Design and implement Azure Firewall

Azure Firewall is a managed, cloud-based network security service that protects your Azure virtual network resources. Azure firewall has built-in high availability and unrestricted cloud scalability. Azure Firewall works not only for traffic to and from the internet, but also internally. Internal traffic filtering includes spoke-to-spoke traffic and hybrid cloud traffic between your on-premises network and your Azure virtual network.

When to use Azure Firewall

Azure Firewall has three SKUs: Azure Firewall Basic, Azure Firewall Standard, and Azure Firewall Premium. All versions can help you in these scenarios.

• You want to protect your network against infiltration.
• You want to protect your network against user error.
• Your business includes e-commerce or credit card payments.
• You want to configure spoke-to-spoke connectivity.
• You want to monitor incoming and outgoing traffic.

What are Azure Firewall rules?

An Azure Firewall denies all traffic by default, until rules are manually configured to allow traffic. Rules are organized inside Rule Collections which are contained in Rule Collection Groups. In the Azure Firewall, you can configure NAT rules, network rules, and applications rules.

Azure Firewall applies rules in priority order. Rules based on threat intelligence are always given the highest priority and are processed first. After that, rules are applied by type: NAT rules, then network rules, then application rules. Within each type, rules are processed according to the priority values you assign when you create the rule, from lowest value to highest value.