Worldwide cloud networks have substantial differences compared to those in the on-premises, but they are united by the need to be constantly monitored, managed and analyzed. All this is important for to know them better, in order to protect them and optimize them. Microsoft introduced in Azure the solution called Traffic Analytics, fully cloud-based, allowing you to have an overall visibility on network activities that are undertaken in the cloud environment. This article analyzes the characteristics of the solution and explains how you can turn it.
Operating principles of the solution
In Azure to allow or deny network communication to the resources connected with Azure Virtual Networks (vNet) it uses the Network Security Group (NSG), containing a list of access rules. The NSGs are applied to network interfaces connected to the virtual machines, or directly to the subnet. The platform uses NSG flow logs to maintain the visibility of inbound and outbound network traffic from the Network Security Group. Traffic Analytics is based on the analysis of NSG flow logs and after an appropriate aggregation of data, inserting the necessary intelligence concerning security, topology and geographic map, can provide detailed information about the network traffic of your Azure cloud environment.
Figure 1 – Data flow of Traffic Analytics
Solution functionality
Using Traffic Analytics you can do the following:
- View network activities cross Azure subscriptions and identify hotspots.
- Intercept potential network security threats, in order to take the right remedial actions. This is made possible thanks to the information provided by the solution: which ports are open, what applications attempt to access to Internet and which virtual machines connect to unauthorized networks.
- Understand network flows between different Azure regions and Internet, in order to optimize their deployment for network performance and capacity.
- Identify incorrect network configurations that lead to having incorrect communication attempts.
How to enable the solution
In order to analyze the network traffic you must have a Network Watcher in every region where there are the NSGs for which you intend to analyze traffic. The Network Watcher is a regional service, which makes it possible to monitor and diagnose the networking of Azure. Enabling Network Watcher can be made by Azure Portal, using Powershell or via REST API. By creating it from the portal it is not possible to determine the name of the Network Watcher and its Resource Group, but is assigned a default name in both entities.
Figure 2 – Enabling Network Watcher from the portal
Figure 3 – Enabling Network Watcher using PowerShell
As this is a preview service in order to use it you need to redo the registration of the network resource provider on the Azure subscription interested. You must also register the provider Azure Insights.
Figure 4 - Registration of the providers through PowerShell
In order to enable the collection of NSG Flow Logs you must have a storage account on which to store them. You must also have a workspace OMS Log Analytics on which Traffic Analytics will consolidate the aggregated and indexed data. The information present in Log Analytics will then be used to generate the analysis.
First configuration step of the NSG flow logs settings:
Figure 5 - Selection of the NSGs on which enable the collection of flow logs
Choice of storage account and workspace OMS Log Analytics for each NSGs:
Figure 6 – Enabling the collection of NSG flow logs and consolidation in OMS Log Analytics
The steps above must be repeated for each NSG for which you want to enable Traffic Analytics.
Figure 7 – List of NSGs with settings enabled
Within a few minutes from enabling, time necessary to obtain a quantity of sufficiently indicative aggregated data, its dashboard is populated with the information of Traffic Analytics.
Figure 8 – Traffic Analytics Dashboard
From the dashboard of Traffic Analytics information is readily available such as: hosts with a high level of communication, the most widely used application protocols, the communications that occur more frequently and the flows relating to network traffic in the cloud.
Selecting the section of interest is shown the query of Log Analytics that extrapolates the data:
Figure 9 - Sample query of Log Analytics showing the allowed malicious traffic
For a complete overview of the possible scenarios for using Traffic Analytics you can see this Microsoft's document.
Conclusions
Traffic Analytics is a new feature, currently in preview, introduced in Azure. It is an effective and easy-to-use tool that helps you keep track of the status of your network in Azure reporting very useful data, as who and where are connected, which ports are exposed to the internet, which network traffic is generated and more. This information is critical for detecting anomalies and make appropriate corrective actions. All operations that are difficult to achieve without this fully integrated tool in the platform.
