Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Azure virtual network TAP (Terminal Access Point) allows you to continuously stream your virtual machine network traffic to a network packet collector or analytics tool. The collector or analytics tool is provided by a network virtual appliance partner. For a list of partner solutions that are validated to work with virtual network TAP, see partner solutions.
Important
Virtual network TAP is now in public preview in select Azure regions. For more information, see the Supported Region section in this article.
The following diagram shows how virtual network TAP works. You can add a TAP configuration on a network interface that is attached to a virtual machine deployed in your virtual network. The destination is a virtual network IP address in the same virtual network as the monitored network interface or a peered virtual network. The collector solution for virtual network TAP can be deployed behind an Azure Internal Load balancer for high availability.
Prerequisites
Before you can create a virtual network TAP, ensure you've received the confirmation email that you're enrolled in the preview. You must have one or more virtual machines created with Azure Resource Manager, and a partner solution for aggregating the TAP traffic in the same Azure region. If you don't have a partner solution in your virtual network, see partner solutions to deploy one.
You can use the same virtual network TAP resource to aggregate traffic from multiple network interfaces in the same or different subscriptions. If the monitored network interfaces are in different subscriptions, the subscriptions must be associated to the same Microsoft Entra tenant. Additionally, the monitored network interfaces, and the destination endpoint for aggregating the TAP traffic can be in peered virtual networks in the same region. If you're using this deployment model, ensure that the virtual network peering is enabled before you configure virtual network TAP.
Permissions
The accounts you use to apply TAP configuration on network interfaces must be assigned to the network contributor role or a custom role that is assigned the necessary actions from the following table:
| Action | Name |
|---|---|
| Microsoft.Network/virtualNetworkTaps/* | Required to create, update, read, and delete a virtual network TAP resource |
| Microsoft.Network/networkInterfaces/read | Required to read the network interface resource on which the TAP is configured |
| Microsoft.Network/tapConfigurations/* | Required to create, update, read, and delete the TAP configuration on a network interface |
Public preview limitations
Following are limitations during our preview.
- Virtual network TAP only supports virtual machine's (VM) network interface as a mirroring source.
- Virtual network TAP supports Load Balancer or VM's network interface as a destination resource for mirrored traffic.
- Virtual network doesn't support Live Migration. VM set as source for virtual network TAP will have live migration disabled.
- VMs behind a Standard Load Balancer with Floating IP enabled can't be set as a mirroring source.
- VMs behind Basic Load Balancer can't be set as a mirroring source.
- Virtual network doesn't support mirroring of inbound Private Link Service traffic.
- VMs in a virtual network with encryption enabled can't be set as mirroring source.
- Virtual network TAP doesn't support IPv6.
- When a VM is added or removed as a source, the VM might experience network downtime (up to 60 seconds).
Supported Regions
- Asia East
- US West Central
Coming soon
- UK South (May 5)
- US East (May 15)
Virtual network TAP partner solutions
Network packet brokers
| Partner | Product |
|---|---|
| Gigamon | GigaVUE Cloud Suite for Azure |
| cPacket | cPacket Cloud Suite |
| Keysight | CloudLens |
Security analytics, network/application performance management
| Partner | Product |
|---|---|
| Darktrace | Darktrace /NETWORK |
| Netscout | Omnis Cyber Intelligence NDR |
| Corelight | Corelight Open NDR Platform |
| Vectra | Vectra NDR |
| Fortinet | FortiNDR Cloud |
| FortiGate VM | |
| TrendMicro | Trend Vision One™ Network Security |
| Extrahop | Reveal(x) |
| Bitdefender | GravityZone Extended Detection and Response for Network |
| eSentire | eSentire MDR |
| LinkShadow | LinkShadow NDR |
| AttackFence | AttackFence NDR |
| Arista Networks | Arista NDR |
Next Steps
Learn how to Create a virtual network TAP using CLI or the Azure portal.