Azure backup for vms - traffic not going to our firewall

Question

Azure backup for vms - traffic not going to our firewall

Mohan Venkata Durgarao Y 40

Hi ,

We recently enabled backup for all of our azure vms. One rsv per subscription which has one vnet only. All our backup data is not going through our firewall and going through azure backbone. Is there a way to divert traffic to our firewall

Thanks

Mohan

0 comments

2 answers

Your answer

Answer 1

Hi,

It is not possible to pass the backup traffic through Azure Firewall or other firewall. "Azure VM backup: All the required communication and data transfer between storage and Azure Backup service happens within the Azure network without needing to access your virtual network. So back up of Azure VMs placed inside secured networks don't require you to allow access to any IPs or FQDNs.". The traffic does not passes through the vnet so you cannot use things like UDR (user-defined routes) to route it. Even if it was possible wouldn't be recommended as that most likely will cause throttle and latency issues.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

For Azure VM backup, the backup traffic does not go through the virtual network or Azure Firewall. The data transfer between the VM disks, storage, and the Recovery Services vault happens on the Azure backbone network.

Because of that, there isn’t a supported way to force standard Azure VM backup traffic through a firewall in the VNet.

Key points:

Azure VM backup doesn’t require allowing IPs or FQDNs in the VNet for backup traffic.
The communication and data transfer stay within Azure’s internal network.
If the goal is to inspect or control backup traffic with a firewall, that model doesn’t apply to VM-level Azure Backup.
Private endpoints are relevant for workloads such as SQL Server on Azure VM, SAP HANA on Azure VM, and MARS/on-premises servers, where secure network connectivity to the Recovery Services vault is needed.

If the requirement is specifically to send backup-related traffic through a firewall, that applies to some workload backups inside VMs, not to Azure VM backup itself.