Azure Firewall Standard is a fully managed, stateful firewall service for centrally inspecting and controlling traffic across Azure networks. It handles north–south traffic between Azure and external destinations and east–west traffic between Azure virtual networks, providing highly available firewall capability without managing its underlying infrastructure. It is one layer in a defense-in-depth approach rather than a complete security solution. section 3.2 section 3.1
Standard controls traffic at layers 3, 4, and 7 and integrates Microsoft threat-intelligence feeds to deny traffic to or from known malicious destinations. Azure Firewall Premium extends Standard with TLS inspection, intrusion detection and prevention, URL filtering, and web categories. section 3.2.1 section 3.7
Deploy traffic control in this order:
- Create the firewall in a chosen subscription, resource group, and VNet. The VNet needs a dedicated AzureFirewallSubnet that cannot host other resources. section 3.2.2
- Provide a public IP address, including when controlling internal traffic, so Microsoft can manage the underlying service resources. section 3.2.2
- Create a route table and route entry, then associate the route table with the workload subnet to direct its traffic through the firewall. section 3.2.2 section 3.2.6
- Add explicit allow rules. Traffic with no matching rule is blocked by default. section 3.2.6 section 3.2.7
Listing 3.1 Creating an Azure Firewall instance
az network firewall create #1 --name Contoso-FW01 #2 --resource-group myResourceGroup #3 --location eastus #4 az network public-ip create #5 --name fw-pip #6 --resource-group myResourceGroup --location eastus --allocation-method static --sku standard az network firewall ip-config create #7 --firewall-name Contoso-FW01 #8 --name FW-config #9 --public-ip-address fw-pip #10 --resource-group myResourceGroup --vnet-name myVNet #11 az network firewall update #12 --name Contoso-FW01 #13 --resource-group myResourceGroup az network public-ip show #14 --name fw-pip --resource-group myResourceGroup fwprivaddr="$(az network firewall ip-config list -g myResourceGroup -f Contoso-FW01 --query "[?name=='FW-config'].privateIpAddress" --output tsv)" #1 Creates the Azure Firewall instance; by default, the Standard SKU is chosen #2 The name of Azure Firewall; needs to be unique in the resource group #3 The resource group that Azure Firewall and underlying resources are deployed to #4 The location in which the firewall instance is deployed #5 Creates public IP address needed for Microsoft to communicate with Azure Firewall resources #6 The name of the public IP address #7 Creates the Azure Firewall IP configuration #8 The name of the Azure Firewall; choose the Azure Firewall you created #9 The name of the Azure Firewall IP configuration #10 The name of public IP; choose the public IP you created #11 The name of the existing VNet; needs to contain a subnet called AzureFirewallSubnet #12 Updates the Azure Firewall instance #13 The name of the Azure Firewall you are updating #14 Gets details about the public IP address
Use the Azure CLI sequence to create a Standard firewall, a static Standard public IP, and its IP configuration; record the resulting private IP for routing steps. section 3.2.3
Listing 3.5 Creating a DNAT rule for Azure Firewall
az network firewall nat-rule create --collection-name Nat-Coll01 #1 --dest-addr 209.244.0.3 #2 --destination-ports 53 #3 --firewall-name Contoso-FW01 #4 --name DNAT-MgmtAccess #5 --protocols TCP UDP #6 --resource-group myResourceGroup --source-addresses 10.0.0.1 #7 --translated-address 128.1.1.1 #8 --translated-port 126 #9 --priority 201 #10 --action Dnat #11 #1 The name of the rule collection; will be created automatically if one doesn’t exist #2 The destination IP addresses in CIDR format; you can use '*' for the rule to apply to all IP addresses #3 The destination port; you can use '*' for rule to apply to all ports #4 The name of the Azure Firewall #5 The name of the DNAT rule #6 The protocols used; accepted values are Any, ICMP, TCP, and UDP #7 The source IP address in CIDR format #8 The translated IP address for the DNAT rule #9 The translated port for the DNAT rule #10 The number value that specifies the priority of the rule collection; it can range from 100 (high priority) to 65000 (low priority) #11 The action that applies to the rule collection; for DNAT rules, the value is Dnat
Create a DNAT rule to forward selected inbound traffic from the firewall public IP to an internal destination. Use narrowly because it exposes a path from outside the network inward. section 3.2.7
Rules are evaluated in type order: DNAT first, then network rules, then application rules. DNAT governs inbound forwarding to internal resources; network rules control traffic such as between peered VNets; application rules allow defined HTTP or HTTPS destinations by FQDN. Rules belong to collections, which can be grouped into rule collection groups, and priority affects processing within the rule design. section 3.2.7 section 3.2.7
Permit workload DNS and web access
For a workload subnet such as 10.0.2.0/24, create a network rule allowing UDP port 53 to specified DNS destination addresses, then create an application rule allowing HTTP and HTTPS access to a selected FQDN such as www.google.com. Assign explicit priorities and Allow actions, leaving all other unmatched traffic denied. section 3.2.7 section 3.2.7
