Enable Virtual Machine IP Forwarding Monitoring

More Info:

Ensure that IP forwarding enabled on your Azure virtual machines (VMs) is being monitored.

Risk Level

Medium

Address

Operational Maturity, Security

Compliance Standards

• CIS AZURE
• Cloudanix Best Practice
• NIST CSF
• PCI

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration “Enable Virtual Machine IP Forwarding Monitoring” in Azure using Azure console, please follow the below steps:

1. Login to Azure Portal (https://portal.azure.com/).
2. Select the Virtual Machine for which you want to enable IP forwarding monitoring.
3. Click on the “Networking” option from the left-hand side menu.
4. Under “Networking”, click on “Network Interfaces”.
5. Select the Network Interface associated with the Virtual Machine.
6. Under “Settings”, click on “Network Security Group”.
7. Click on “Inbound security rules” and then click on the “Add” button.
8. In the “Add inbound security rule” page, provide the below details:
   • Name: Enter a name for the rule.
   • Priority: Enter a priority number for the rule.
   • Source: Select “Any” or specify the source IP address range.
   • Destination: Select “Any” or specify the destination IP address range.
   • Protocol: Select “Any” or specify the protocol type.
   • Action: Select “Allow” or “Deny”.
   • Enable logging: Select “On” to enable logging.
9. Click on the “Add” button to create the rule.
10. Repeat steps 7-9 to create an outbound security rule with the same details.
11. Once the rules are created, IP forwarding monitoring will be enabled for the Virtual Machine.

Note: Enabling IP forwarding monitoring allows the Virtual Machine to forward traffic from one network interface to another.

Using CLI

To enable Virtual Machine IP Forwarding Monitoring in AZURE using AZURE CLI, you can follow these steps:

1. Open the AZURE CLI on your local machine or use the AZURE CLI Cloud Shell.
2. Login to your AZURE account using the command: az login
3. Once you are logged in, select the subscription in which the virtual machine is present using the command: az account set --subscription <subscription_id>
4. Next, enable IP forwarding on the virtual machine using the following command: az vm update --name <vm_name> --resource-group <resource_group_name> --set networkProfile.networkInterfaceConfigurations[0].ipConfigurations[0].publicIpAddress.id=<public_ip_id> --ip-forwarding true
5. Finally, enable monitoring for IP forwarding on the virtual machine using the following command: az monitor diagnostic-settings create --resource <vm_name> --resource-group <resource_group_name> --name <diagnostic_setting_name> --logs '[{"category": "IPForwarding","enabled": true}]'

Note: Replace <vm_name>, <resource_group_name>, <public_ip_id>, and <diagnostic_setting_name> with the appropriate values for your virtual machine.

Using Python

To enable Virtual Machine IP Forwarding Monitoring in Azure using Python, you can follow these steps:

1. Import the necessary libraries:

from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.compute import ComputeManagementClient
from azure.mgmt.monitor import MonitorManagementClient
from azure.mgmt.monitor.models import DiagnosticSettingsResource, LogSettings, \
    MetricSettings, DiagnosticSettingsCategoryResource, RetentionPolicy

2. Authenticate and create a compute and monitor management client:

# Define the credentials and subscription ID
credentials = ServicePrincipalCredentials(
    client_id='<client_id>',
    secret='<client_secret>',
    tenant='<tenant_id>'
)

subscription_id = '<subscription_id>'

# Create the compute and monitor management client
compute_client = ComputeManagementClient(credentials, subscription_id)
monitor_client = MonitorManagementClient(credentials, subscription_id)

3. Get the virtual machine resource ID:

# Define the resource group and virtual machine name
resource_group_name = '<resource_group_name>'
vm_name = '<vm_name>'

# Get the virtual machine resource ID
vm = compute_client.virtual_machines.get(resource_group_name, vm_name)
vm_id = vm.id

4. Create a diagnostic settings resource:

# Define the diagnostic settings resource name
diag_settings_name = '<diag_settings_name>'

# Define the log settings
log_settings = LogSettings(enabled=True, retention_policy=RetentionPolicy(enabled=False))

# Define the metric settings
metric_settings = MetricSettings(enabled=True, retention_policy=RetentionPolicy(enabled=False))

# Define the diagnostic settings categories
categories = [
    DiagnosticSettingsCategoryResource(category_id='NetworkSecurityGroupFlowLogs', enabled=True),
    DiagnosticSettingsCategoryResource(category_id='NetworkSecurityGroupEventLogs', enabled=True),
    DiagnosticSettingsCategoryResource(category_id='AllMetrics', enabled=True)
]

# Create the diagnostic settings resource
diag_settings = DiagnosticSettingsResource(
    storage_account_id=None,
    workspace_id=None,
    event_hub_authorization_rule_id=None,
    event_hub_name=None,
    log_analytics_destination_type=None,
    metrics=metric_settings,
    logs=log_settings,
    workspace_resource_id=None,
    storage_account_subscription_id=None,
    event_hub_resource_id=None,
    workspace_resource_id_for_log_analytics=None,
    categories=categories
)

5. Enable IP forwarding monitoring:

# Add the IPForwarding property to the NetworkSecurityGroupFlowLogs category
for category in diag_settings.categories:
    if category.category_id == 'NetworkSecurityGroupFlowLogs':
        category.properties = {'IPForwarding': 'true'}

# Create or update the diagnostic settings resource
monitor_client.diagnostic_settings.create_or_update(
    resource_uri=vm_id,
    name=diag_settings_name,
    parameters=diag_settings
)

This code will enable IP forwarding monitoring for the virtual machine in Azure.

Using Terraform

resource "azurerm_policy_assignment" "vm_ip_forwarding_monitoring" {
  name                 = "vm-ip-forwarding-monitoring"
  display_name         = "Monitor Virtual Machines with IP forwarding enabled"
  description          = "Enable monitoring for Azure VMs that have IP forwarding enabled on their network interfaces."
  scope                = "/subscriptions/${SUBSCRIPTION_ID}" # replace with your subscription ID
  policy_definition_id = "/providers/Microsoft.Authorization/policyDefinitions/${IP_FORWARDING_POLICY_DEFINITION_ID}"

  # Optional: assign to a specific resource group instead of whole subscription
  # scope = "/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP_NAME}"

  # Optional: if the built‑in policy supports parameters, define them here
  # parameters = jsonencode({
  #   effect = {
  #     value = "AuditIfNotExists"  # or the effect required by your org/policy definition
  #   }
  # })
}

Substitute:

• SUBSCRIPTION_ID with your Azure subscription ID.
• IP_FORWARDING_POLICY_DEFINITION_ID with the built‑in or custom policy definition ID that audits/monitors VMs (or NICs) with IP forwarding enabled (for example, the built‑in policy from Azure Security Center/Defender for Cloud that checks VM/NIC IP forwarding).

This change does not force replacement of existing virtual machines; it only creates/updates a policy assignment at the subscription (or resource group) scope.

Verify with terraform plan:

• A new azurerm_policy_assignment.vm_ip_forwarding_monitoring resource is created (or updated) with the expected scope and policy_definition_id, and no compute resources are replaced.