Azure Compliance ControlsAzure Virtual Network
Virtual machine network interfaces should have IP forwarding disabled
Enabling IP forwarding on a virtual machine's NIC allows the machine to receive traffic addressed to other destinations. IP forwarding is rarely required (e.g., when using the VM as a network virtual appliance). This should be reviewed by the network security team.
What this control checks
Network interfaces must have IP forwarding disabled (enable_ip_forwarding set to false).
Framework mappings
The clauses this control is mapped to in each framework.
- Information Flow Enforcement (AC-4)
- SC-5 Denial-of-service Protection
- SC-7: Boundary Protection
- SC-7(3) Access Points
FedRAMP Moderate Baseline Rev 4
- AC-4 Information Flow Enforcement
- SC-5 Denial Of Service Protection
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 3.1.3 Control the flow of CUI in accordance with approved authorizations
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- 1.1 IT Governance
- 5 Policy for Information System Audit (IS Audit)
- AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
- SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
- SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- AC-4 Information Flow Enforcement
- SC-5 Denial Of Service Protection
- SC-7 Boundary Protection
- SC-7(3) Access Points
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_interface_ip_forwarding_disabled - Checkov Check:
CKV_AZURE_118 - Powerpipe Control:
azure_compliance.control.network_interface_ip_forwarding_disabled - Azure Policy Definitions:
88c0b9da-ce96-4b03-9635-f29a937e2900,bd352bd5-2853-4985-bf0d-73806b4a5744 - KICS Query:
4216ebac-d74c-4423-b437-35025cb88af5 - Trivy Check:
AZU-0075
Last reviewed: 2026-10-13