Azure Firewall outbound traffic

krutibasa majhi 0

Hello Everyone,

How to check the total outbound internet traffic for the last 30 days in Azure Firewall. Please advice.

I searched in the metrics, but it did not display anything related to outbound traffic. Although "data processed" is available, I cannot see any inbound or outbound traffic details.

Thanks,

Krutibasa

KapilAnanth-MSFT 35,001 Reputation points Microsoft Employee

2024-03-20T12:33:40.32+00:00
@krutibasa majhi ,

Can you confirm if you have Enable diagnostic logging through the Azure portal?

If yes, can you confirm if you tried Jackson Martins's latest query?

Cheers,

Kapil

1 answer

Jackson Martins 9,646 Reputation points MVP

2024-03-18T14:47:45.9033333+00:00

Hi @krutibasa majhi

Azure Firewall integrates with Azure Monitor Logs, providing detailed logging capabilities that can be analyzed to track inbound and outbound traffic

Ensure you have a Log Analytics workspace set up and linked to your Azure Firewall. If not, you can create one and then configure Azure Firewall to send its diagnostic logs and metrics to this workspace.

Reference:

https://learn.microsoft.com/en-us/azure/firewall/firewall-diagnostics

https://learn.microsoft.com/en-us/azure/firewall/logs-and-metrics

Get in touch if you need more help with this issue.

--please don't forget to "[Accept the answer]" if the reply is helpful--
Please sign in to rate this answer.
krutibasa majhi 0 Reputation points

2024-03-19T09:14:09.51+00:00

Hi @Jackson Martins Thanks for your response..

I have enabled Azure Diagnostics and Log Analytics workspace. Despite trying multiple queries, I'm unable to see the outbound traffic data. I can only view information such as source, destination, port, and action.

None of the below queries are running; they're showing errors.

AzureDiagnostics | where ResourceType == "AzureFirewalls" | where TimeGenerated >= ago(24h) | where Direction_s == "Outbound" // Assuming this column represents the traffic direction | summarize TotalOutboundDataProcessed = sum(TotalBytes_d) / 1024 by bin(TimeGenerated, 1h)

AzureDiagnostics | where ResourceType == "AzureFirewalls" | where TimeGenerated >= ago(24h) // Adjust time range as needed | summarize TotalOutboundDataProcessed = sum(FlowBytesSent_s) by bin(TimeGenerated, 1h)

--

AzureDiagnostics | where ResourceId contains "<Your_AzureFirewall_Resource_ID>" | where TimeGenerated >= ago(24h) | where Direction == "Outbound" | summarize TotalOutgoingBytes = sum(FlowBytesSent_s) by bin(TimeGenerated, 1h)

Thanks,

Krutibasa

Jackson Martins 9,646 Reputation points MVP

2024-03-19T13:13:09.09+00:00

Based on your queries, it looks like you're trying to use columns like Direction_s, TotalBytes_d, and FlowBytesSent_s. If these columns are showing errors, it's likely due to incorrect names or types. Double-check the schema for the exact names.

Try something similar:

his example assumes that outbound traffic is designated in the logs with a direction indicator (like "O" for outbound), but you will need to adjust the query according to your actual log schema:

AzureDiagnostics | where ResourceType == "AZUREFIREWALLS" and Direction_s == "O" | summarize TotalOutboundBytes=sum(BytesSent_d) by bin(TimeGenerated, 1h), SourceIP_s, DestinationIP_s | order by TimeGenerated desc
Sign in to comment