Appearance
East-West Communication Map — Production Spoke
Status: Current as of 2026-04-16 Owner: Infrastructure Related: azure-network-topology.md, nseg-proposed-rules.md
This document captures the required east-west (spoke-to-spoke and intra-spoke) communication paths for the production environment. The purpose is to make explicit which traffic must be permitted across subnet boundaries so NSG and UDR rules can be tightened without breaking production workloads.
East-west enforcement happens at two layers:
- UDR route tables — all inter-spoke traffic is forced through the Palo Alto NVA at
10.99.2.4for stateful inspection. - NSG rules — subnet-level allow/deny rules supplement UDR enforcement.
Production Spoke CIDRs
| Spoke / Subnet | CIDR | Purpose |
|---|---|---|
| Production VNet (vnet-prod) | 10.20.0.0/16 | Production workloads |
| - servers-subnet | 10.20.1.0/24 | Tier-1 application servers |
| - workers-subnet | 10.20.2.0/24 | Worker / compute nodes |
| Identity VNet | 10.10.0.0/16 | AD domain controllers |
| - ad-subnet | 10.10.1.0/24 | ACTDIRAP01, ACTDIRAP02, RODC |
| Dashboard VNet | 10.5.0.0/16 | Dashboard, reporting |
| Legacy Svcs (CiriusSvcsVNET) | 10.4.0.0/16 | ACTDIRAP04/05, WRKBIZAP payer traffic |
| Dev VNet | 10.30.0.0/16 | Non-prod |
| Firewall VNet hub | 10.99.0.0/16 | Palo Alto NVA, Twingate |
Required East-West Flows (MUST be allowed)
Production to Identity (authentication, directory)
| Source | Destination | Protocol / Port | Purpose |
|---|---|---|---|
| 10.20.0.0/16 | 10.10.1.0/24 | TCP/UDP 88 | Kerberos |
| 10.20.0.0/16 | 10.10.1.0/24 | TCP/UDP 389 | LDAP |
| 10.20.0.0/16 | 10.10.1.0/24 | TCP 636 | LDAPS |
| 10.20.0.0/16 | 10.10.1.0/24 | TCP 3268, 3269 | Global Catalog |
| 10.20.0.0/16 | 10.10.1.0/24 | TCP/UDP 53 | DNS (AD-integrated) |
| 10.20.0.0/16 | 10.10.1.0/24 | TCP/UDP 464 | Kerberos password |
| 10.20.0.0/16 | 10.10.1.0/24 | TCP 445 | SMB (SYSVOL, GPO) |
| 10.20.0.0/16 | 10.10.1.0/24 | TCP 135, 49152-65535 | RPC / AD replication |
| 10.10.1.0/24 | 10.20.0.0/16 | TCP/UDP 88, 389, 636, 53 | Return authentication traffic |
Production servers to Production workers (application traffic)
| Source | Destination | Protocol / Port | Purpose |
|---|---|---|---|
| 10.20.1.0/24 (servers) | 10.20.2.0/24 (workers) | TCP defined app ports | App-to-worker task dispatch |
| 10.20.2.0/24 (workers) | 10.20.1.0/24 (servers) | TCP defined app ports | Worker-to-app result return |
Application ports are workload-specific and documented in the Palo Alto App-ID mappings. NSGs allow the broader subnet-to-subnet flow; Palo Alto enforces App-ID on inter-subnet traffic that routes through the NVA.
Workers to RD Gateway (administrative access)
| Source | Destination | Protocol / Port | Purpose |
|---|---|---|---|
| 10.20.2.0/24 (workers) | CGIRDPAZP01 (10.20.2.10/32) | TCP 3389 | RDP via RD Gateway only |
| 10.99.5.0/24 (Twingate) | CGIRDPAZP01 (10.20.2.10/32) | TCP 443 | HTTPS to RD Gateway Web |
Direct RDP from workstation to worker VM is blocked by Deny-RDP-From-Servers and Deny-RDP-From-Workers NSG rules.
Veeam to all VMs (backup)
| Source | Destination | Protocol / Port | Purpose |
|---|---|---|---|
| Veeam VM | all prod VMs | TCP 135, 445, 6162, 2500-3300 | Veeam backup proxy + VSS |
| Veeam VM | all prod VMs | TCP 10000-10100 | Data transfer |
Legacy Svcs (CiriusSvcsVNET 10.4.0.0/16)
| Source | Destination | Protocol / Port | Purpose |
|---|---|---|---|
| 10.4.0.0/16 (WRKBIZAP) | payer external IPs | TCP 443 | Medicare payer API |
| Prod workers | 10.4.0.0/16 (ACTDIRAP04/05) | TCP 88, 389, 636 | Legacy AD queries |
Target state H2 2026: migrate WRKBIZAP off CiriusSvcsVNET, decommission this VNet. See wrkbizap-migration-plan.md.
Blocked East-West (MUST be denied)
These flows are explicitly denied by NSG rules on both nsg-servers and nsg-workers to prevent lateral movement:
| Source | Destination | Protocol / Port | NSG Rule |
|---|---|---|---|
| 10.20.2.0/24 (workers) | 10.20.1.0/24 (servers) | TCP 3389 | servers_deny_rdp_from_workers (Deny, pri 3000) |
| 10.20.2.0/24 (workers) | 10.20.1.0/24 (servers) | TCP 5985, 5986 | servers_deny_winrm_from_workers (Deny, pri 3010) |
| 10.20.2.0/24 (workers) | 10.20.1.0/24 (servers) | TCP 135 | servers_deny_wmi_from_workers (Deny, pri 3020) |
| 10.20.1.0/24 (servers) | 10.20.2.0/24 (workers) | TCP 3389 | workers_deny_rdp_from_servers (Deny, pri 3000) |
| 10.20.1.0/24 (servers) | 10.20.2.0/24 (workers) | TCP 5985, 5986 | workers_deny_winrm_from_servers (Deny, pri 3010) |
| 10.20.1.0/24 (servers) | 10.20.2.0/24 (workers) | TCP 135 | workers_deny_wmi_from_servers (Deny, pri 3020) |
Rationale: workers have no legitimate reason to RDP / WinRM / WMI into servers (and vice versa). These are the primary hands-on-keyboard lateral movement protocols. Administrative access comes through RD Gateway only.
Out-of-Scope (Cross-Spoke)
Non-production spokes (Dev, Legacy Svcs) MUST route through Palo Alto NVA even for intra-VNet peered traffic. UDRs at the subnet level send all non-local spoke CIDRs to next_hop = 10.99.2.4. See azure-network-topology.md section East-West Enforcement.
Change Log
| Date | Change | Author |
|---|---|---|
| 2026-04-16 | Initial east-west communication map | Kobe |