Deploy Azure Network Virtual Appliances Firewall

This guide outlines the steps and considerations for deploying a network virtual appliance (NVA) acting as a firewall within your Azure environment. Leveraging NVAs provides advanced security features and granular control over your network traffic.

Prerequisites

An active Azure subscription.
Permissions to create and manage network resources (Virtual Networks, Subnets, Network Security Groups, etc.).
Understanding of Azure networking concepts (e.g., VNet peering, User Defined Routes).

Deployment Scenarios

Network virtual appliances can be deployed in various configurations depending on your security requirements:

Hub-and-Spoke Topology: Deploying a firewall in the hub VNet to inspect traffic between spokes and to/from the internet.
East-West Traffic Inspection: Placing firewalls within individual VNets or subnet groups to inspect traffic originating from or destined for resources within those segments.

Deployment Steps

The general process involves selecting a firewall NVA from the Azure Marketplace, deploying it, and then configuring your Azure network to route traffic through it.

Step 1: Choose a Network Virtual Appliance Firewall

Azure Marketplace offers a wide range of third-party firewall solutions. Popular choices include:

Palo Alto Networks VM-Series
Fortinet FortiGate-VM
Cisco Firepower NGFW
Check Point CloudGuard Network Security

Consider factors such as features, performance, licensing, and support when making your selection.

Step 2: Deploy the Firewall NVA

Deployment typically involves launching a template from the Azure Marketplace. Follow the vendor-specific deployment instructions. This usually includes:

Creating a dedicated subnet for the NVA.
Specifying network interface configurations (public and private IPs).
Configuring initial NVA settings.

Example Azure CLI command snippet (illustrative, actual command will vary):


az vm create \
    --resource-group myResourceGroup \
    --name myNVA-Firewall \
    --image <NVA-Image-URN> \
    --admin-username azureuser \
    --admin-password <your_password> \
    --vnet-name myVNet \
    --subnet myNVA-Subnet \
    --public-ip-address myNVA-PublicIP \
    --nic-type <standard/basic>

Step 3: Configure Network Routing

To ensure traffic is inspected by the NVA, you need to configure User Defined Routes (UDRs). Create route tables and associate them with the subnets that require traffic inspection.

Scenario: Inspecting traffic from a workload subnet to the internet.

Create a UDR table: az network route-table create ...
Add a route to direct internet-bound traffic (0.0.0.0/0) to the NVA's private IP address as the next hop.
Associate the UDR table with your workload subnet(s): az network vnet subnet update ...

Example UDR configuration (illustrative):


{
    "name": "RouteToNVA",
    "properties": {
        "addressPrefix": "0.0.0.0/0",
        "nextHopType": "VirtualAppliance",
        "nextHopIpAddress": "10.0.1.4" // Private IP of the NVA's internal interface
    }
}

Step 4: Configure Firewall Policies

Once the NVA is deployed and routing is configured, log in to the firewall appliance's management interface to define your security policies. This includes:

Creating security rules for allowed and denied traffic.
Configuring network address translation (NAT).
Setting up intrusion prevention (IPS) and other advanced features.

Refer to your chosen firewall vendor's documentation for detailed policy configuration.

Best Practices

High Availability: Deploy NVAs in a highly available configuration, often using multiple instances behind a load balancer.
Management Network: Consider a dedicated management subnet or network for accessing and managing your NVAs.
Logging and Monitoring: Integrate NVA logs with Azure Monitor or SIEM solutions for comprehensive security monitoring.
Regular Updates: Keep NVA software and signatures up-to-date to protect against the latest threats.

Note: Azure Firewall, a managed NVA service, offers an alternative to third-party solutions with built-in high availability and scalability.