Azure firewall rules

Question

Is it possible to built rules in a Network or application rule set with different priority numbers using code? I do not see that option on the portal or perhaps it is not recommended.

Answer 1

Yes you can.

For example you can set the priority at the Rule collection using Teraform: https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/firewall_application_rule_collection

You can also either priority to the rules as well, or it will jut inherit from the group, using the same priority.

I would leave it as the priority on the rule collection group, unless you need to change it, then add the priority on the ruleset.

Answer 2

what is best practices how different group collection should be created? Would it be too many if we have group collection separated based on application like DCs in one group, fille server in another group, and have different priorities

Answer 3

@prasantc

Apologies for the delayed response here.

Based on your questions above

And best practice with the example of custom rule set with different priority over default three default rule set.

Currently there is no official documentation available for this specific scenario and I am filing a doc-request with the team internally regarding this request.

Specially, for a company where the network policy rules grows and they want to group allow and deny policy specific to application or department or environment. Whichever would be the best approach to organize the rules to meaningful group and priority.

Based on this documentation for Azure Well-Architected Framework review - Azure Firewall it is recommended to assign a global Azure Firewall policy to govern the security posture across global network environments and assign the policy to all instances of Azure Firewall in your network or as the network evolves. Then Delegate incremental firewall policies to local security teams through role-based access control (RBAC). You can also use Azure Firewall Manager to centrally manage Azure Firewall policies across multiple secured virtual hubs. Your central IT teams can author global firewall policies to enforce organization wide firewall policy across teams. Locally authored firewall policies allow a DevOps self-service model for better agility. You can take a look at this documentation for more information.

In Azure Firewall Manager new policies can be created from scratch or inherited from existing policies. Inheritance allows DevOps to create local firewall policies on top of organization mandated base policy. Network rule collections inherited from a parent policy are always prioritized over network rule collections defined as part of a new policy. The same logic also applies to application rule collections. However, network rule collections are always processed before application rule collections regardless of inheritance. You can take a look at the example here on how to implement a a rule hierarchy.

You can also explore the option of using these leading third-party solutions that support Azure Firewall central management using standard Azure REST APIs.

I guess did not ask the much detail at the first question which is my mistake and I was looking specific cases of portal or bicep rather than TF

You can refer to this tutorial here to create an Azure Firewall and a firewall policy. Please let us know if you are facing any issue while deploying using bicep.

Hope this helps! Please let me know if you have any additional questions. Thank you!

---

​​Please "Accept the answer" if the information helped you. This will help us and others in the community as well.