🔥 Azure Firewall

Azure Firewall is a cloud-native, stateful firewall-as-a-service with built-in high availability and unlimited cloud scalability. It's deployed in Hub VNets and inspects all traffic flowing between Spoke VNets and to/from the internet.

Basic / Standard / Premium IDPS TLS Inspection Hub-Spoke

📋 Overview & SKUs

Feature	Basic	Standard	Premium
FQDN Filtering	✅	✅	✅
Network Rules (IP/Port)	✅	✅	✅
Application Rules (FQDN)	✅	✅	✅
Threat Intelligence	Basic	✅ Alert+Deny	✅ Alert+Deny
IDPS (Intrusion Detection)	❌	❌	✅ 58,000+ signatures
TLS Inspection	❌	❌	✅
URL Filtering (full path)	❌	❌	✅
Web Categories	❌	✅	✅
Throughput	250 Mbps	30 Gbps	30 Gbps

🏗️ Hub-Spoke Architecture

Azure Firewall is placed in the Hub VNet. All Spoke VNets route traffic through the Hub Firewall via User Defined Routes (UDRs). This centralizes all egress/ingress inspection.

Hub VNet (10.0.0.0/16)
├── AzureFirewallSubnet (10.0.1.0/26) ← Azure Firewall (min /26, no NSG!)
├── GatewaySubnet (10.0.0.0/27)       ← VPN/ExpressRoute Gateway
└── AzureBastionSubnet (10.0.2.0/27)  ← Azure Bastion

Spoke VNet 1 – Workloads (10.1.0.0/16)
└── UDR: 0.0.0.0/0 → Azure Firewall Private IP

Spoke VNet 2 – Data (10.2.0.0/16)
└── UDR: 0.0.0.0/0 → Azure Firewall Private IP

⚠️

AzureFirewallSubnet requirements: Minimum /26 subnet, no NSG attached. NSGs on the Firewall subnet are not supported and will break the deployment.

📜 Rule Types

Rule Type	Layer	Description
DNAT Rules	L3/L4	Inbound traffic: translate public IP:port to internal IP:port
Network Rules	L3/L4	Allow/deny based on IP, port, protocol
Application Rules	L7	Allow/deny based on FQDN, URL categories, protocols (HTTP/HTTPS)

Rule Priority: DNAT → Network Rules → Application Rules. First matching rule wins.

⚙️ Firewall Policy

portal.azure.com › Firewall Policies › prod-fw-policy › Rule collections

Overview

DNS settings

Rule collections

IDPS

TLS inspection

prod-fw-policy | Rule collections

Name	Type	Priority	Action
Deny-Inbound-RDP	Network	100	Deny
Allow-AzureServices	Network	200	Allow
App-Allow-HTTPS	Application	300	Allow

💡 Lower priority number = higher precedence. Deny rules should have priority 100–199.

📸 Azure Firewall Policy rule collections — Network rules evaluated before Application rules

Firewall Policy is the recommended configuration method. It supports policy hierarchy: Parent Policy (global baseline) → Child Policies (per-region/environment). Child policies inherit parent rules but can add their own.

🛡️ IDPS – Intrusion Detection & Prevention

Premium only. IDPS has 58,000+ signatures covering CVEs, exploit kits, botnets, lateral movement, and C2 communication.

Mode	Behavior
Off	IDPS disabled
Alert	Log matching traffic, no block
Alert and Deny	Block and log matching traffic (recommended)

🔐 TLS Inspection

Premium only. TLS Inspection decrypts HTTPS traffic, inspects the payload, then re-encrypts. Requires an Intermediate CA certificate stored in Key Vault.

Deploy an Intermediate CA certificate to Azure Key Vault
Grant Azure Firewall Managed Identity access to the certificate
Enable TLS Inspection in the Firewall Policy
Configure trusted CA certificates for internal services
Application Rules with HTTPS will now decrypt and inspect traffic

🌐 URL Filtering

Premium only. URL Filtering can block based on the full URL path (not just domain), and can use Web Categories to block entire categories (Social Media, Gambling, Adult Content, etc.).

🔎 KQL Queries

Blocked Traffic by Firewall

AzureDiagnostics
| where Category == "AzureFirewallNetworkRule"
| where msg_s contains "Deny"
| extend SourceIP = extract(@"from (\d+\.\d+\.\d+\.\d+)", 1, msg_s)
| extend DestIP = extract(@"to (\d+\.\d+\.\d+\.\d+)", 1, msg_s)
| summarize BlockCount = count() by SourceIP, DestIP, bin(TimeGenerated, 1h)
| order by BlockCount desc

Threat Intelligence Hits

AzureDiagnostics
| where Category == "AzureFirewallThreatIntelLog"
| project TimeGenerated, msg_s, SourcePort_d, DestinationPort_d
| order by TimeGenerated desc

IDPS Alerts (Premium)

AzureDiagnostics
| where Category == "AzureFirewallIDPSSignatureHit"
| project TimeGenerated, SignatureId_d, SeverityLevel_s,
          SourceIP, DestinationIP, Protocol_s, Action_s
| order by TimeGenerated desc

Azure Firewall – Complete Guide