Contacts: Daniel Evans, CK Kashyap, Mark Franco
Host a bot behind a firewall and allow conversations with the bot using Teams. The implication of “bot behind a firewall” is that the network connectivity to/from the bot is restricted to only the necessary machines (IP addresses).
The reference network architecture below illustrates how a Bot may be run inside a Virtual Network(VNET) that allows traffic only to and from a set of IP addresses that belong to Microsoft Teams and Azure Bot Service(ABS). The egress traffic restrictions are set by the networking rules in the firewall and the ingress traffic restrictions are set using the Network Security Group (NSG) rules of the App GW.
Instructions to setup the ASE such that the egress traffic is routed through the firewall is here. Set the firewall to restrict traffic only to Teams and ABS by adding the following rules in a Network Rule Collection (Rules -> Network Rule Collection)
- IP Address rule – allow traffic from the subnet of the ASE to 220.127.116.11/14
- FQDN rule – allow traffic from the subnet of the ASE to login.microsoftonline.com
- FQDN rule – allow traffic from the subnet of the ASE to login.botframework.com
Restrict the ingress traffic to Teams by adding an inbound security rule to the NSG associated with the subnet of the App Gateway. As shown in the snapshot below, the inbound traffic from only 18.104.22.168/14 to the subnet of the ASE is allowed.