Is there a tool that will show me the flow of rules processing in Azure Firewall to debug my rules and rule collections?

Question

Azure Firewall Policy Rules and Rule collections can be complicated and confusing.

Is there a tool available (and if not, can Microsoft actually build a useful tool?) that customers can use to show the entire flow of rules processing in the Azure Firewall Policy to understand what it is doing and what will be the result of my request?

I would like a tool that shows me every rule collection and rule that is checked in the order that it is checking them. This could be a really helpful tool for customers when we are trying to configure these rules with all of the things that the firewall policy is doing behind the scenes.

Answer 1

@JohnSebastian-3934

Thank you for reaching out and sharing the feedback.

Is there a tool available (and if not, can Microsoft actually build a useful tool?) that customers can use to show the entire flow of rules processing in the Azure Firewall Policy to understand what it is doing and what will be the result of my request?

Currently such a feature is not available for Azure Firewall and it will help the team prioritize this ask if you could file this feedback item on the feedback portal here.

Meanwhile you can go through this documentation to understand how rules are processed by Azure Firewall.

You can also take a look at Flow trace a structured firewall log which contains flow information, flags, and the time period when the flows were recorded. You can see full flow information such as SYN, SYN-ACK, FIN, FIN-ACK, RST, INVALID (flows).

More details about the flow trace logs can be found here and here is a sample query. This is not the exact feature like you requested above but you can use flow trace logs to see the complete flow of a request and validate connectivity

Hope this helps! Please let me know if you have any additional questions.

---