Security & Networking · Client: Enterprise SaaS Provider

Zero Trust Network Architecture in Azure: Firewalls, Private Link & NSGs

Architected and deployed a production-grade Zero Trust network in Azure using Hub-and-Spoke topology, Azure Firewall, Private Link, and strict NSG/ASG micro-segmentation.

Challenge

An enterprise SaaS provider was running a multi-tier application in a flat network architecture. The database and storage tiers had public endpoints exposed, workloads could freely communicate across boundaries without restriction, and outbound internet traffic lacked centralized inspection. Administrative access was handled via risky public SSH/RDP ports. They needed a complete security overhaul to adhere to Zero Trust principles (Verify explicitly, Use least privilege, Assume breach) to secure their customer data and achieve compliance.

Solution

We designed and implemented a strict Hub-and-Spoke network topology to enforce Zero Trust boundaries: 1. **Centralized Hub & Firewall:** Deployed Azure Firewall in the hub network to inspect and control all outbound internet and cross-spoke traffic using User Defined Routes (UDRs). 2. **Spoke Micro-Segmentation:** Segmented the architecture into distinct Application and Data spokes. We applied Network Security Groups (NSGs) and Application Security Groups (ASGs) to enforce granular, least-privilege traffic flow between the Web, App, and Database tiers. 3. **Private PaaS Access (Private Link):** Disabled all public network access on Azure SQL, Azure Key Vault, and Azure Storage. We deployed Azure Private Endpoints and configured Azure Private DNS to ensure all PaaS communication occurred securely over the Azure backbone. 4. **Secure Administration:** Eliminated public IPs on all virtual machines by deploying Azure Bastion, enabling secure, private RDP/SSH access for administrators.

Impact

The network redesign successfully eliminated all unauthorized public ingress to critical backend systems and PaaS services. By forcing traffic through Azure Firewall and locking down communications with ASGs, the blast radius of any potential compromise was severely restricted. The entire network infrastructure was codified using Terraform/Bicep, enabling repeatable, auditable deployments and vastly improving the organization's security posture and compliance readiness.