any any allow rule on azure firewall

Question

Hi MS,

I have a secured HUB and my firewall has ANY-ANY allow rule.

The inbound and outbound traffic is protected via NSGs.

So are there any risks of having an ANY ANY allow rule or any best practices I should follow?

Answer 1

hi @Samar Masood Khan

It is not recommended that you allow any address on the internet to access any port in your structure, there are automatic scans that will quickly identify the listening ports in your structure and you may suffer attacks.

nsg is already a great constraint, but I don't recommend keeping any any-any rules

There are some best practices articles for the solutions, below are some:

reference: https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/virtual-network-security-baseline#14-deny-communications-with-known-malicious-ip-addresses

reference: https://learn.microsoft.com/en-us/azure/architecture/framework/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json

reference: https://learn.microsoft.com/en-us/azure/architecture/framework/services/networking/azure-firewall

Get in touch if you need more help with this issue.

--please don't forget to "[Accept the answer]" if the reply is helpful--