Question

A financial services company is deploying a multi-tier application across several Azure virtual networks (VNets) in a hub-and-spoke topology. Compliance auditors require that lateral (east/west) traffic between the web, application, and database tiers be inspected and filtered by a stateful firewall, and that no tier can communicate directly without policy enforcement. The security team wants to centralize this inspection with minimal per-VNet configuration. Which design best meets these requirements?

Accepted Answer

Deploy Azure Firewall in the hub VNet and configure user-defined routes (UDRs) in each spoke to force inter-spoke traffic through the firewall

Answer

Enable VNet peering between all spokes in a full-mesh topology and rely on default Azure NSG rules to segment tiers

Answer

Apply application security groups (ASGs) on each VM's NIC and allow all peered traffic between spokes to pass without central inspection

Answer

Route all east/west traffic out to the internet through Azure NAT Gateway so an external firewall appliance can inspect it before returning