Azure Learning

azure-firewall

Properties2
tagsnetworking, security, firewall, routing
aliasesAzure Firewall, firewall, AFW

2 min read

Azure Firewall

What it is

Azure Firewall is a managed, stateful, cloud-native firewall-as-a-service with built-in high availability and unlimited cloud scalability. It performs application (FQDN) and network (IP/port) filtering, threat intelligence (signature-based hunting), DNAT for inbound, and centralized logging/metrics for outbound traffic.

Why it exists

NSGs filter per-subnet/NIC but lack the centralized, application-layer (FQDN) inspection, auto-scalable throughput, and traffic-engineering (hunting/throttling) that a real perimeter firewall needs. Azure Firewall replaces/hardens your NVA or open-source firewalls at scale, with forced tunneling through UDRs to funnel all traffic through it.

Key ideas

  • Rules — Application rule (FQDN allow/deny, e.g. *.contoso.com), Network rule (IP/protocol/port), NAT rule (DNAT inbound), plus Threat Intelligence (deny malicious IPs/FQDNs), Web categories (as per standards).
  • Firewall Policy — a separate resource holding rule collections, reusable across multiple firewalls (better than legacy per-firewall rules).
  • SKUs — Standard and Premium (Premium adds IDPS, TLS inspection, URL filtering).
  • Deployed in a dedicated AzureFirewallSubnet with a single public IP; scales automatically (multiple instances as load grows).
  • Supports Forced tunneling (all internet egress through it), DNS proxy, and integration with Virtual WAN hubs.
  • DDoS Protection — always on (Basic); can be enhanced with DDoS protection plan (Standard).

How it fits

[VM/app] ──0.0.0.0/0 UDR──► [Azure Firewall]  DHCP  [...internet]
                              │  App rules / Network rules / Threat intel / DNAT inbound
                              ▼
                          to allowed destinations

azure-firewall - Microsoft diagram

Diagrams courtesy of Microsoft Learn / Azure docs: firewall/overview

Exam notes

  • Azure Firewall is stateful and auto-scalable; needs a dedicated AzureFirewallSubnet with a public IP.
  • Use Application rules for outbound FQDNs; Network rules for IP/port; DNAT for inbound mapping.
  • Firewall Policy is the modern way to share rule sets across firewalls.
  • Compare to nsg (per-subnet/NIC stateless-ish microsegmentation) — Firewall = centralized perimeter + app-layer.

Home · nsg · route-table · virtual-wan · ddos-protection · vnet

📘 Source: Microsoft Learn — Azure Firewall

Graph View

Backlinks