Best practice and use case scenario of Azure Firewall ?

Question

People,

I'd like to know the best-case scenario for deploying and using Azure Firewall in my production Subscription is?

From what I can see, the KeyVault and Storage Account already have their own Firewall feature built in, therefore it is only the Azure Virtual machine that I can think of to secure with the Firewall.
But if most of the VM is just for internal purposes and not published outside of the public internet, what is the main reason for using Azure Firewall then?

Answer 1

Hello @EnterpriseArchitect ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you would like to know the best practices and use case scenario of deploying Azure Firewall in your production Subscription.

The below articles provides architectural best practices for Azure Firewall.
Refer : https://learn.microsoft.com/en-us/azure/architecture/framework/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json
https://learn.microsoft.com/en-us/azure/architecture/networking/guide/well-architected-framework-azure-firewall

You can use Azure Firewall to govern:

• Internet outbound traffic (VMs and services that access the internet).
• Non-HTTP/S inbound traffic.
• East-west traffic filtering.

You can share the same Azure Firewall across multiple workloads and Azure Virtual Networks. You could also stop Azure Firewall deployments that do not need to run for 24 hours.

If your setup has Internet outbound traffic or Non-HTTP/S inbound traffic, then it is recommended to use Azure Firewall for better security.

If you only have one VM which doesn't have a public IP with any internet connectivity, then you can skip Azure Firewall deployment.

Some more best practices that you can refer:
https://learn.microsoft.com/en-us/azure/security/fundamentals/network-best-practices#deploy-perimeter-networks-for-security-zones
https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/virtual-network-security-baseline#14-deny-communications-with-known-malicious-ip-addresses

Kindly let us know if the above helps or you need further assistance on this issue.

----------------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.