Forum Discussion
Traffic Path - Azure Virtual Desktop
1. The outgoing AVD traffic (not the Internet access) is going to pass through default Azure NAT Gateway and if we want to control / police this without default route, a NVA / firewall is inevitable?
Yes, although I don't know how much control or visibility you would have over this kind of traffic, as it would stop the AVD brokers/gateway from communicating to the session hosts, I doubt you could control this, only the traffic to and from the session hosts (not the backend NAT gateway).
2. The reverse connect traffic is all HTTPS (TCP 443) or web traffic, but it doesn't requires anything like App Gateway because it's not originated from outside of Azure - always Azure originated?
Yep - https://ryanmangansitblog.com/2019/11/09/a-deep-dive-in-to-windows-virtual-desktop-reverse-connect/Keep in mind Firewall/NVA will offer better logging, visibility and ability to lock down traffic etc but it is not a requirement.
It is correct to say that:
1. The outgoing AVD traffic (not the Internet access) is going to pass through default Azure NAT Gateway and if we want to control / police this without default route, a NVA / firewall is inevitable?
2. The reverse connect connect traffic is all HTTPS (TCP 443) or web traffic, but it doesn't requires anything like App Gateway because it's not originated from outside of Azure - always Azure originated?
Thanks
Taranjeet Singh
1. The outgoing AVD traffic (not the Internet access) is going to pass through default Azure NAT Gateway and if we want to control / police this without default route, a NVA / firewall is inevitable?
Yes, although I don't know how much control or visibility you would have over this kind of traffic, as it would stop the AVD brokers/gateway from communicating to the session hosts, I doubt you could control this, only the traffic to and from the session hosts (not the backend NAT gateway).
2. The reverse connect traffic is all HTTPS (TCP 443) or web traffic, but it doesn't requires anything like App Gateway because it's not originated from outside of Azure - always Azure originated?
Yep - https://ryanmangansitblog.com/2019/11/09/a-deep-dive-in-to-windows-virtual-desktop-reverse-connect/
Keep in mind Firewall/NVA will offer better logging, visibility and ability to lock down traffic etc but it is not a requirement.