5.2 Azure Firewall and Firewall Manager

4.2 Azure Firewall and Firewall Manager

Azure Firewall is a managed, cloud-native stateful network security service that secures Azure Virtual Network resources. Operating as a fully managed service with built-in high availability and auto-scaling, Azure Firewall provides centralized Layer 3 to Layer 7 rule enforcement across subscriptions and virtual networks. Centralized policy governance across multi-hub deployments is managed through Azure Firewall Manager.

---

Azure Firewall SKU Comparison

Azure Firewall is available in three distinct Service Keeping Units (SKUs) tailored to different organizational scale and security requirements:

---

Rule Processing Order & Evaluation Mechanics

Azure Firewall evaluates incoming and outgoing network traffic using a strict, non-configurable rule processing hierarchy.

1. DNAT Rules (Inbound Destination NAT)

Inbound DNAT rules translate a public IP address and port on the firewall to a private IP address and port of a workload VM or load balancer.

• DNAT rules are evaluated first.
• When a DNAT rule matches, an implicit network allow rule is automatically applied to permit the translated packet through to the backend target.

2. Network Rules

Network rules filter Layer 3 and Layer 4 traffic based on source IP addresses, destination IP addresses, Service Tags, FQDNs (resolved to IPs via firewall DNS proxy), target ports, and protocols (TCP, UDP, ICMP).

• Network rules are evaluated second.
• Rule collections are evaluated strictly by priority integer (lowest number first).
• If a matching Network rule is found, processing terminates immediately (either Allowed or Denied). Application rules are never evaluated if a Network rule matches.

3. Application Rules

Application rules configure Layer 7 filtering for outbound or cross-subnet traffic based on Fully Qualified Domain Names (FQDNs), HTTP/HTTPS headers, MSSQL connection attributes, and Web Categories.

• Application rules are evaluated third (only if no Network rule matched the packet).
• If no Application rule matches, the packet is dropped by default (Deny).

---

Advanced Security Capabilities (Premium SKU)

Intrusion Detection and Prevention System (IDPS)

Azure Firewall Premium incorporates a signature-based IDPS engine analyzing network traffic across all ports and protocols for known exploit patterns, vulnerability probing, and Command-and-Control (C2) botnet traffic.

IDPS operates in one of three selectable modes:

• Off: IDPS signature inspection is disabled.
• Alert: Inspects traffic and logs signature detections to Log Analytics workspace without blocking traffic.
• Alert and Deny: Inspects traffic, logs detections, and actively drops/resets malicious packets.

TLS Inspection Architecture

Because over 80% of enterprise web traffic is encrypted via TLS/SSL, legacy firewalls cannot inspect HTTP payloads without decryption. Azure Firewall Premium performs outbound TLS inspection by intercepting client HTTPS sessions, decrypting payload content for IDPS and URL filtering, and re-encrypting the session toward the target destination.

TLS Certificate Requirements:

• Requires an Intermediate Certificate Authority (CA) certificate (or Enterprise Root CA certificate) stored in Azure Key Vault.
• Azure Firewall accesses the Key Vault using a User-Assigned Managed Identity.
• Client endpoints (VMs) must trust the Root/Intermediate CA certificate in their local OS trusted root certificate store to prevent browser security warnings.

---

Azure Firewall Manager & Security Governance

Azure Firewall Manager provides centralized security policy management and automated routing configuration across enterprise cloud topologies.

Architecture Deployment Models

1. Hub Virtual Network: Centralized firewall deployed within a standard Azure Virtual Network hub connected to spoke VNets via VNet Peering.
2. Secured Virtual Hub (Azure Virtual WAN): Managed hub infrastructure created by Virtual WAN where security policies and routing intents (Automated Routing Intent) direct all inter-spoke and internet egress traffic through Azure Firewall or integrated third-party Security-as-a-Service (SECaaS) partners.

Hierarchical Firewall Policies

Firewall Manager utilizes Firewall Policies that can be shared across multiple firewall instances:

• Parent Policy: Maintained by central security teams containing enterprise-wide compliance rules (e.g., global blocklists, mandatory logging).
• Child Policy: Inherits all rules from the Parent Policy while allowing business unit teams to append localized application rules. Child policies cannot override or drop explicit deny rules established in the Parent policy.