Lesson: Azure Firewall and Firewall Manager

Introduction

In the modern cloud landscape, securing your network perimeter is non-negotiable. As organizations migrate complex workloads to Microsoft Azure, they require a robust, scalable, and manageable solution to filter traffic. Azure Firewall is a managed, cloud-native network security service that protects your Azure Virtual Network resources.

Unlike traditional network appliances that require manual patching and scaling, Azure Firewall is fully stateful, meaning it tracks the state of active network connections. Azure Firewall Manager acts as the central management plane, allowing you to govern security policies across multiple subscriptions and virtual networks, which is essential for enterprise-scale deployments.

Azure Firewall: Deep Dive

Azure Firewall sits at the edge of your Virtual Network (VNet). It uses a "hub-and-spoke" architecture, where the firewall resides in a central "hub" VNet and inspects traffic flowing between spokes, on-premises networks, or the internet.

Key Features

1. High Availability: Built-in high availability with no extra cost; it scales automatically based on traffic volume.
2. FQDN Filtering: You can allow outbound HTTP/S traffic based on Fully Qualified Domain Names (e.g., *.microsoft.com).
3. Threat Intelligence: Integrated threat intelligence-based filtering alerts and denies traffic from known malicious IP addresses and domains.
4. SNAT/DNAT Support: Source Network Address Translation (SNAT) for outbound traffic and Destination Network Address Translation (DNAT) for inbound traffic to internal resources.

Note: Azure Firewall supports three tiers: Basic (for small/medium businesses), Standard (for general enterprise), and Premium (for advanced security, including IDPS and TLS inspection).

Azure Firewall Manager

As your cloud footprint grows, managing individual firewalls becomes tedious. Firewall Manager allows you to create Firewall Policies that can be applied across multiple firewalls.

• Centralized Policy Management: Define a "Base Policy" for global rules (e.g., block all traffic from a specific country) and "Child Policies" for application-specific rules.
• Hub-and-Spoke Governance: Automatically deploy and configure firewalls in Hub VNets using Secured Virtual Hubs (via Azure Virtual WAN).

Practical Implementation

Scenario: Deploying an Azure Firewall via Azure CLI

To deploy a firewall, you must first ensure you have a dedicated subnet named AzureFirewallSubnet.

1. Create the Firewall Subnet

az network vnet subnet create \
    --name AzureFirewallSubnet \
    --resource-group MyRG \
    --vnet-name MyVNet \
    --address-prefixes 10.0.1.0/26

2. Create the Firewall

az network firewall create \
    --name MyHubFirewall \
    --resource-group MyRG \
    --location eastus \
    --sku AZFW_VNet

3. Define a Network Rule

This rule allows internal traffic from the 10.0.0.0/16 range to reach a specific server on port 80.

az network firewall network-rule create \
    --firewall-name MyHubFirewall \
    --collection-name AllowInternalTraffic \
    --name AllowWeb \
    --resource-group MyRG \
    --action Allow \
    --destination-addresses 10.0.2.5 \
    --destination-ports 80 \
    --protocols TCP \
    --source-addresses 10.0.0.0/16 \
    --priority 100

Best Practices

1. Hub-and-Spoke Architecture

Always deploy Azure Firewall in a dedicated Hub VNet. Use User-Defined Routes (UDRs) in your spoke VNets to force traffic to the firewall (the "Next Hop" should be the Firewall's private IP).

2. Leverage Firewall Policies

Never create rules directly on the firewall if you manage multiple environments. Use Firewall Manager Policies. This allows you to inherit rules from a global policy, ensuring compliance across Dev, Test, and Prod environments.

3. Enable Diagnostic Logging

Always stream firewall logs to a Log Analytics Workspace. This is critical for auditing and troubleshooting. Look for:

• AzureFirewallApplicationRule: Logs FQDN filtering results.
• AzureFirewallNetworkRule: Logs IP/Port filtering results.

4. Use IDPS (Premium Tier)

If you are handling sensitive data, use the Premium Tier to enable Intrusion Detection and Prevention System (IDPS). It inspects traffic for signatures of known exploits, providing a layer of security that standard rules cannot offer.

Common Pitfalls

• Forgetting the Subnet Name: Azure Firewall requires the subnet to be named AzureFirewallSubnet. If you name it anything else, the deployment will fail.
• Ignoring SNAT Ranges: If your firewall is handling traffic between internal private networks, ensure the traffic is not being SNATed. Configure your SNAT private IP ranges correctly to avoid unnecessary translation.
• Over-reliance on "Allow All": Avoid using 0.0.0.0/0 as a source or destination in your rules. Always follow the Principle of Least Privilege by restricting rules to specific IPs, CIDRs, or FQDNs.
• Asymmetric Routing: Ensure that traffic return paths are symmetric. If a packet enters the firewall, the response must return through the firewall. Asymmetric routing is a common cause of dropped connections.

Key Takeaways

• Managed Security: Azure Firewall removes the operational burden of patching and scaling traditional network appliances.
• Centralized Control: Use Firewall Manager to enforce security policies globally across multiple subscriptions, reducing administrative overhead and configuration drift.
• Tiered Approach: Choose the tier that matches your security requirements: Basic for low cost, Standard for general traffic filtering, and Premium for advanced threat protection (IDPS/TLS Inspection).
• Architectural Foundation: The Hub-and-Spoke model with UDRs is the gold standard for Azure network security.
• Visibility is Security: Always integrate with Azure Monitor and Log Analytics to gain actionable insights into traffic patterns and potential security breaches.