Azure firewall

Question

Azure firewall

prasantc 996

Is it possible to link one firewall policy in a secured hub from us east in west europe and link another policy that are unique to west eu firewall policy to EU firewall in a secured hub vwan scenario? In other words, multiple policy link to Firewall

KapilAnanth 49,876 Reputation points Moderator

2023-07-31T05:09:19.7733333+00:00

@prasantc

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,

Kapil

Answer accepted by question author

0 additional answers

Your answer

KapilAnanth 49,876 Reputation points Moderator

2023-07-31T05:09:19.7733333+00:00

@prasantc

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,

Kapil

Answer 1

KapilAnanth 49,876 Moderator

@prasantc

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to know if we can link multiple Firewall policies to a single Firewall (secured Hub).

This will not be possible.

A securedHub can have only one Firewall policy associated to it at any instance.

You should consider using Child Policies : Hierarchical policies in Azure

With inheritance, any changes to the parent policy are automatically applied down to associated firewall child policies.

After inheriting rules from a Master/Parent Policy, you can use these Child Policies across your vWAN secured Hubs.
Should any rule override from Parent policy required, you can simply update the Child Policy for that specific secured Hub.
And should any new Global/Master rule needs to implemented, you can do it in the Parent Policy

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

prasantc 996 Reputation points

2023-07-26T16:02:28.3966667+00:00
Should any rule override from Parent policy required, you can simply update the Child Policy for that specific secured Hub.

Does Child override the parent policy or parent has higher priority?

I have multiple secured hub in three intercontinental region and two inter-region making total of 6 secured hub in VWAN. A common set of parent policies in all region and secondary policy unique to each region is the plan
KapilAnanth 49,876 Reputation points Moderator

2023-07-28T13:22:54.1466667+00:00
@prasantc ,

I see the term "override" was misleading.

Apologies.

If a Firewall Policy is inherited from a parent policy, Rule Collection Groups in the parent policy always takes precedence regardless of the priority of a child policy.

What I was hoping to mean is,

Firewall is DENY BY DEFAULT

So, if the child polices were to just inherit the Rules from Parent policy and have none on their own, Traffic will still be blocked.

We will be required to define a set of ALLOW RULES in the Child Policies to allow Traffic.

So, we define a general set of Global Allow and Deny Rules in Parent Policy

i.e, No DENY ALL Rule in Parent Policy

Now, in the Child Policies, you can define the specific ALLOW RULES, specific DENY RULES and as well the DENY ALL Rule

So, in this case, Child Policy ALLOW will override the DENY BY DEFAULT of Parent Policy

I hope this makes it clear.

To summarize, the idea is to not have any DENY Rules in Parent Policy and set explicit ALLOW/DENY rules in the Child Policy.

Cheers,

Kapil

Please Accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer.

Share via

Azure firewall

0 additional answers

Your answer