|
| 1 | +--- |
| 2 | +title: Azure Payment HSM traffic inspection |
| 3 | +description: Azure Payment HSM traffic inspection |
| 4 | +services: payment-hsm |
| 5 | +ms.service: payment-hsm |
| 6 | +author: msmbaldwin |
| 7 | +ms.author: mbaldwin |
| 8 | +ms.topic: quickstart |
| 9 | +ms.date: 04/06/2023 |
| 10 | +--- |
| 11 | + |
| 12 | +# Azure Payment HSM traffic inspection |
| 13 | + |
| 14 | +Azure Payment Hardware Security Module (Payment HSM or PHSM) is a [bare-metal service](overview.md) providing cryptographic key operations for real-time and critical payment transactions in the Azure cloud. For more information, see [What is Azure Payment HSM?](overview.md). |
| 15 | + |
| 16 | +When Payment HSM is deployed, it comes with a host network interface and a management network interface. There are several deployment scenarios: |
| 17 | + |
| 18 | +1. [With host and management ports in same VNet](create-payment-hsm.md?tabs=azure-cli) |
| 19 | +2. [With host and management ports in different VNets](create-different-vnet.md?tabs=azure-cli) |
| 20 | +3. [With host and management port with IP addresses in different VNets](create-different-ip-addresses.md?tabs=azure-cli) |
| 21 | + |
| 22 | +In all of the above scenarios, Payment HSM is a VNet-injected service in a delegated subnet: `hsmSubnet` and `managementHsmSubnet` must be delegated to `Microsoft.HardwareSecurityModules/dedicatedHSMs` service. |
| 23 | + |
| 24 | +Payment HSM comes with some policy [restrictions](solution-design.md#constraints) on these subnets: **Network Security Groups (NSGs) and User-Defined Routes (UDRs) are currently not supported**. |
| 25 | + |
| 26 | +> [!IMPORTANT] |
| 27 | +> The `FastPathEnabled` **feature** must be [registered and approved](register-payment-hsm-resource-providers.md?tabs=azure-cli#register-the-resource-providers-and-features) on all subscriptions that need access to Payment HSM. For more information, see [FastPathEnabled](fastpathenabled.md). |
| 28 | +
|
| 29 | +PHSM is not compatible with vWAN topologies or cross region VNet peering, as listed in the [topology supported](solution-design.md#supported-topologies). |
| 30 | + |
| 31 | +This article present two ways to inspect traffic destined to a Payment HSM: a firewall with source network address translation (SNAT), and a firewall with reverse proxy |
| 32 | + |
| 33 | +## Firewall with source network address translation (SNAT) |
| 34 | + |
| 35 | +This design is inspired by the [Dedicated HSM solution architecture](networking.md#solution-architecture). |
| 36 | + |
| 37 | +The firewall **SNATs the client IP address** before forwarding traffic to the PHSM NIC, guaranteeing that the return traffic will automatically be directed back to the Firewall. Either an Azure Firewall or a 3rd party FW NVA can be used in this design. |
| 38 | + |
| 39 | + |
| 40 | + |
| 41 | +:::image type="content" source="./media/firewall-snat-architecture-diagram.png" alt-text="Architecture diagram of the firewall with SNAT"::: |
| 42 | + |
| 43 | +Route tables required: |
| 44 | +- On-Prem to PHSM: a Route Table containing a UDR for the Payment HSM VNet range and pointing to the central hub Firewall is applied to the GatewaySubnet. |
| 45 | +- Spoke VNet(s) to PHSM: a Route Table containing the usual default route pointing to the central hub Firewall is applied to the Spoke VNet(s) subnets. |
| 46 | + |
| 47 | +Results: |
| 48 | +- UDRs not being supported on the PHSM subnet is addressed by the Firewall doing SNAT on the client IP: when forwarding traffic to PHSM, the return traffic will automatically be directed back to the Firewall. |
| 49 | +- Filtering rules that cannot be enforced using NSGs on the PHSM subnet can be configured on the Firewall. |
| 50 | +- Both Spoke traffic and On-Prem traffic to the PHSM environment are secured. |
| 51 | + |
| 52 | +## Firewall with reverse proxy |
| 53 | + |
| 54 | +This design is a good option when performing SNAT on the Firewall is not approved by network security teams, requiring instead to keep the source and destination IPs unchanged for traffic crossing the Firewall. |
| 55 | + |
| 56 | +This architecture leverages a reverse proxy, deployed in a dedicated subnet in the PHSM VNet directly or in a peered VNet. Instead of sending traffic to the PHSM devices, the destination is set to the reverse proxy IP, located in a subnet that does not have the restrictions of the PHSM delegated subnet: both NSGs and UDRs can be configured, and combined with a Firewall in the central hub. |
| 57 | + |
| 58 | +:::image type="content" source="./media/firewall-reverse-proxy-architecture-diagram.png" alt-text="Architecture diagram of the firewall with reverse proxy"::: |
| 59 | + |
| 60 | +This solution requires a reverse proxy, such as: |
| 61 | + |
| 62 | +- F5 (Azure Marketplace ; VM-based) |
| 63 | +- NGINXaaS (Azure Marketplace ; PaaS fully managed) |
| 64 | +- Reverse proxy Server using NGINX (VM-based) |
| 65 | +- Reverse proxy Server using HAProxy (VM-based) |
| 66 | + |
| 67 | +Example of reverse proxy Server using NGINX (VM-based) configuration: |
| 68 | + |
| 69 | +```conf |
| 70 | +# Nginx.conf |
| 71 | +stream { |
| 72 | + server { |
| 73 | + listen 1500; |
| 74 | + proxy_pass 10.221.8.4:1500; |
| 75 | + } |
| 76 | +
|
| 77 | + upstream phsm { |
| 78 | + server 10.221.8.5:443; |
| 79 | + } |
| 80 | +
|
| 81 | + server { |
| 82 | + listen 443; |
| 83 | + proxy_pass phsm; |
| 84 | + proxy_next_upstream on; |
| 85 | + } |
| 86 | +} |
| 87 | +``` |
| 88 | + |
| 89 | +Route tables required: |
| 90 | +- On-Prem to PHSM: a Route Table containing a UDR for the Payment HSM VNet range and pointing to the central hub Firewall is applied to the GatewaySubnet. |
| 91 | +- Spoke VNet(s) to PHSM: a Route Table containing the usual default route pointing to the central hub Firewall is applied to the Spoke VNet(s) subnets. |
| 92 | + |
| 93 | +> [!IMPORTANT] |
| 94 | +> Gateway Route propagation must be disabled on the reverse proxy subnet, so that a 0/0 UDR is enough to force the return traffic via the firewall. |
| 95 | +
|
| 96 | +Results: |
| 97 | +- UDRs not being supported on the PHSM subnet can be configured on the reverse proxy subnet. |
| 98 | +- The reverse proxy SNATs the client IP: when forwarding traffic to PHSM, the return traffic will automatically be directed back to the reverse proxy. |
| 99 | +- Filtering rules that cannot be enforced using NSGs on the PHSM subnet can be configured on the Firewall and/or on NSGs applied to the reverse proxy subnet. |
| 100 | +- Both Spoke traffic and On-Prem traffic to the PHSM environment are secured. |
| 101 | + |
| 102 | +## Next steps |
| 103 | + |
| 104 | +- [What is Azure Payment HSM?](overview.md) |
| 105 | +- [Azure Payment HSM solution design](solution-design.md) |
| 106 | +- [Azure Payment HSM deployment scenarios](deployment-scenarios.md) |
| 107 | +- [Get started with Azure Payment HSM](getting-started.md) |
| 108 | +- [Create a payment HSM](create-payment-hsm.md) |
| 109 | +- [Frequently asked questions](faq.yml) |
0 commit comments