Appearance
CiriusSvcsVNET — Dependency Map
Status: Current as of 2026-04-16 Owner: Infrastructure Lifecycle: decommission (target H2 2026) Related: wrkbizap-migration-plan.md
VNet Overview
| Attribute | Value |
|---|---|
| Name | CiriusSvcsVNET |
| Subscription | Firewall (0412f98f-142d-4781-b209-070f1f160544) |
| Resource Group | Networking |
| Address Space | 10.4.0.0/16 |
| ASR Replica | CiriusSvcsVNET-asr in Networking-asr (same sub) |
Hosted Workloads
| VM | Role | Subscription | RG |
|---|---|---|---|
| ACTDIRAP04 | Legacy AD DC | Firewall | AD |
| ACTDIRAP05 | Legacy AD DC | Firewall | AD |
| WRKBIZAP25 | Payer API server | Firewall | DESKTOPSREBUILD |
| WRKBIZAP26 | Payer API server | Firewall | DESKTOPSREBUILD |
| WRKBIZAP27 | Payer API server | Firewall | DESKTOPSREBUILD |
Traffic Flows
Inbound
| From | To | Purpose |
|---|---|---|
| Prod workers (10.20.2.0/24) | ACTDIRAP04/05 | Legacy AD authentication — migrate to ACTDIRAP01/02 (10.10.1.0/24) |
| Payer external IPs | WRKBIZAP25/26/27 via firewall | Medicare payer API calls (App-ID enforced on Palo Alto) |
| Admin via Twingate (10.99.5.0/24) | RD Gateway then WRKBIZAP | RDP administration |
Outbound
| From | To | Purpose |
|---|---|---|
| WRKBIZAP* | payer external IPs | API responses / callbacks, egress via Palo Alto |
| WRKBIZAP* | ACTDIRAP04/05 | Domain auth, DNS (intra-VNet) |
| ACTDIRAP04/05 | ACTDIRAP01/02 (10.10.1.0/24) | AD replication via Palo Alto NVA |
| ACTDIRAP04/05 | cirius-logging-law-central | Diagnostic settings / AMA |
Peerings / UDRs
- Peered with firewall VNet hub (
vnet-fw, 10.99.0.0/16) - UDRs on CiriusSvcs subnets route 0.0.0.0/0 to Palo Alto NVA
10.99.2.4 - Prod VNet UDRs include
10.4.0.0/16with next hop = NVA
Dependent External Systems
- Palo Alto NVA — all CiriusSvcs traffic inspected; migration requires NAT, URL, App-ID rule review before decommission
- Medicare payer relationships — payer IPs allow-listed on Palo Alto and referenced in external BAA / network access agreements
- DNS —
ciriusgroup.comzones hosted on ACTDIRAP04/05 for legacy clients; migration requires DNS replication verification - Veeam backup — jobs target CiriusSvcs VMs; decommission must include retention decision for payer audit data (6-year WORM archive)
- ASR replication —
CiriusSvcsVNET-asris the DR replica; decommission must disable replication before VNet deletion to avoid orphan replicas
Decommission Blockers (as of 2026-04-16)
- WRKBIZAP25/26/27 still serve live payer traffic — migrate first
- ACTDIRAP04/05 still have clients referencing them as primary DC in static config
- Palo Alto rules still reference 10.4.0.0/16 source zones
- BAA amendments may be required if payer-facing IPs change
Target State
Workloads migrated to main production VNet (vnet-prod, 10.20.0.0/16) and CiriusSvcsVNET deleted as part of the June 2026 decommission wave. See wrkbizap-migration-plan.md.
Change Log
| Date | Change | Author |
|---|---|---|
| 2026-04-16 | Initial dependency mapping | Kobe |