Appearance
Network Topology — Authoritative Reference
Scope: address plan, VNets/VPCs, subnets, peering, firewall placement — both clouds. Routing detail (UDR design, next-hop rationale, asymmetric-routing rules) lives in UDR Routing Design — one source per fact; this doc does not duplicate route tables. Provenance: rebased from
azure-infraandaws-infraTerraform on 2026-06-10 (review issue #138). Every table cites its source file. If this doc and Terraform disagree, Terraform wins — fix the doc.
Generated diagram
<!-- topology:start -->
Auto-generated from
azure-infraTerraform byscripts/gen-topology.ts(DOCS-161). Diagram source:architecture/network-topology.mmd; rendered image:public/network-topology.svg(re-render after topology changes). Hub firewalls are hexagons.
VNets: 16 · peerings: 13
<!-- topology:end -->
Azure Address Plan
| VNet | CIDR | Subscription | Status | Source |
|---|---|---|---|---|
| vnet-firewall (PublicFW hub) | 10.99.0.0/16 | Firewall | Live | firewall/net_vnet.tf |
| vnet-privatefw (PrivateFW hub) | 10.98.0.0/16 | Firewall | Live | firewall/net_privatefw.tf |
| vnet-identity | 10.10.0.0/16 | Identity | Live | identity/net_vnet.tf |
| vnet-rodc | 10.11.0.0/16 | Identity | Live | identity/net_rodc.tf |
| vnet-prod | 10.20.0.0/16 | Production | Live | prod/net_vnet.tf |
| vnet-dev | 10.30.0.0/16 | Development | Live | dev/net_vnet.tf |
| vnet-dmz | 10.6.0.0/16 | Dashboard | Live | dmz/net_vnet.tf |
| vnet-logging | 10.40.0.0/16 | Logging | Live | logging/net_vnet_logging.tf |
| CiriusSvcsVNET | 10.4.0.0/16 | Firewall | Decommission-bound — blocked on PA LDAP/RADIUS migration off legacy DCs; see CiriusSvcs VNet Dependencies | firewall/decommission-cirius-svcs-vnet.tf |
| vnet-dashboard | 10.5.0.0/16 | — | Decommissioned — not in code (historical references only) | identity/net_vnet.tf:77 comment |
Subnets (live VNets)
| VNet | Subnet | CIDR | Notes | Source |
|---|---|---|---|---|
| vnet-firewall | mgmt-subnet | 10.99.0.0/24 | PA/Panorama mgmt | firewall/net_vnet.tf |
| vnet-firewall | public-subnet | 10.99.1.0/24 | PA untrust | firewall/net_vnet.tf |
| vnet-firewall | private-subnet | 10.99.2.0/24 | PA trust; syslog VM, AW VLC | firewall/net_vnet.tf |
| vnet-firewall | snet-cae-syslog | 10.99.3.0/27 | Container Apps delegated | firewall/net_vnet.tf |
| vnet-firewall | snet-private-endpoints | 10.99.4.0/24 | AMPLS private endpoints | firewall/net_ampls_pe.tf |
| vnet-firewall | twingate-subnet | 10.99.5.0/24 | ACI delegated | firewall/net_vnet.tf |
| vnet-firewall | backup-aci-subnet | 10.99.6.0/24 | ACI delegated | firewall/net_vnet.tf |
| vnet-privatefw | mgmt / untrust / trust | 10.98.0.0/24 / 10.98.1.0/24 / 10.98.2.0/24 | PrivateFW interfaces | firewall/net_privatefw.tf |
| vnet-identity | ad-subnet | 10.10.1.0/24 | DCs + NPS | identity/net_vnet.tf |
| vnet-rodc | rodc-subnet | 10.11.0.0/24 | RODC only | identity/net_rodc.tf |
| vnet-prod | servers / workers | 10.20.1.0/24 / 10.20.2.0/24 | PHI workloads | prod/net_vnet.tf |
| vnet-dev | servers / workers | 10.30.1.0/24 / 10.30.2.0/24 | dev/net_vnet.tf | |
| vnet-dmz | dmz-servers-subnet | 10.6.1.0/24 | dmz/net_vnet.tf | |
| vnet-logging | snet-cae-agents | 10.40.1.0/27 | Container Apps delegated | logging/net_vnet_logging.tf |
Azure Peering (live)
Hub-and-spoke around the two firewalls. All direct spoke↔spoke peerings were deliberately removed — their /16 system routes bypassed the Palo Altos (removal notes live as comments in each VNet's Terraform).
| Hub | Peered spokes | Source |
|---|---|---|
| vnet-firewall (PublicFW) | vnet-privatefw, vnet-dmz, vnet-rodc, vnet-logging | firewall/net_vnet.tf, firewall/net_ampls_pe.tf |
| vnet-privatefw (PrivateFW) | vnet-prod, vnet-identity, vnet-dev, CiriusSvcsVNET (decommission-bound) | firewall/net_privatefw.tf |
Spoke assignment rule: internal workload spokes (prod, identity, dev, legacy svcs) hang off PrivateFW; edge/special spokes (DMZ, RODC, logging PEs, Twingate) hang off PublicFW. The RODC explicitly does not peer with PrivateFW (
identity/net_rodc.tf). Default routes and per-spoke UDRs: see UDR Routing Design.
Azure Firewalls
| NVA | VM | Mgmt | Untrust | Trust | Notes | Source |
|---|---|---|---|---|---|---|
| PublicFW | CIRIUS-SVCS-FW | 10.99.0.4 | 10.99.1.4 (+public IP) | 10.99.2.4 | VM-Series BYOL, D3_v2 | firewall/net_firewall.tf |
| PrivateFW | CIRIUS-PVT-FW | 10.98.0.4 | 10.98.1.4 | 10.98.2.4 | VM-Series BYOL; license borrow from AWS DR PA pending (VPNLYR-032) | firewall/net_privatefw.tf |
| Panorama | CIRIUS-SVCS-PANORAMA | 10.99.0.5 (+public IP) | — | — | 12.1.2, 100GB log disk, delete lock | firewall/net_panorama.tf |
GlobalProtect
| Fact | Value | Source |
|---|---|---|
| Portal/gateway | pvt.ciriusgroup.com:7000 (loopback 10.10.10.1) | panos-infra/net_panos_gp.tf |
| Auth | OneLogin SAML; split tunnel 10.0.0.0/8; DNS 10.10.1.10/.11 | panos-infra/net_panos_gp.tf |
| Client pool | ⚠️ Conflicting sources: PAN-OS Terraform says 10.97.0.0/24; NSGs across the estate treat 10.96.101.0/24 as the live VPN range. Likely the running legacy pool is 10.96.101.0/24 and 10.97.0.0/24 is the gated rebuild. | panos-infra/net_panos_gp.tf:54 vs firewall/net_privatefw.tf:60-85 |
| Phase 2 state | Control plane gated off (gp_phase2_enabled = false) — blocked on wildcard cert + OneLogin SAML profile import to Panorama | panos-infra/net_panos_gp.tf:21-31 |
Identity Hosts & DNS
| Host | IP | Role | Status | Source |
|---|---|---|---|---|
| ACTDIRAZP01 / ACTDIRAZP02 | 10.10.1.10 / 10.10.1.11 | Writable DCs (WS2022) | Live | identity/svr_ad.tf, identity/svr_ad2.tf |
| ACTIDMAZP01 | 10.10.1.12 | NPS + MFA ext + Entra Connect | Live | identity/svr_actidmazp01.tf |
| ACTRODC01 | 10.11.0.10 | RODC — sole DC for DMZ | Live | identity/svr_rodc.tf |
| ACTDIRAP01 / ACTDIRAP02 | 10.4.4.4 / 10.4.4.5 | Legacy DCs (PA LDAP/RADIUS still bound) | Decommission-blocked | firewall/decommission-cirius-svcs-vnet.tf |
| ACTDIRAP04 / ACTDIRAP05 | dynamic | Legacy DCs | June 2026 decommission | firewall/decommission-ad_e182ebbc.tf |
| actdirawp01 / actdirawp02 (AWS) | 10.40.1.10 / 10.40.2.10 | DR DCs — dr.ciriusgroup.internal | Live | aws-infra/identity/svr_ad.tf |
DNS per VNet: identity / prod / dev / privatefw / rodc → 10.10.1.10–.11; firewall + dmz → 10.11.0.10 (RODC); CiriusSvcsVNET → legacy 10.4.4.4–.5. Source: each VNet's dns_servers block.
AWS Address Plan (DR — 7-account org)
| VPC | CIDR | Account | TGW | Status | Source |
|---|---|---|---|---|---|
| vpc-firewall | 10.99.0.0/16 (mgmt .0/24, public .1/24, private .2/24, tgw-attach .30.0/28 + .30.16/28) | Networking 238342914131 | Yes (appliance mode) | Live | firewall/net_vpc.tf, firewall/net_tgw.tf |
| identity-vpc | 10.40.0.0/16 (10.40.1.0/24 2a, 10.40.2.0/24 2b) | Identity 414134953818 | Yes | Live | identity/net_vpc_module.tf |
| prod-vpc | 10.50.0.0/16 (10.50.1.0/24, 10.50.2.0/24) | Prod 807267566999 | Yes | Live | prod/net_vpc_module.tf |
| dev-vpc | 10.60.0.0/16 | Dev 040067931468 | — | Retired (.rm files; TGW attachment commented out pending rebuild) | dev/net_vpc_module.rm |
| Management-VPC | 10.10.0.0/16 (10.10.1.0/24, IGW-routed) | Management 206820231356 | No — deliberately unattached | Live | main/management_vpc.tf |
| Logging / Backup accounts | no VPCs | 038901680748 / 863609217450 | — | — | grep aws-infra/logging, aws-infra/backup |
Transit Gateway design
central-tgw (default association/propagation off, RAM-shared to identity/prod/dev accounts). Two route tables: tgw-rt-eastwest (firewall attachment associated; fw/identity/prod propagate) and tgw-rt-egress (spoke attachments associated; static 0.0.0.0/0 + spoke CIDRs → firewall VPC attachment). Net effect: all inter-spoke and internet traffic from spokes hairpins through the Palo Alto in the firewall VPC. Source: firewall/net_tgw.tf.
AWS hosts (firewall account)
| Host | IP | OS / image | Source |
|---|---|---|---|
| CIRIUS-AWS-FW | 10.99.0.4 mgmt (+EIP) / 10.99.1.4 public (+EIP) / 10.99.2.4 private | PAN-OS m5.xlarge | firewall/net_firewall.tf |
| CIRIUS-AWS-PANO | 10.99.0.5 (+EIP) | Panorama t3.xlarge, 100GB log disk | firewall/net_panorama.tf |
| syslogawp | 10.99.2.5 | Ubuntu 24.04 t3.small | firewall/net_rsyslog.tf |
Cross-cloud overlap note: AWS Management-VPC (10.10.0.0/16) overlaps Azure vnet-identity, and AWS vpc-firewall (10.99.0.0/16) mirrors Azure vnet-firewall. The clouds are separate routing domains with no cross-cloud routes in code — tolerated by design, but it rules out ever routing those prefixes between clouds.
Known Infrastructure Inconsistencies (found during the 2026-06-10 rebase)
These are Terraform-side issues surfaced while rebasing this doc — tracked as azure-infra / aws-infra issues, listed here so readers don't "correct" the doc back to the broken state:
prodrouteto-dev-spoke(10.30.0.0/16) points at 10.99.2.4 while identity's equivalent and dev's default use 10.98.2.4 — violates the asymmetric-routing rule in UDR Routing Design. (prod/net_vnet.tf:84-93)prodstill carriesto-dashboard-spoke10.5.0.0/16 → 10.99.2.4 although that VNet is decommissioned. (prod/net_vnet.tf:97-106)- AWS: identity spoke routes and the firewall TGW return table still reference retired 10.60.0.0/16 (dev) — blackhole at the TGW. (
identity/net_vpc_module.tf:27,firewall/net_vpc.tf:74-80) - GP client pool defined as 10.97.0.0/24 in PAN-OS TF but 10.96.101.0/24 in NSGs (see GlobalProtect above).
- Stale comment in
firewall/net_vnet.tf:118-119claims prod/identity return routes were removed; the routes are live (the comment, not the code, is wrong).