5.1.1.3. Configure Azure Firewall
đź’ˇ First Principle: Azure Firewall provides centralized, intelligent, and scalable network security for Virtual Network resources, delivering advanced threat protection and traffic filtering that goes beyond traditional Network Security Groups.
Scenario: Your organization requires all outbound internet traffic from Virtual Machines in a production Virtual Network to be filtered, allowing access only to approved FQDNs (e.g., *.microsoft.com). All inbound traffic should also be inspected by a centralized firewall before reaching any application.
What It Is: Azure Firewall is a managed, cloud-native network security service that provides centralized network protection for all your Azure VNet resources.
Purpose:
- Azure Firewall acts as a security boundary, inspecting and filtering both inbound and outbound traffic.
- It is deployed in a dedicated subnet named
AzureFirewallSubnet.
Key Benefits:
- Centralized Control: Enforce consistent network security policies across multiple subscriptions and VNets.
- Threat Intelligence: Leverages Microsoft’s threat intelligence feed to block traffic from known malicious IPs and domains.
- FQDN Filtering: Allows or denies outbound traffic based on Fully Qualified Domain Names (FQDNs).
- SNAT/DNAT: Supports Source and Destination Network Address Translation.
Rule Types:
- Network Rules (Layer 3/4): Control traffic based on IP addresses, ports, and protocols.
- Application Rules (Layer 7): Filter traffic based on HTTP/S and FQDNs.
Visual: Azure Firewall Centralized Security
Loading diagram...
⚠️ Common Pitfall: Not configuring User-Defined Routes (UDRs) to force traffic through the Azure Firewall. Without UDRs, traffic from subnets may bypass the firewall and go directly to the internet.
Key Trade-Offs:
- Centralized Control (Firewall) vs. Distributed Control (NSGs): Azure Firewall provides centralized, powerful filtering but adds a single point of traffic management. NSGs provide distributed, simpler filtering. They are often used together for defense-in-depth.
Reflection Question: How does configuring Azure Firewall (with its centralized control, threat intelligence, and FQDN filtering capabilities) fundamentally provide intelligent and scalable network security for Azure VNet resources, ensuring both inbound and outbound traffic adheres to strict security policies?