Communications between the Azure VMware Solution private cloud and the on-premises environment is secured with an on-premises firewall.  This architecture can be implemented when a VPN or ExpressRoute is used to connect to Azure.