Architecture and Operational Role of Azure Firewall
Securing network traffic across cloud footprints requires centralized policy enforcement and threat prevention. Without unified inspection points, distributed Virtual Networks (VNets) face configuration drift, inconsistent security policies, and fragmented network perimeter visibility.
Azure Firewall is a cloud-native, fully stateful firewall-as-a-service that provides threat protection, centralized rule orchestration, and Layer 3 through Layer 7 traffic inspection across Azure cloud resources.
Core Architectural Features and Capabilities
Azure Firewall runs as a managed, highly available service backed by built-in auto-scaling, eliminating the need to deploy and balance third-party network virtual appliances (NVAs) manually.
- Layer 3 to Layer 7 Filtering: Enforces network filtering rules based on IP address, port, and protocol, alongside Layer 7 application rules that filter outbound HTTP/S traffic by Fully Qualified Domain Names (FQDNs).
- Built-in High Availability and Elasticity: Scales compute resources automatically up to 30 Gbps based on real-time traffic volume and spans multiple Availability Zones without requiring extra load balancers.
- Threat Intelligence-Driven Filtering: Ingests Microsoft Cyber Signals telemetry to alert on or actively block traffic communicating with known malicious IP addresses and domain names.
- TLS Inspection and IDPS: Higher service tiers (Azure Firewall Premium) perform inbound and outbound Transport Layer Security (TLS) termination and inspection, backed by signature-based Intrusion Detection and Prevention Systems (IDPS).
Hub-and-Spoke Deployment and Traffic Redirection
Azure Firewall typically anchors a centralized hub-and-spoke networking topology to inspect north-south (internet-bound) and east-west (spoke-to-spoke) traffic flows.
- Dedicated Subnet Requirement: The firewall deploys strictly into a dedicated subnet named
AzureFirewallSubnet with a minimum size of /26 to allow sufficient IP headroom for automatic scaling.
- User-Defined Routes (UDRs): Spoke subnets route their outbound traffic (
0.0.0.0/0 or internal CIDR ranges) directly to the private IP of the Azure Firewall via custom route tables.
- Source Network Address Translation (SNAT): All outbound public internet traffic uses the firewall's public IP address as the source, masking internal VNet IP spaces and simplifying perimeter firewall whitelisting.
- Destination Network Address Translation (DNAT): Inbound traffic directed to the firewall's public IP can be translated and redirected to backend services situated within private subnets.
Azure Firewall vs. Network Security Groups (NSGs)
Understanding when to leverage Azure Firewall versus Network Security Groups is essential for cost optimization and defense-in-depth design:
- Scope and Placement: NSGs operate locally as distributed packet-filtering firewalls directly on subnet boundaries and network interfaces (NICs), whereas Azure Firewall functions as a centralized gateway for transit inspection.
- Inspection Depth: NSGs only filter Layer 3 and Layer 4 stateful connections, lacking capabilities for URL path filtering, FQDN inspection, TLS termination, or signature-based threat analysis.
- Complementary Architecture: Best-practice architectures combine both layers—using NSGs for granular microsegmentation within subnets and Azure Firewall to inspect perimeter boundary crossings and cross-VNet enterprise traffic.