Azure Firewall Configuration

This document guides you through the essential configuration steps for Azure Firewall, a cloud-native network security service that protects your Azure Virtual Network resources. Properly configuring Azure Firewall is crucial for enforcing network policies, controlling inbound and outbound traffic, and detecting malicious activity.

Prerequisites

Before you begin, ensure you have the following:

• An Azure subscription.
• A virtual network (VNet) deployed in Azure.
• A dedicated subnet for Azure Firewall, named AzureFirewallSubnet. This subnet must be named exactly this and cannot have any other resources deployed in it.
• Appropriate permissions to create and manage network resources in Azure.

Creating an Azure Firewall Instance

You can create an Azure Firewall instance using the Azure portal, Azure CLI, or Azure PowerShell.

Using the Azure Portal

1. Navigate to the Azure portal.
2. Search for Firewall and select it.
3. Click Create.
4. On the Basics tab:
   • Select your subscription and resource group.
   • Enter a name for your firewall (e.g., myAzureFirewall).
   • Choose a region that is the same as your virtual network.
   • Select the Availability zone (if applicable).
   • For Edition, choose Standard or Premium.
5. On the IP Configurations tab:
   • Click Add IP configuration.
   • Enter a name for the IP configuration (e.g., FirewallIPConfig).
   • Select the Virtual network where your AzureFirewallSubnet resides.
   • Select the AzureFirewallSubnet.
   • For Public IP address, select an existing one or click Create new to create a new static public IP address.
6. On the Tags tab, you can add tags if needed.
7. Click Review + create, then click Create.

Using Azure CLI

az network firewall create \
    --name myAzureFirewall \
    --resource-group myResourceGroup \
    --location eastus \
    --vnet-name myVNet \
    --public-ip-name FirewallPublicIp \
    --sku Standard
        

Configuring Network Rules

Network rules allow you to permit or deny traffic based on IP addresses, ports, and protocols. These rules are evaluated before application rules.

Rule Collection Types

• Network Rule Collection: For L3/L4 traffic (IP addresses, ports, protocols).
• Application Rule Collection: For FQDNs (Fully Qualified Domain Names) and HTTP/HTTPS traffic.
• NAT Rule Collection: For Network Address Translation, typically for inbound connections.

Creating a Network Rule Collection

1. Navigate to your Azure Firewall instance in the Azure portal.
2. Under Settings, select Rules.
3. Click on the Network rule collections tab.
4. Click Add network rule collection.
5. Provide a Name for the collection (e.g., AllowInternalWeb).
6. Set the Priority (lower numbers are processed first).
7. Select the Rule collection type: Network.
8. Under Rules, click Add rule:
   • Name: e.g., AllowHTTP_80
   • Source type: e.g., IP Address
   • Source: e.g., 10.0.1.0/24
   • Protocol: e.g., TCP
   • Destination type: e.g., IP Address
   • Destination: e.g., 10.0.2.5
   • Destination port: e.g., 80
   • Action: Allow
9. Click Add to save the rule and then Add again to save the collection.

Configuring Application Rules

Application rules enable granular control over HTTP and HTTPS traffic based on Fully Qualified Domain Names (FQDNs) or FQDN tags.

1. In your Azure Firewall instance, go to Rules > Application rule collections.
2. Click Add application rule collection.
3. Provide a Name (e.g., AllowMicrosoftUpdate).
4. Set the Priority.
5. Set the Rule collection type: Application.
6. Under Rules, click Add rule:
   • Name: e.g., AllowWindowsUpdate
   • Source type: IP Address
   • Source: e.g., 10.0.1.0/24
   • Protocol: e.g., http,https
   • Destination type: e.g., FQDN
   • Target FQDNs: e.g., *.windowsupdate.microsoft.com
   • Web categories: (Optional)
   • Action: Allow
7. Click Add to save the rule and then Add again to save the collection.

Configuring NAT Rules

NAT rules are used to translate private IP addresses and ports to public ones, allowing external access to internal resources.

1. In your Azure Firewall instance, go to Rules > NAT rule collections.
2. Click Add NAT rule collection.
3. Provide a Name (e.g., AllowRDPInbound).
4. Set the Priority.
5. Set the Rule collection type: NAT.
6. Under Rules, click Add rule:
   • Name: e.g., RDP_Public_IP
   • Protocol: TCP
   • Source type: IP Address
   • Source: * (or specific IPs if known)
   • Destination type: IP Address
   • Destination: Your firewall's public IP address.
   • Destination port: The public port for RDP (e.g., 3389).
   • Translated address: The private IP address of the internal server (e.g., 10.0.2.10).
   • Translated port: The private port for RDP (e.g., 3389).
   • Action: Dnat
7. Click Add to save the rule and then Add again to save the collection.

Next Steps

Once your Azure Firewall is configured, consider setting up threat intelligence, monitoring firewall logs, and integrating with Azure Security Center for comprehensive security posture management.