Azure Firewall - Default vs Custom rule collection group

Question

If I configure a custom rule collection group with the same priority as the defaultNetworkRuleCollection, what is the processing logic? Which one gets evaluated first?

Answer 1

Hello Peter, Welcome to MS Q&A

• When a custom rule collection group is configured with the same priority as the defaultNetworkRuleCollection, Azure Firewall processes the rule collection groups in the order of their priority value (lower number = higher priority).
• If two rule collection groups have the same priority, the processing order between them is not explicitly documented and should not be relied upon; Microsoft recommends using unique priority values to ensure deterministic processing.
• In practice, always assign unique priorities to custom and default rule collection groups to avoid ambiguity in rule evaluation order.

Pls check and let us know if any ques.

Kindly accept answer if it helps

Thanks

Deepanshu

• For more details, see Azure Firewall Policy rule sets.