 90003 Application control 90006 90003 Network-based anomaly detection 90006 90003 Web filtering 90006 90003 Antivirus 90006 90003 Botnet protection 90006 90011 90014 To find available Azure virtual network security appliances, go to the Azure Marketplace and search for «security» and «network security.»90015 90032 Deploy perimeter networks for security zones 90033 90014 A perimeter network (also known as a DMZ) is a physical or logical network segment that provides an additional layer of security between your assets and the internet. Specialized network access control devices on the edge of a perimeter network allow only desired traffic into your virtual network. 90015 90014 Perimeter networks are useful because you can focus your network access control management, monitoring, logging, and reporting on the devices at the edge of your Azure virtual network.A perimeter network is where you typically enable distributed denial of service (DDoS) prevention, intrusion detection / intrusion prevention systems (IDS / IPS), firewall rules and policies, web filtering, network antimalware, and more. The network security devices sit between the internet and your Azure virtual network and have an interface on both networks. 90015 90014 Although this is the basic design of a perimeter network, there are many different designs, like back-to-back, tri-homed, and multi-homed.90015 90014 Based on the Zero Trust concept mentioned earlier, we recommend that you consider using a perimeter network for all high security deployments to enhance the level of network security and access control for your Azure resources. You can use Azure or a third-party solution to provide an additional layer of security between your assets and the internet: 90015 90018 90003 Azure native controls. Azure Firewall and the web application firewall in Application Gateway offer basic security with a fully stateful firewall as a service, built-in high availability, unrestricted cloud scalability, FQDN filtering, support for OWASP core rule sets, and simple setup and configuration.90006 90003 Third-party offerings. Search the Azure Marketplace for next-generation firewall (NGFW) and other third-party offerings that provide familiar security tools and significantly enhanced levels of network security. Configuration might be more complex, but a third-party offering might allow you to use existing capabilities and skillsets. 90006 90011 90032 Avoid exposure to the internet with dedicated WAN links 90033 90014 Many organizations have chosen the hybrid IT route. With hybrid IT, some of the company’s information assets are in Azure, and others remain on-premises.In many cases, some components of a service are running in Azure while other components remain on-premises. 90015 90014 In a hybrid IT scenario, there is usually some type of cross-premises connectivity. Cross-premises connectivity allows the company to connect its on-premises networks to Azure virtual networks. Two cross-premises connectivity solutions are available: 90015 90018 90003 Site-to-site VPN. It’s a trusted, reliable, and established technology, but the connection takes place over the internet.Bandwidth is constrained to a maximum of about 1.25 Gbps. Site-to-site VPN is a desirable option in some scenarios. 90006 90003 90053 Azure ExpressRoute 90054. We recommend that you use ExpressRoute for your cross-premises connectivity. ExpressRoute lets you extend your on-premises networks into the Microsoft cloud over a private connection facilitated by a connectivity provider. With ExpressRoute, you can establish connections to Microsoft cloud services like Azure, Office 365, and Dynamics 365.ExpressRoute is a dedicated WAN link between your on-premises location or a Microsoft Exchange hosting provider. Because this is a telco connection, your data does not travel over the internet, so it is not exposed to the potential risks of internet communications. 90006 90011 90014 The location of your ExpressRoute connection can affect firewall capacity, scalability, reliability, and network traffic visibility. You’ll need to identify where to terminate ExpressRoute in existing (on-premises) networks.You can: 90015 90018 90003 Terminate outside the firewall (the perimeter network paradigm) if you require visibility into the traffic, if you need to continue an existing practice of isolating datacenters, or if you’re solely putting extranet resources on Azure. 90006 90003 Terminate inside the firewall (the network extension paradigm). This is the default recommendation. In all other cases, we recommend treating Azure as an nth datacenter. 90006 90011 90032 Optimize uptime and performance 90033 90014 If a service is down, information can not be accessed.If performance is so poor that the data is unusable, you can consider the data to be inaccessible. From a security perspective, you need to do whatever you can to make sure that your services have optimal uptime and performance. 90015 90014 A popular and effective method for enhancing availability and performance is load balancing. Load balancing is a method of distributing network traffic across servers that are part of a service. For example, if you have front-end web servers as part of your service, you can use load balancing to distribute the traffic across your multiple front-end web servers.90015 90014 This distribution of traffic increases availability because if one of the web servers becomes unavailable, the load balancer stops sending traffic to that server and redirects it to the servers that are still online. Load balancing also helps performance, because the processor, network, and memory overhead for serving requests is distributed across all the load-balanced servers. 90015 90014 We recommend that you employ load balancing whenever you can, and as appropriate for your services.Following are scenarios at both the Azure virtual network level and the global level, along with load-balancing options for each. 90015 90014 90053 Scenario 90054: You have an application that: 90015 90018 90003 Requires requests from the same user / client session to reach the same back-end virtual machine. Examples of this are shopping cart apps and web mail servers. 90006 90003 Accepts only a secure connection, so unencrypted communication to the server is not an acceptable option. 90006 90003 Requires multiple HTTP requests on the same long-running TCP connection to be routed or load balanced to different back-end servers.90006 90011 90014 90053 Load-balancing option 90054: Use Azure Application Gateway, an HTTP web traffic load balancer. Application Gateway supports end-to-end TLS encryption and TLS termination at the gateway. Web servers can then be unburdened from encryption and decryption overhead and traffic flowing unencrypted to the back-end servers. 90015 90014 90053 Scenario 90054: You need to load balance incoming connections from the internet among your servers located in an Azure virtual network.Scenarios are when you: 90015 90018 90003 Have stateless applications that accept incoming requests from the internet. 90006 90003 Do not require sticky sessions or TLS offload. Sticky sessions is a method used with Application Load Balancing, to achieve server-affinity. 90006 90011 90014 90053 Load-balancing option 90054: Use the Azure portal to create an external load balancer that spreads incoming requests across multiple VMs to provide a higher level of availability. 90015 90014 90053 Scenario 90054: You need to load balance connections from VMs that are not on the internet.In most cases, the connections that are accepted for load balancing are initiated by devices on an Azure virtual network, such as SQL Server instances or internal web servers. 90055 90053 Load-balancing option 90054: Use the Azure portal to create an internal load balancer that spreads incoming requests across multiple VMs to provide a higher level of availability. 90015 90014 90053 Scenario 90054: You need global load balancing because you: 90015 90018 90003 Have a cloud solution that is widely distributed across multiple regions and requires the highest level of uptime (availability) possible.90006 90003 Need the highest level of uptime possible to make sure that your service is available even if an entire datacenter becomes unavailable. 90006 90011 90014 90053 Load-balancing option 90054: Use Azure Traffic Manager. Traffic Manager makes it possible to load balance connections to your services based on the location of the user. 90015 90014 For example, if the user makes a request to your service from the EU, the connection is directed to your services located in an EU datacenter.This part of Traffic Manager global load balancing helps to improve performance because connecting to the nearest datacenter is faster than connecting to datacenters that are far away. 90015 90032 Disable RDP / SSH Access to virtual machines 90033 90014 It’s possible to reach Azure virtual machines by using Remote Desktop Protocol (RDP) and the Secure Shell (SSH) protocol. These protocols enable the management VMs from remote locations and are standard in datacenter computing. 90015 90014 The potential security problem with using these protocols over the internet is that attackers can use brute force techniques to gain access to Azure virtual machines.After the attackers gain access, they can use your VM as a launch point for compromising other machines on your virtual network or even attack networked devices outside Azure. 90015 90014 We recommend that you disable direct RDP and SSH access to your Azure virtual machines from the internet. After direct RDP and SSH access from the internet is disabled, you have other options that you can use to access these VMs for remote management. 90015 90014 90053 Scenario 90054: Enable a single user to connect to an Azure virtual network over the internet.90055 90053 Option 90054: Point-to-site VPN is another term for a remote access VPN client / server connection. After the point-to-site connection is established, the user can use RDP or SSH to connect to any VMs located on the Azure virtual network that the user connected to via point-to-site VPN. This assumes that the user is authorized to reach those VMs. 90015 90014 Point-to-site VPN is more secure than direct RDP or SSH connections because the user has to authenticate twice before connecting to a VM.First, the user needs to authenticate (and be authorized) to establish the point-to-site VPN connection. Second, the user needs to authenticate (and be authorized) to establish the RDP or SSH session. 90015 90014 90053 Scenario 90054: Enable users on your on-premises network to connect to VMs on your Azure virtual network. 90055 90053 Option 90054: A site-to-site VPN connects an entire network to another network over the internet. You can use a site-to-site VPN to connect your on-premises network to an Azure virtual network.Users on your on-premises network connect by using the RDP or SSH protocol over the site-to-site VPN connection. You do not have to allow direct RDP or SSH access over the internet. 90015 90014 90053 Scenario 90054: Use a dedicated WAN link to provide functionality similar to the site-to-site VPN. 90055 90053 Option 90054: Use ExpressRoute. It provides functionality similar to the site-to-site VPN. The main differences are: 90015 90018 90003 The dedicated WAN link does not traverse the internet.90006 90003 Dedicated WAN links are typically more stable and perform better. 90006 90011 90032 Secure your critical Azure service resources to only your virtual networks 90033 90014 Use virtual network service endpoints to extend your virtual network private address space, and the identity of your virtual network to the Azure services, over a direct connection. Endpoints allow you to secure your critical Azure service resources to only your virtual networks. Traffic from your virtual network to the Azure service always remains on the Microsoft Azure backbone network.90015 90014 Service endpoints provide the following benefits: 90015 90018 90003 90014 90053 Improved security for your Azure service resources 90054: With service endpoints, Azure service resources can be secured to your virtual network. Securing service resources to a virtual network provides improved security by fully removing public internet access to resources, and allowing traffic only from your virtual network. 90015 90006 90003 90014 90053 Optimal routing for Azure service traffic from your virtual network 90054: Any routes in your virtual network that force internet traffic to your on-premises and / or virtual appliances, known as forced tunneling, also force Azure service traffic to take the same route as the internet traffic.Service endpoints provide optimal routing for Azure traffic. 90015 90014 Endpoints always take service traffic directly from your virtual network to the service on the Azure backbone network. Keeping traffic on the Azure backbone network allows you to continue auditing and monitoring outbound internet traffic from your virtual networks, through forced tunneling, without affecting service traffic. Learn more about user-defined routes and forced tunneling. 90015 90006 90003 90014 90053 Simple to set up with less management overhead 90054: You no longer need reserved, public IP addresses in your virtual networks to secure Azure resources through an IP firewall.There are no NAT or gateway devices required to set up the service endpoints. Service endpoints are configured through a simple click on a subnet. There is no additional overhead to maintain the endpoints. 90015 90006 90011 90014 To learn more about service endpoints and the Azure services and regions that service endpoints are available for, see Virtual network service endpoints. 90015 90032 Next steps 90033 90014 See Azure security best practices and patterns for more security best practices to use when you’re designing, deploying, and managing your cloud solutions by using Azure.90015 .