Forced tunneling configures Azure Firewall to send outbound traffic to a specified network destination instead of directly to the internet. This supports designs where a network virtual appliance, such as a third-party firewall, performs additional inspection. section 3.2.7
Implement forced tunneling with these constraints:
- Enable forced tunneling when creating Azure Firewall; it cannot be enabled afterward. section 3.2.7
- Add routes to AzureFirewallSubnet to direct traffic to the alternate network destination. section 3.2.7
- Create AzureFirewallManagementSubnet with its own public IP address to support the configuration. section 3.2.7
Inspection through a network virtual appliance
After outbound traffic passes through Azure Firewall, route it to a network virtual appliance or third-party firewall for further inspection rather than forwarding it to the internet. section 3.2.7
