Architectural Reference: License Server Outbound Connectivity
This document details the secure network architecture utilized by anDREa to facilitate outbound access from research Virtual Machines (VMs) to external, volume-licensed server infrastructures (e.g., IBM SPSS). It provides an audit-compliant blueprint mapping to ISO 27001:2023 (A.08.20 - Network Security, A.08.22 - Segregation in Networks) and NIS 2 (Supply Chain Security & Infrastructure Resilience) guidelines.
1. Architectural Problem Statement
Research projects hosted within myDRE frequently depend on third-party commercial software validated by enterprise volume-licensing services. These licensing servers are typically hosted on-premises or within private data centers outside the anDREa cloud boundary.
The Firewall Scaling Bottleneck
- The Challenge: Scale variations per Tenant range from 20 to over 1,000 active VMs. Allowing direct, fragmented inbound connections from a massive, dynamically scaling pool of public cloud IPs breaks zero-trust firewall paradigms and creates significant administrative overhead for the Tenant's on-premises firewall administrators.
- The Complexity: The issue scales compounding safely across multiple distinct Tenants, each maintaining separate license servers, non-standard port requirements, and unique vendor compliance agreements.
2. Proposed Technical Solution (Automated SNAT Mesh)
To bypass the scaling bottleneck, anDREa routes license-bound traffic through a centralized Secure Network Address Translation (SNAT) endpoint utilizing Azure Firewall paired with tenant-isolated subscription routing.
┌────────────────────────────────────────────────────────┐
│ Tenant Subscriptions (myDRE) │
│ [ VM Pool 1 ] [ VM Pool 2 ] [ VM Pool 3 ] │
└───────────────────────────┬────────────────────────────┘
│ (Isolated Route Tables)
▼
┌────────────────────────────────────────────────────────┐
│ Central Azure Firewall │
│ (Consolidated SNAT Pool) │
└───────────────────────────┬────────────────────────────┘
│ [ single static public IP ]
▼
┌────────────────────────────────────────────────────────┐
│ Tenant On-Premises Firewall │
│ (Only 1 Public IP Whitelisted) │
└───────────────────────────┬────────────────────────────┘
▼
┌────────────────────────┐
│ Central License Server │
└────────────────────────┘
Architectural Advantages
- Single IP Whitelisting: The Tenant's on-premises firewall only needs to allow inbound traffic from one static, pre-defined anDREa Public IP.
- Automated Segregation: anDREa automates the provisioning of localized Route Tables across the Tenant's Virtual Networks (VNets), isolating outbound licensing paths per subscription.
- Non-Standard Alternatives: Alternative routing topologies can be submitted via an Outside SLA Request (Non-Standard Change). anDREa reserves the right to reject alterations that degrade platform scaling, maintenance parameters, security baselines, or user experience.
Commercial Funding Isolation (Strict Segregation)
If specific commercial or industry-funded studies are legally barred from sharing or accessing corporate license keys:
- anDREa provisions and maps a separate Microsoft Azure subscription strictly tied to that explicit Workspace.
- The licensing routes are entirely omitted from this subscription's Route Tables.
- This guarantees that even if an individual user possesses valid personal or institutional credentials, the software running inside the isolated Workspace is physically blocked at the network layer from hitting the license server.
3. Deployment Requirements & Post-Onboarding Protocols
Tenant Deliverables
To activate this outbound routing path, the Tenant organization must supply and configure:
- Target Coordinates: A verified list of destination license server IP addresses and explicit communication port ranges.
- Inbound Rules: Access rules configured on the Tenant's perimeter firewall allowing traffic coming from the designated anDREa static IP (communicated during Tenant onboarding).
Service Scope: anDREa manages and secures the network transit path only. The acquisition, activation, maintenance, and legal validation of software compliance licenses remain the exclusive responsibility of the Tenant.
Post-Onboarding Documentation Protocol
Once connectivity has been provisioned and verified by the deployment engineers, configuration settings must be cataloged for audit verification:
- Log in as an agent to the myDRE Support Portal.
- Navigate to: Help Center > Tenant Name > Specifics > Specific Configurations.
- Create or update the configuration article titled:
{Tenant Name} - License Servers.