Skip to content

CiriusSvcsVNET — Dependency Map

Status: Current as of 2026-04-16 Owner: Infrastructure Lifecycle: decommission (target H2 2026) Related: wrkbizap-migration-plan.md

VNet Overview

AttributeValue
NameCiriusSvcsVNET
SubscriptionFirewall (0412f98f-142d-4781-b209-070f1f160544)
Resource GroupNetworking
Address Space10.4.0.0/16
ASR ReplicaCiriusSvcsVNET-asr in Networking-asr (same sub)

Hosted Workloads

VMRoleSubscriptionRG
ACTDIRAP04Legacy AD DCFirewallAD
ACTDIRAP05Legacy AD DCFirewallAD
WRKBIZAP25Payer API serverFirewallDESKTOPSREBUILD
WRKBIZAP26Payer API serverFirewallDESKTOPSREBUILD
WRKBIZAP27Payer API serverFirewallDESKTOPSREBUILD

Traffic Flows

Inbound

FromToPurpose
Prod workers (10.20.2.0/24)ACTDIRAP04/05Legacy AD authentication — migrate to ACTDIRAP01/02 (10.10.1.0/24)
Payer external IPsWRKBIZAP25/26/27 via firewallMedicare payer API calls (App-ID enforced on Palo Alto)
Admin via Twingate (10.99.5.0/24)RD Gateway then WRKBIZAPRDP administration

Outbound

FromToPurpose
WRKBIZAP*payer external IPsAPI responses / callbacks, egress via Palo Alto
WRKBIZAP*ACTDIRAP04/05Domain auth, DNS (intra-VNet)
ACTDIRAP04/05ACTDIRAP01/02 (10.10.1.0/24)AD replication via Palo Alto NVA
ACTDIRAP04/05cirius-logging-law-centralDiagnostic settings / AMA

Peerings / UDRs

  • Peered with firewall VNet hub (vnet-fw, 10.99.0.0/16)
  • UDRs on CiriusSvcs subnets route 0.0.0.0/0 to Palo Alto NVA 10.99.2.4
  • Prod VNet UDRs include 10.4.0.0/16 with next hop = NVA

Dependent External Systems

  • Palo Alto NVA — all CiriusSvcs traffic inspected; migration requires NAT, URL, App-ID rule review before decommission
  • Medicare payer relationships — payer IPs allow-listed on Palo Alto and referenced in external BAA / network access agreements
  • DNSciriusgroup.com zones hosted on ACTDIRAP04/05 for legacy clients; migration requires DNS replication verification
  • Veeam backup — jobs target CiriusSvcs VMs; decommission must include retention decision for payer audit data (6-year WORM archive)
  • ASR replicationCiriusSvcsVNET-asr is the DR replica; decommission must disable replication before VNet deletion to avoid orphan replicas

Decommission Blockers (as of 2026-04-16)

  1. WRKBIZAP25/26/27 still serve live payer traffic — migrate first
  2. ACTDIRAP04/05 still have clients referencing them as primary DC in static config
  3. Palo Alto rules still reference 10.4.0.0/16 source zones
  4. BAA amendments may be required if payer-facing IPs change

Target State

Workloads migrated to main production VNet (vnet-prod, 10.20.0.0/16) and CiriusSvcsVNET deleted as part of the June 2026 decommission wave. See wrkbizap-migration-plan.md.

Change Log

DateChangeAuthor
2026-04-16Initial dependency mappingKobe

Internal use only — Cirius Group