Setting up Azure Firewall for network perimeter

Question

How can I set up Azure Firewall for better security and at more of the resource group level? I already have a network security group (NSG) set up with IP whitelisting for an exposed endpoint, but I'm not sure how to connect the filtered traffic to the NSG and the exposed public endpoint. I'm specifically looking into DNAT rules and network rules, but I'm having trouble understanding if they perform the filtering.

Answer 1

Hello @Anmol Arora ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you would like to understand how to setup Azure Firewall for network perimeter.

Perimeter networks, sometimes called demilitarized zones (DMZs), help provide secure connectivity between cloud networks, on-premises or physical datacenter networks, and the internet. In effective perimeter networks, incoming packets flow through security appliances that are hosted in secure subnets, before the packets can reach back-end servers. Security appliances include firewalls, network virtual appliances (NVAs), and other intrusion detection and prevention systems. Internet-bound packets from workloads must also flow through security appliances in the perimeter network before they can leave the network.

Refer: https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/perimeter-networks

How can I set up Azure Firewall for better security and at more of the resource group level?

Azure Firewall is always deployed in a Virtual network. You can deploy Azure Firewall on any virtual network, but customers typically deploy it on a central virtual network and peer other virtual networks to it in a hub-and-spoke model. You can then set the default route from the peered virtual networks to point to this central firewall virtual network.

Refer: https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#what-is-the-typical-deployment-model-for-azure-firewall

The Azure Firewall service complements network security group functionality. Together, they provide better "defense-in-depth" network security. Network security groups provide distributed network layer traffic filtering to limit traffic to resources within virtual networks in each subscription. Azure Firewall is a fully stateful, centralized network firewall as-a-service, which provides network- and application-level protection across different subscriptions and virtual networks.

Refer: https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#what-is-the-difference-between-network-security-groups--nsgs--and-azure-firewallYou can refer the below document which explains an architecture implementing a perimeter network, also called a DMZ.

Refer: https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal

I'm specifically looking into DNAT rules and network rules, but I'm having trouble understanding if they perform the filtering.

Yes, the DNAT rules and network rules perform traffic filtering based on your configuration.

Refer: https://learn.microsoft.com/en-us/azure/firewall/rule-processing

https://learn.microsoft.com/en-us/azure/firewall/tutorial-firewall-dnat-policy

https://learn.microsoft.com/en-us/azure/firewall/tutorial-hybrid-portal-policy#configure-network-rules

Kindly let us know if the above helps or you need further assistance on this issue.

---

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.