Azure vMX VNETs for Internet and LAN Port - Segmentation

[Mloraditch]

So we have started to Deploy vMXs in Azure in Routed mode with an Internet and LAN Port. 

One drawback I've identified is that you must use the same VNET for both ports. The Wizard doesn't allow different ones. I wanted to put the MX internet on a completely separate un-peered VNET for security reasons. 

I think my primary option is to develop rules via NSGs to block LAN subnets from the WAN subnet and vice versa.

Has anyone else noticed this? Am I missing something obvious? Seems like it would be a simple fix for Meraki to update the templates to allow this.

Do other public clouds have the same issue? We aren't going to be changing but curious.

[alemabrahao]

As you mentioned, using NSGs to create rules that block traffic between the LAN and WAN subnets is a viable approach.
Another option would be to implement UDRs to further control the flow of traffic between the subnets, ensuring that only allowed traffic passes through them.

Other public clouds, like AWS and Google Cloud, also have similar constraints when it comes to VNET/VPC configurations.

[ShaunB93 · Accepted solution]

This is an Azure constraint:
"You can connect network interfaces in the same VM to different subnets within a virtual network. However, the network interfaces must all be connected to the same virtual network"

Add network interfaces to or remove from Azure VMs | Microsoft Learn

[Mloraditch]

TIL! Thanks.