Azure SASE Integration¶
Business Objective¶
Why Azure?
1. Office 365 Optimization: 3,200 users on Exchange Online, Teams, SharePoint
2. Azure AD Integration: Existing identity provider for SSO
3. Global User Access: Remote workers, partners need secure access to corporate resources
4. Hybrid Cloud Strategy: Some workloads moving to Azure (future)
What is SASE?
Secure Access Service Edge = Network + Security delivered as a cloud service
Azure SASE Stack:
| Component | Purpose | Integration Point |
|---|---|---|
| Azure Virtual WAN | Cloud-based SD-WAN hub | Replaces physical hub routers for Azure-bound traffic |
| Azure Firewall | Cloud-native firewall | Complements on-premise FTD (not replacement) |
| Azure Front Door | Global load balancer + WAF | For web applications hosted in Azure |
| Azure Private Link | Private connectivity to Azure services | Access Azure SQL, Storage without public IPs |
| ExpressRoute | Dedicated circuit to Microsoft | Office 365 optimized path |
CRITICAL CLARIFICATION:
┌─────────────────────────────────────────────────────────────────────────────┐
│ AZURE SASE POSITIONING (NOT A CISCO REPLACEMENT) │
├─────────────────────────────────────────────────────────────────────────────┤
│ │
│ ❌ MISCONCEPTION: │
│ "Replace Cisco Umbrella SASE with Azure SASE" │
│ │
│ ✅ REALITY: │
│ "Add Azure SASE for Office 365 and Azure workloads" │
│ "Keep Cisco Umbrella SASE for internet/SaaS" │
│ │
│ ┌──────────────────────────────────────────────────────────────────────┐ │
│ │ TRAFFIC STEERING LOGIC: │ │
│ │ ──────────────────────────────────────────────────────────────────── │ │
│ │ │ │
│ │ Corporate Apps (10.252.x.x) → SD-WAN MPLS → On-Prem DC │ │
│ │ │ │
│ │ Office 365 (52.x.x.x) → SD-WAN → Azure ExpressRoute → │ │
│ │ Microsoft Peering │ │
│ │ │ │
│ │ Azure Workloads (10.100.x.x) → SD-WAN → Azure Virtual WAN → │ │
│ │ Azure VNet │ │
│ │ │ │
│ │ Internet / SaaS → SD-WAN → Umbrella SASE DIA → │ │
│ │ (Salesforce, YouTube, etc.) Inspection → Internet │ │
│ │ │ │
│ └──────────────────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────────────┘
Azure ExpressRoute (Office 365 Optimization)¶
Purpose: Dedicated, low-latency path to Office 365 (bypassing public internet).
Architecture:
┌─────────────────────────────────────────────────────────────────────────────┐
│ AZURE EXPRESSROUTE FOR OFFICE 365 │
├─────────────────────────────────────────────────────────────────────────────┤
│ │
│ ┌─────────────────────────────────────────────────────────────────────┐ │
│ │ ABHAVTECH ON-PREMISE (3 HUB SITES) │ │
│ │ ──────────────────────────────────────────────────────────────── │ │
│ │ │ │
│ │ Mumbai Hub London Hub NJ Hub │ │
│ │ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ │
│ │ │ SD-WAN │ │ SD-WAN │ │ SD-WAN │ │ │
│ │ │ C8500-12X│ │ C8500-12X│ │ C8500-12X│ │ │
│ │ └─────┬────┘ └─────┬────┘ └─────┬────┘ │ │
│ │ │ │ │ │ │
│ └────────┼─────────────────────────┼───────────────────────┼──────────┘ │
│ │ │ │ │
│ │ 10G ExpressRoute │ 10G ExpressRoute │ 10G ExpressRt│
│ │ (Tata Comm) │ (BT) │ (AT&T) │
│ │ │ │ │
│ ▼ ▼ ▼ │