Azure SASE Integration¶
Business Objective¶
Why Azure?
1. Office 365 Optimization: 3,200 users on Exchange Online, Teams, SharePoint
2. Azure AD Integration: Existing identity provider for SSO
3. Global User Access: Remote workers, partners need secure access to corporate resources
4. Hybrid Cloud Strategy: Some workloads moving to Azure (future)
What is SASE?
Secure Access Service Edge = Network + Security delivered as a cloud service
Azure SASE Stack:
| Component | Purpose | Integration Point |
|---|---|---|
| Azure Virtual WAN | Cloud-based SD-WAN hub | Replaces physical hub routers for Azure-bound traffic |
| Azure Firewall | Cloud-native firewall | Complements on-premise FTD (not replacement) |
| Azure Front Door | Global load balancer + WAF | For web applications hosted in Azure |
| Azure Private Link | Private connectivity to Azure services | Access Azure SQL, Storage without public IPs |
| ExpressRoute | Dedicated circuit to Microsoft | Office 365 optimized path |
CRITICAL CLARIFICATION:
┌─────────────────────────────────────────────────────────────────────────────┐
│ AZURE SASE POSITIONING (NOT A CISCO REPLACEMENT) │
├─────────────────────────────────────────────────────────────────────────────┤
│ │
│ ❌ MISCONCEPTION: │
│ "Replace Cisco Umbrella SASE with Azure SASE" │
│ │
│ ✅ REALITY: │
│ "Add Azure SASE for Office 365 and Azure workloads" │
│ "Keep Cisco Umbrella SASE for internet/SaaS" │
│ │
│ ┌──────────────────────────────────────────────────────────────────────┐ │
│ │ TRAFFIC STEERING LOGIC: │ │
│ │ ──────────────────────────────────────────────────────────────────── │ │
│ │ │ │
│ │ Corporate Apps (10.252.x.x) → SD-WAN MPLS → On-Prem DC │ │
│ │ │ │
│ │ Office 365 (52.x.x.x) → SD-WAN → Azure ExpressRoute → │ │
│ │ Microsoft Peering │ │
│ │ │ │
│ │ Azure Workloads (10.100.x.x) → SD-WAN → Azure Virtual WAN → │ │
│ │ Azure VNet │ │
│ │ │ │
│ │ Internet / SaaS → SD-WAN → Umbrella SASE DIA → │ │
│ │ (Salesforce, YouTube, etc.) Inspection → Internet │ │
│ │ │ │
│ └──────────────────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────────────┘
Azure ExpressRoute (Office 365 Optimization)¶
Purpose: Dedicated, low-latency path to Office 365 (bypassing public internet).
Architecture:
┌─────────────────────────────────────────────────────────────────────────────┐
│ AZURE EXPRESSROUTE FOR OFFICE 365 │
├─────────────────────────────────────────────────────────────────────────────┤
│ │
│ ┌─────────────────────────────────────────────────────────────────────┐ │
│ │ ABHAVTECH ON-PREMISE (3 HUB SITES) │ │
│ │ ──────────────────────────────────────────────────────────────── │ │
│ │ │ │
│ │ Mumbai Hub London Hub NJ Hub │ │
│ │ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ │
│ │ │ SD-WAN │ │ SD-WAN │ │ SD-WAN │ │ │
│ │ │ C8500-12X│ │ C8500-12X│ │ C8500-12X│ │ │
│ │ └─────┬────┘ └─────┬────┘ └─────┬────┘ │ │
│ │ │ │ │ │ │
│ └────────┼─────────────────────────┼───────────────────────┼──────────┘ │
│ │ │ │ │
│ │ 10G ExpressRoute │ 10G ExpressRoute │ 10G ExpressRt│
│ │ (Tata Comm) │ (BT) │ (AT&T) │
│ │ │ │ │
│ ▼ ▼ ▼ │
│ ┌────────────────────────────────────────────────────────────────────┐ │
│ │ AZURE EXPRESSROUTE CIRCUITS │ │
│ │ ────────────────────────────────────────────────────────────────── │ │
│ │ │ │
│ │ Mumbai Circuit London Circuit NJ Circuit │ │
│ │ • 10 Gbps • 10 Gbps • 10 Gbps │ │
│ │ • Premium SKU • Premium SKU • Premium SKU │ │
│ │ • VLAN 4001 • VLAN 4002 • VLAN 4003 │ │
│ │ │ │
│ │ PEERING TYPES: │ │
│ │ ✅ Microsoft Peering (Office 365, Azure AD, Dynamics) │ │
│ │ ✅ Private Peering (Azure VMs, Azure SQL, Storage) │ │
│ │ │ │
│ └────────────────────────────────────────────────────────────────────┘ │
│ │ │ │ │
│ │ │ │ │
│ ▼ ▼ ▼ │
│ ┌────────────────────────────────────────────────────────────────────┐ │
│ │ MICROSOFT CLOUD (OFFICE 365) │ │
│ │ ────────────────────────────────────────────────────────────────── │ │
│ │ │ │
│ │ • Exchange Online (Email) 52.96.x.x/16 │ │
│ │ • Teams (Calling, Meetings) 52.112.x.x/16 │ │
│ │ • SharePoint Online 52.108.x.x/16 │ │
│ │ • OneDrive 52.104.x.x/16 │ │
│ │ • Azure AD (Authentication) 40.126.x.x/16 │ │
│ │ │ │
│ │ ROUTING: │ │
│ │ • Microsoft advertises 600+ Office 365 routes via BGP │ │
│ │ • Abhavtech advertises 10.252.0.0/16 (corporate) │ │
│ │ • Route Preference: ExpressRoute > Internet (by default) │ │
│ │ │ │
│ └────────────────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────────────┘
ExpressRoute Circuit Specifications:
| Parameter | Mumbai | London | New Jersey |
|---|---|---|---|
| Bandwidth | 10 Gbps | 10 Gbps | 10 Gbps |
| SKU | Premium | Premium | Premium |
| Carrier | Tata Communications | BT | AT&T |
| VLAN ID | 4001 | 4002 | 4003 |
| BGP ASN (Abhavtech) | 65000 | 65001 | 65002 |
| BGP ASN (Microsoft) | 12076 | 12076 | 12076 |
| IPv4 /30 Subnet (Microsoft) | 169.254.200.0/30 | 169.254.200.4/30 | 169.254.200.8/30 |
| IPv4 /30 Subnet (Private) | 169.254.201.0/30 | 169.254.201.4/30 | 169.254.201.8/30 |
BGP Configuration (SD-WAN Edge):
! Mumbai C8500-12X Configuration
! VRF for Azure ExpressRoute
vrf definition VRF-AZURE-EXPRESSROUTE
rd 65000:4
address-family ipv4
route-target export 65000:4
route-target import 65000:4
exit-address-family
!
! ExpressRoute interface (Microsoft Peering)
interface TenGigabitEthernet0/0/2.4001
description AZURE-EXPRESSROUTE-MICROSOFT-PEERING
encapsulation dot1Q 4001
vrf forwarding VRF-AZURE-EXPRESSROUTE
ip address 169.254.200.2 255.255.255.252
no shut
!
! BGP for ExpressRoute
router bgp 65000
!
address-family ipv4 vrf VRF-AZURE-EXPRESSROUTE
neighbor 169.254.200.1 remote-as 12076
neighbor 169.254.200.1 activate
neighbor 169.254.200.1 description MSFT-EXPRESSROUTE-PEER
!
! Advertise corporate network to Microsoft
network 10.252.0.0 mask 255.255.0.0
!
! Accept Office 365 routes from Microsoft
neighbor 169.254.200.1 route-map MSFT-IN in
neighbor 169.254.200.1 route-map MSFT-OUT out
exit-address-family
!
! Route-map: Accept only Office 365 prefixes
route-map MSFT-IN permit 10
match ip address prefix-list OFFICE365-PREFIXES
set local-preference 200 ! Prefer ExpressRoute over internet
!
ip prefix-list OFFICE365-PREFIXES seq 10 permit 52.96.0.0/14 le 32
ip prefix-list OFFICE365-PREFIXES seq 20 permit 52.104.0.0/14 le 32
ip prefix-list OFFICE365-PREFIXES seq 30 permit 52.112.0.0/14 le 32
ip prefix-list OFFICE365-PREFIXES seq 40 permit 40.96.0.0/12 le 32
! Route-map: Advertise only corporate IPs
route-map MSFT-OUT permit 10
match ip address prefix-list TO-MICROSOFT
!
ip prefix-list TO-MICROSOFT seq 10 permit 10.252.0.0/16
Traffic Flow (Before vs After ExpressRoute):
| Metric | Before (via Internet) | After (via ExpressRoute) |
|---|---|---|
| Latency (Mumbai → Exchange Online) | 80-120ms | 5-10ms ✅ |
| Packet Loss | 0.5-2% | <0.1% ✅ |
| Jitter | 15-30ms | <5ms ✅ |
| Bandwidth | Best effort | Guaranteed 10G ✅ |
| SLA | None | 99.95% ✅ |
| Path | Public internet (multiple ISP hops) | Direct Microsoft backbone ✅ |
Office 365 Service Mapping:
| O365 Service | Bandwidth Usage (3,200 users) | ExpressRoute Benefit |
|---|---|---|
| Exchange Online (Email) | ~500 Mbps (average) | Low latency for mailbox access |
| Teams (Audio) | ~2 Gbps (150 concurrent calls) | MOS >4.3, no jitter |
| Teams (Video) | ~5 Gbps (80 concurrent 1080p calls) | No pixelation, HD quality |
| SharePoint/OneDrive | ~1.5 Gbps (file sync) | Faster uploads/downloads |
| Azure AD (Auth) | <100 Mbps | Sub-second SSO response |
| TOTAL (Peak) | ~9 Gbps | Under 10G circuit capacity ✅ |
Azure Virtual WAN (SD-WAN Hub in Cloud)¶
Purpose: Cloud-based SD-WAN hub for branches to access Azure resources.
Architecture:
┌─────────────────────────────────────────────────────────────────────────────┐
│ AZURE VIRTUAL WAN ARCHITECTURE │
├─────────────────────────────────────────────────────────────────────────────┤
│ │
│ BRANCH SITES (Connect to Azure Virtual WAN via Internet) │
│ ┌──────────────────────────────────────────────────────────────────────┐ │
│ │ │ │
│ │ Branch 1 (Bangalore) Branch 2 (Delhi) Branch 3 (Hyderabad)│ │
│ │ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ │
│ │ │ ISR 4331 │ │ ISR 4331 │ │ ISR 1100 │ │ │
│ │ │ │ │ │ │ │ │ │
│ │ │ IPsec │ │ IPsec │ │ IPsec │ │ │
│ │ │ Tunnel │ │ Tunnel │ │ Tunnel │ │ │
│ │ └─────┬────┘ └─────┬────┘ └─────┬────┘ │ │
│ │ │ │ │ │ │
│ └────────┼─────────────────────────┼─────────────────────┼────────────┘ │
│ │ │ │ │
│ │ Internet (DIA) │ Internet (DIA) │ Internet (DIA) │
│ │ │ │ │
│ ▼ ▼ ▼ │
│ ┌────────────────────────────────────────────────────────────────────┐ │
│ │ AZURE VIRTUAL WAN HUB │ │
│ │ ────────────────────────────────────────────────────────────────── │ │
│ │ │ │
│ │ Region: Central India (Mumbai) │ │
│ │ SKU: Standard (supports BGP, VPN, ExpressRoute) │ │
│ │ Scale: 2 Gbps aggregate (auto-scales) │ │
│ │ │ │
│ │ CONNECTED VNETS: │ │
│ │ ┌─────────────────────────────────────────────────────────────┐ │ │
│ │ │ VNet 1: abhavtech-azure-prod (10.100.0.0/16) │ │ │
│ │ │ • Azure VMs: App servers, databases │ │ │
│ │ │ • Azure SQL Database │ │ │
│ │ │ • Azure Storage Accounts │ │ │
│ │ └─────────────────────────────────────────────────────────────┘ │ │
│ │ │ │
│ │ ┌─────────────────────────────────────────────────────────────┐ │ │
│ │ │ VNet 2: abhavtech-azure-shared (10.101.0.0/16) │ │ │
│ │ │ • Azure AD Connect servers │ │ │
│ │ │ • Azure Bastion (jump hosts) │ │ │
│ │ │ • Azure Firewall (central inspection) │ │ │
│ │ └─────────────────────────────────────────────────────────────┘ │ │
│ │ │ │
│ │ ROUTING: │ │
│ │ • Branches advertise: 192.168.x.0/24 (local LANs) │ │
│ │ • Azure advertises: 10.100.0.0/16, 10.101.0.0/16 (VNets) │ │
│ │ • Virtual WAN propagates routes automatically │ │
│ │ │ │
│ └────────────────────────────────────────────────────────────────────┘ │
│ │
│ ┌────────────────────────────────────────────────────────────────────┐ │
│ │ AZURE FIREWALL (CENTRAL INSPECTION) │ │
│ │ ────────────────────────────────────────────────────────────────── │ │
│ │ • All branch-to-Azure traffic inspected │ │
│ │ • Threat intelligence feed (Microsoft) │ │
│ │ • Application rules (allow HTTPS to Azure SQL) │ │
│ │ • Network rules (allow RDP to Azure VMs from admin IPs) │ │
│ └────────────────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────────────┘
Virtual WAN Hub Configuration:
| Parameter | Value |
|---|---|
| Hub Location | Central India (Mumbai) |
| Hub Address Space | 10.200.0.0/23 (auto-assigned by Azure) |
| VPN Gateway SKU | VpnGw3 (1.25 Gbps per tunnel, 10 tunnels = 12.5 Gbps aggregate) |
| BGP Support | Yes (ASN: 65515 - auto-assigned by Azure) |
| Connected Branches | 15 branches (all India sites) |
| Connected VNets | 2 VNets (prod + shared) |
| ExpressRoute Gateway | ErGw3AZ (10 Gbps, zone-redundant) |
Branch VPN Configuration (ISR 4331):
! Bangalore ISR 4331 - IPsec to Azure Virtual WAN
crypto ikev2 proposal AZURE-IKEV2-PROPOSAL
encryption aes-cbc-256
integrity sha384
group 14
!
crypto ikev2 policy AZURE-IKEV2-POLICY
proposal AZURE-IKEV2-PROPOSAL
!
crypto ikev2 keyring AZURE-KEYRING
peer azure-vwan-mumbai
address 52.172.x.x ! Azure Virtual WAN public IP
pre-shared-key <secret>
exit
!
crypto ikev2 profile AZURE-IKEV2-PROFILE
match identity remote address 52.172.x.x
identity local address 203.0.113.50 ! Branch public IP
authentication remote pre-share
authentication local pre-share
keyring local AZURE-KEYRING
!
crypto ipsec transform-set AZURE-IPSEC-TS esp-aes 256 esp-sha384-hmac
mode tunnel
!
crypto ipsec profile AZURE-IPSEC-PROFILE
set transform-set AZURE-IPSEC-TS
set ikev2-profile AZURE-IKEV2-PROFILE
!
interface Tunnel100
description IPsec to Azure Virtual WAN
ip address 10.200.1.10 255.255.255.252 ! Tunnel IP assigned by Azure
tunnel source GigabitEthernet0/0/0 ! WAN interface
tunnel mode ipsec ipv4
tunnel destination 52.172.x.x
tunnel protection ipsec profile AZURE-IPSEC-PROFILE
ip mtu 1400
ip tcp adjust-mss 1360
!
! BGP over IPsec tunnel
router bgp 65000
neighbor 10.200.1.9 remote-as 65515 ! Azure Virtual WAN BGP peer
neighbor 10.200.1.9 ebgp-multihop 2
!
address-family ipv4
neighbor 10.200.1.9 activate
network 192.168.50.0 mask 255.255.255.0 ! Advertise branch LAN
exit-address-family
!
Use Case Example:
Branch User (Bangalore) needs to access Azure SQL Database:
1. User opens application: erp.abhavtech.com
2. App queries Azure SQL: abhavtech-sql.database.windows.net (10.100.2.10)
3. SD-WAN Edge (ISR 4331) routing decision:
• Destination: 10.100.2.10 (Azure VNet)
• Route: Learned via BGP from Azure Virtual WAN
• Action: Route via Tunnel100 (IPsec to Azure)
4. Azure Virtual WAN receives packet:
• Source: 192.168.50.100 (branch user)
• Destination: 10.100.2.10 (Azure SQL)
• Action: Route to VNet 1 (prod)
5. Azure Firewall inspects:
• Rule: Allow SQL (port 1433) from 192.168.0.0/16 (all branches) to Azure SQL
• Action: ALLOW
6. Packet reaches Azure SQL Database
7. Response returns via same path
Latency: ~20ms (branch → Azure Virtual WAN → Azure SQL)
Throughput: 1.25 Gbps per tunnel (plenty for SQL queries)
Azure Private Link (Private Connectivity to Azure Services)¶
Purpose: Access Azure PaaS services (Azure SQL, Storage) over private IPs instead of public endpoints.
Before (Public Endpoints):
Branch → Internet → Azure SQL public IP (104.x.x.x) → Azure SQL
Risk: Exposed to internet, subject to DDoS, brute force
After (Private Link):
Branch → IPsec to Azure Virtual WAN → Private Endpoint (10.100.2.10) → Azure SQL
Benefit: Never exposed to internet, private connectivity
Architecture:
┌─────────────────────────────────────────────────────────────────────────────┐
│ AZURE PRIVATE LINK ARCHITECTURE │
├─────────────────────────────────────────────────────────────────────────────┤
│ │
│ ┌──────────────────────────────────────────────────────────────────────┐ │
│ │ AZURE VNET (abhavtech-azure-prod: 10.100.0.0/16) │ │
│ │ ────────────────────────────────────────────────────────────────── │ │
│ │ │ │
│ │ ┌────────────────────────────────────────────────────────────────┐ │ │
│ │ │ Subnet: private-endpoints (10.100.10.0/24) │ │ │
│ │ │ ────────────────────────────────────────────────────────────── │ │ │
│ │ │ │ │ │
│ │ │ Private Endpoint 1: │ │ │
│ │ │ ┌─────────────────────────────────────────────────────────┐ │ │ │
│ │ │ │ Name: pe-abhavtech-sql │ │ │ │
│ │ │ │ IP: 10.100.10.10 │ │ │ │
│ │ │ │ Target: abhavtech-sql.database.windows.net │ │ │ │
│ │ │ │ Public IP: DISABLED │ │ │ │
│ │ │ └─────────────────────────────────────────────────────────┘ │ │ │
│ │ │ │ │ │
│ │ │ Private Endpoint 2: │ │ │
│ │ │ ┌─────────────────────────────────────────────────────────┐ │ │ │
│ │ │ │ Name: pe-abhavtech-storage │ │ │ │
│ │ │ │ IP: 10.100.10.20 │ │ │ │
│ │ │ │ Target: abhavtechstorage.blob.core.windows.net │ │ │ │
│ │ │ │ Public IP: DISABLED │ │ │ │
│ │ │ └─────────────────────────────────────────────────────────┘ │ │ │
│ │ │ │ │ │
│ │ └─────────────────────────────────────────────────────────────┘ │ │
│ │ │ │
│ │ ┌────────────────────────────────────────────────────────────────┐ │ │
│ │ │ Subnet: application-servers (10.100.2.0/24) │ │ │
│ │ │ ────────────────────────────────────────────────────────────── │ │ │
│ │ │ │ │ │
│ │ │ App VMs can access: │ │ │
│ │ │ • Azure SQL via 10.100.10.10 (private) │ │ │
│ │ │ • Azure Storage via 10.100.10.20 (private) │ │ │
│ │ └─────────────────────────────────────────────────────────────┘ │ │
│ │ │ │
│ └──────────────────────────────────────────────────────────────────────┘ │
│ │
│ ┌──────────────────────────────────────────────────────────────────────┐ │
│ │ PRIVATE DNS ZONES (Azure-managed) │ │
│ │ ────────────────────────────────────────────────────────────────── │ │
│ │ │ │
│ │ privatelink.database.windows.net: │ │
│ │ • abhavtech-sql.database.windows.net → 10.100.10.10 │ │
│ │ │ │
│ │ privatelink.blob.core.windows.net: │ │
│ │ • abhavtechstorage.blob.core.windows.net → 10.100.10.20 │ │
│ │ │ │
│ │ (DNS zones linked to VNet, automatically updated) │ │
│ └──────────────────────────────────────────────────────────────────────┘ │
│ │
│ ┌──────────────────────────────────────────────────────────────────────┐ │
│ │ ON-PREMISE DNS RESOLUTION │ │
│ │ ────────────────────────────────────────────────────────────────── │ │
│ │ │ │
│ │ Branch user queries: abhavtech-sql.database.windows.net │ │
│ │ → On-prem DNS (10.252.1.10) forwards to Azure DNS (10.100.0.2) │ │
│ │ → Azure DNS returns: 10.100.10.10 (private endpoint IP) │ │
│ │ → User connects via Azure Virtual WAN tunnel │ │
│ │ │ │
│ └──────────────────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────────────┘
Private Link Enabled Services:
| Azure Service | Private Endpoint | Private IP | Public IP Status |
|---|---|---|---|
| Azure SQL Database | pe-abhavtech-sql | 10.100.10.10 | ❌ Disabled |
| Azure Storage (Blob) | pe-abhavtech-storage-blob | 10.100.10.20 | ❌ Disabled |
| Azure Storage (File) | pe-abhavtech-storage-file | 10.100.10.21 | ❌ Disabled |
| Azure Key Vault | pe-abhavtech-keyvault | 10.100.10.30 | ❌ Disabled |
| Azure Container Registry | pe-abhavtech-acr | 10.100.10.40 | ❌ Disabled |
Security Benefits:
| Threat | Before (Public Endpoint) | After (Private Link) |
|---|---|---|
| DDoS Attack | SQL public IP vulnerable | Private IP, no internet exposure ✅ |
| Brute Force | SQL auth exposed to internet | Only accessible from known VNets ✅ |
| Data Exfiltration | Data could be copied to external storage | Network rules prevent egress to unknown IPs ✅ |
| Compliance | Data traverses public internet (even with TLS) | Data stays on Microsoft backbone ✅ |
Azure Summary Table¶
| Component | Purpose | Integration |
|---|---|---|
| ExpressRoute (3 circuits) | Office 365 optimization | SD-WAN BGP peering |
| Azure Virtual WAN Hub | Cloud SD-WAN hub for branches | IPsec from branch ISRs |
| Azure Firewall | Central inspection for branch-to-Azure | Integrated with Virtual WAN |
| Azure Front Door | Global load balancer + WAF | Future (web apps in Azure) |
| Private Link (5 endpoints) | Private connectivity to PaaS | VNet integrated |