services / Azure / Virtual network gateway

An Azure Virtual Network Gateway provides VPN (site-to-site / point-to-site) and ExpressRoute connectivity between an Azure VNet and on-premises or remote networks. It is the production network ingress/egress edge for hybrid connectivity.

A gateway is the trust boundary for a single VNet's hybrid/remote connectivity; control of it can expose or sever access to an entire private network and its hosted services.

Microsoft.​Network/​virtualNetworkGateways/​getbgppeerstatus/​action

Returns the status of BGP peers connected to the gateway, revealing the identity and reachability of peer routers in the connected on-prem/remote network. Read-only, but useful reconnaissance for planning lateral movement beyond Azure; functionally near-identical to this gateway's other BGP/routing-table-disclosure actions, which are treated the same way.

Risks

1. Network discovery (LOW)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links