Azure Firewall: application rule to allow https:443 vs network rule to allow port 443

Question

I am learning Azure Firewall and am confused by some basic TCP/IP concepts.

To allow HTTPs outbound traffic in Azure Firewall, as I know there are 2 ways to set up(please refer attached screenshot):

1. Create a network rule to allow port 443
2. Create an application rule to allow https:443

Both seem to work.

What's the difference between them? which one is preferred?

(I have similar confusion in Application Gateway and Azure Load balance in terms of HTTPs vs port 443)

Thank you

Answer 1

@David Roth

Thank you for posting your query on Microsoft Q&A.

The difference is in the level of granularity in the traffic allowed.

Network rules

Network rules allow or deny inbound, outbound, and east-west traffic based on the network layer (L3) and transport layer (L4). We can use a network rule when you want to filter traffic based on IP addresses, any ports, and any protocols.

Application rules

Application rules allow or deny outbound and east-west traffic based on the application layer (L7). We can use an application rule when you want to filter traffic based on fully qualified domain names (FQDNs), URLs, and HTTP/HTTPS protocols.

The preferred method depends on your security requirements. If you want to allow all traffic over port 443, regardless of the protocol or destination, use a network rule. If you want to allow only specific HTTPS traffic, use an application rule. It's always better to have more granular control over the traffic allowed.

Please refer to Network and Application rules

https://learn.microsoft.com/en-us/azure/firewall/rule-processing