Hi, My client wants to put two firewalls inline as per security policy - Palo Alto and Checkpoint. I want to know: If this is possible in Azure to use two NVAs inline? Although above option is preferred, if we use Azure Firewall + one NVA, is this possible? Thanks

Hi @ Rajiv Bansal , in general it should be possible to use more than one firewall/NVA in an Azure network infrastructure. It could be challenging to maintain and administer two different FWs/NVAs. It would be helpful if you have a network diagram of your planed infrastructure. (If the reply was helpful please don't forget to upvote and/or accept as answer , thank you) Regards Andreas Baumgarten

Two NVAs (firewalls) inline in Azure

Rajiv Bansal 206

Hi,

My client wants to put two firewalls inline as per security policy - Palo Alto and Checkpoint. I want to know:

If this is possible in Azure to use two NVAs inline?
Although above option is preferred, if we use Azure Firewall + one NVA, is this possible?

Thanks

KapilAnanth-MSFT 46,776 Reputation points Microsoft Employee

2024-07-08T12:11:21.9066667+00:00
@Rajiv Bansal ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

Azure Firewall is nothing but a managed Azure Provided PaaS NVA.

With that said, while it is possible to have two NVAs to filter traffic one after another, it is not recommended as this would add to management overhead.

This can be achieved with UDRs.

You do not need 2 VNETs to implement this, rather just two Subnets each containing one NVA

In all the subnets except the 2 subnets of NVAs, attach a Route Table with NextHop as NVA1.

This way, all traffic would go to NVA1 where NVA1 can process the traffic first

In the subnet of NVA1, attach another Route Table with NextHop as NVA2

This way, once NVA1 processes the traffic, the traffic can be routed to NVA2 which can further process the request.

Since dual NVA set up are not recommended scenarios, I could not find any documents on How to.

However, this may come in handy : Virtual appliance scenario

Hope this helps

Cheers,

Kapil

Accepted answer

Andreas Baumgarten 111.1K Reputation points MVP

2024-07-05T17:22:52.03+00:00

Hi @Rajiv Bansal ,

in general it should be possible to use more than one firewall/NVA in an Azure network infrastructure.

It could be challenging to maintain and administer two different FWs/NVAs.

It would be helpful if you have a network diagram of your planed infrastructure.

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten
Please sign in to rate this answer.

1 person found this answer helpful.
Rajiv Bansal 206 Reputation points

2024-07-06T06:06:45.2+00:00

Hi @Andreas Baumgarten ,

Thanks for the response. I have to setup a new environment and would go for hub-spoke topology. One VPN Gateway (S2S) and two NVA Firewalls are required to be added. I wanted to know in general if this is possible. If you can refer me to some reference architecture, it would be very helpful.

Andreas Baumgarten 111.1K Reputation points MVP

2024-07-06T06:17:33.1833333+00:00

Hi @Rajiv Bansal ,

hub-spoke topology sounds good to me. Where do you want to deploy the firewalls/NVAs? One in hub vNet I guess. Where should be the second FW/NVA placed?

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

Rajiv Bansal 206 Reputation points

2024-07-06T06:20:28.3233333+00:00

Both NVA/FW should be placed centrally to be used by all workloads. All traffic from/to spokes should be filtered by both. If possible, I would like to put both of them in hub, else in separate VNets.

Andreas Baumgarten 111.1K Reputation points MVP

2024-07-10T04:37:29.0466667+00:00

Hi @Rajiv Bansal ,

this scenario you described is possible. It's additional effort to maintain and might be challenging for troubleshooting. But it's possible.

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Two NVAs (firewalls) inline in Azure

0 additional answers

Your answer