Skip to content

Commit 00f6892

Browse files
LJSpillerLJSpiller
authored
Merge pull request #210381 from vhorne/fw-basic
add Basic preview
2 parents c91d58e + ade8284 commit 00f6892

File tree

5 files changed

+306
-2
lines changed

5 files changed

+306
-2
lines changed

‎articles/firewall/deploy-firewall-basic-portal-policy.md

Lines changed: 279 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,279 @@
1+
---
2+
title: 'Deploy & configure Azure Firewall Basic (preview) and policy using the Azure portal'
3+
description: In this how-to, you learn how to deploy and configure Azure Firewall Basic (preview) and policy rules using the Azure portal.
4+
services: firewall
5+
author: vhorne
6+
ms.service: firewall
7+
ms.topic: how-to
8+
ms.date: 09/12/2022
9+
ms.author: victorh
10+
ms.custom: mvc
11+
#Customer intent: As an administrator new to this service, I want to control outbound network access from resources located in an Azure subnet.
12+
---
13+
14+
# Deploy and configure Azure Firewall Basic (preview) and policy using the Azure portal
15+
16+
> [!IMPORTANT]
17+
> Azure Firewall Basic is currently in PREVIEW.
18+
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
19+
20+
Azure Firewall Basic provides the essential protection SMB customers need at an affordable price point. This solution is recommended for SMB customer environments with less than 250 Mbps throughput requirements. It is recommended to deploy the [Standard SKU](tutorial-firewall-deploy-portal-policy.md) for environments with more than 250 Mbps throughput requirements and the [Premium SKU](premium-portal.md) for advanced threat protection.
21+
22+
Filtering network and application traffic is an important part of an overall network security plan. For example, you may want to limit access to web sites. Or, you may want to limit the outbound IP addresses and ports that can be accessed.
23+
24+
One way you can control both inbound and outbound network access from an Azure subnet is with Azure Firewall and Firewall Policy. With Azure Firewall and Firewall Policy, you can configure:
25+
26+
* Application rules that define fully qualified domain names (FQDNs) that can be accessed from a subnet.
27+
* Network rules that define source address, protocol, destination port, and destination address.
28+
* DNAT rules to translate and filter inbound Internet traffic to your subnets.
29+
30+
Network traffic is subjected to the configured firewall rules when you route your network traffic to the firewall as the subnet default gateway.
31+
32+
For this how-to, you create a simplified single VNet with three subnets for easy deployment. The Firewall Basic Preview has a mandatory requirement to be configured with a management NIC.
33+
34+
* **AzureFirewallSubnet** - the firewall is in this subnet.
35+
* **AzureFirewallManagementSubnet** - for service management traffic.
36+
* **Workload-SN** - the workload server is in this subnet. This subnet's network traffic goes through the firewall.
37+
38+
For production deployments, a [hub and spoke model](/azure/architecture/reference-architectures/hybrid-networking/hub-spoke) is recommended, where the firewall is in its own VNet. The workload servers are in peered VNets in the same region with one or more subnets.
39+
40+
In this how-to, you learn how to:
41+
42+
> [!div class="checklist"]
43+
> * Set up a test network environment
44+
> * Deploy a basic firewall and basic firewall policy
45+
> * Create a default route
46+
> * Configure an application rule to allow access to www.google.com
47+
> * Configure a network rule to allow access to external DNS servers
48+
> * Configure a NAT rule to allow a remote desktop to the test server
49+
> * Test the firewall
50+
51+
If you prefer, you can complete this procedure using [Azure PowerShell](deploy-ps-policy.md).
52+
53+
## Prerequisites
54+
55+
If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
56+
57+
### Enable Firewall Basic
58+
59+
For the preview, you must enable the Firewall Basic feature on your subscription.
60+
61+
```azurepowershell
62+
Connect-AzAccount
63+
Select-AzSubscription -Subscription "subscription_id or subscription_name"
64+
Register-AzProviderFeature -FeatureName AzureFirewallBasic -ProviderNamespace Microsoft.Network
65+
Register-AzResourceProvider -ProviderNamespace Microsoft.Network
66+
```
67+
68+
## Create a resource group
69+
70+
The resource group contains all the resources for the how-to.
71+
72+
1. Sign in to the Azure portal at [https://portal.azure.com](https://portal.azure.com).
73+
2. On the Azure portal menu, select **Resource groups** or search for and select *Resource groups* from any page. Then select **Create**.
74+
4. For **Subscription**, select your subscription.
75+
1. For **Resource group name**, enter *Test-FW-RG*.
76+
1. For **Region**, select a region. All other resources that you create must be in the same region.
77+
1. Select **Review + create**.
78+
1. Select **Create**.
79+
80+
## Deploy the firewall and policy
81+
82+
Deploy the firewall and create associated network infrastructure.
83+
84+
1. On the Azure portal menu or from the **Home** page, select **Create a resource**.
85+
2. Type **firewall** in the search box and press **Enter**.
86+
3. Select **Firewall** and then select **Create**.
87+
4. On the **Create a Firewall** page, use the following table to configure the firewall:
88+
89+
|Setting |Value |
90+
|---------|---------|
91+
|Subscription |\<your subscription\>|
92+
|Resource group |**Test-FW-RG** |
93+
|Name |**Test-FW01**|
94+
|Region |Select the same location that you used previously|
95+
|Firewall Tier|**Basic (Preview)**|
96+
|Firewall management|**Use a Firewall Policy to manage this firewall**|
97+
|Firewall policy|**Add new**:<br>**fw-test-pol**<br>Your selected region<br>Policy tier should default to **Basic**
98+
|Choose a virtual network |**Create new**<br> Name: **Test-FW-VN**<br>Address space: **10.0.0.0/16**<br>Subnet address space: **10.0.0.0/26**|
99+
|Public IP address |**Add new**:<br>**Name**: **fw-pip**|
100+
|Management - Subnet address space| **10.0.1.0/26**|
101+
|Management public IP address| **Add new**<br>**fw-mgmt-pip**
102+
103+
5. Accept the other default values, then select **Review + create**.
104+
6. Review the summary, and then select **Create** to create the firewall.
105+
106+
This will take a few minutes to deploy.
107+
7. After deployment completes, go to the **Test-FW-RG** resource group, and select the **Test-FW01** firewall.
108+
8. Note the firewall private and public IP (fw-pip) addresses. You'll use these addresses later.
109+
110+
## Create a subnet for the workload server
111+
112+
Next, create a subnet for the workload server.
113+
114+
1. Go to the Test-FW-RG resource group and select the **Test-FW-VN** virtual network.
115+
1. Select **Subnets**.
116+
1. Select **Subnet**.
117+
1. For **Subnet name**, type **Workload-SN**.
118+
1. For **Subnet address range**, type **10.0.2.0/24**.
119+
1. Select **Save**.
120+
121+
## Create a virtual machine
122+
123+
Now create the workload virtual machine, and place it in the **Workload-SN** subnet.
124+
125+
1. On the Azure portal menu or from the **Home** page, select **Create a resource**.
126+
2. Select **Windows Server 2019 Datacenter**.
127+
4. Enter these values for the virtual machine:
128+
129+
|Setting |Value |
130+
|---------|---------|
131+
|Resource group |**Test-FW-RG**|
132+
|Virtual machine name |**Srv-Work**|
133+
|Region |Same as previous|
134+
|Image|Windows Server 2019 Datacenter|
135+
|Administrator user name |Type a user name|
136+
|Password |Type a password|
137+
138+
4. Under **Inbound port rules**, **Public inbound ports**, select **None**.
139+
6. Accept the other defaults and select **Next: Disks**.
140+
7. Accept the disk defaults and select **Next: Networking**.
141+
8. Make sure that **Test-FW-VN** is selected for the virtual network and the subnet is **Workload-SN**.
142+
9. For **Public IP**, select **None**.
143+
11. Accept the other defaults and select **Next: Management**.
144+
1. Select **Next: Monitoring**.
145+
1. Select **Disable** to disable boot diagnostics. Accept the other defaults and select **Review + create**.
146+
1. Review the settings on the summary page, and then select **Create**.
147+
1. After the deployment completes, select the **Srv-Work** resource and note the private IP address for later use.
148+
149+
## Create a default route
150+
151+
For the **Workload-SN** subnet, configure the outbound default route to go through the firewall.
152+
153+
1. On the Azure portal menu, select **All services** or search for and select *All services* from any page.
154+
2. Under **Networking**, select **Route tables**.
155+
3. Select **Create**.
156+
5. For **Subscription**, select your subscription.
157+
6. For **Resource group**, select **Test-FW-RG**.
158+
7. For **Region**, select the same location that you used previously.
159+
4. For **Name**, type **Firewall-route**.
160+
1. Select **Review + create**.
161+
1. Select **Create**.
162+
163+
After deployment completes, select **Go to resource**.
164+
165+
1. On the Firewall-route page, select **Subnets** and then select **Associate**.
166+
1. Select **Virtual network** > **Test-FW-VN**.
167+
1. For **Subnet**, select **Workload-SN**. Make sure that you select only the **Workload-SN** subnet for this route, otherwise your firewall won't work correctly.
168+
169+
13. Select **OK**.
170+
14. Select **Routes** and then select **Add**.
171+
15. For **Route name**, type **fw-dg**.
172+
1. For **Address prefix destination**, select **IP Addresses**.
173+
1. For **Destination IP addresses/CIDR ranges**, type **0.0.0.0/0**.
174+
1. For **Next hop type**, select **Virtual appliance**.
175+
176+
Azure Firewall is actually a managed service, but virtual appliance works in this situation.
177+
18. For **Next hop address**, type the private IP address for the firewall that you noted previously.
178+
19. Select **Add**.
179+
180+
## Configure an application rule
181+
182+
This is the application rule that allows outbound access to `www.google.com`.
183+
184+
1. Open the **Test-FW-RG**, and select the **fw-test-pol** firewall policy.
185+
1. Select **Application rules**.
186+
1. Select **Add a rule collection**.
187+
1. For **Name**, type **App-Coll01**.
188+
1. For **Priority**, type **200**.
189+
1. For **Rule collection action**, select **Allow**.
190+
1. Under **Rules**, for **Name**, type **Allow-Google**.
191+
1. For **Source type**, select **IP address**.
192+
1. For **Source**, type **10.0.2.0/24**.
193+
1. For **Protocol:port**, type **http, https**.
194+
1. For **Destination Type**, select **FQDN**.
195+
1. For **Destination**, type **`www.google.com`**
196+
1. Select **Add**.
197+
198+
Azure Firewall includes a built-in rule collection for infrastructure FQDNs that are allowed by default. These FQDNs are specific for the platform and can't be used for other purposes. For more information, see [Infrastructure FQDNs](infrastructure-fqdns.md).
199+
200+
## Configure a network rule
201+
202+
This is the network rule that allows outbound access to two IP addresses at port 53 (DNS).
203+
204+
1. Select **Network rules**.
205+
2. Select **Add a rule collection**.
206+
3. For **Name**, type **Net-Coll01**.
207+
4. For **Priority**, type **200**.
208+
5. For **Rule collection action**, select **Allow**.
209+
1. For **Rule collection group**, select **DefaultNetworkRuleCollectionGroup**.
210+
1. Under **Rules**, for **Name**, type **Allow-DNS**.
211+
1. For **Source type**, select **IP Address**.
212+
1. For **Source**, type **10.0.2.0/24**.
213+
1. For **Protocol**, select **UDP**.
214+
1. For **Destination Ports**, type **53**.
215+
1. For **Destination type** select **IP address**.
216+
1. For **Destination**, type **209.244.0.3,209.244.0.4**.<br>These are public DNS servers operated by Level3.
217+
2. Select **Add**.
218+
219+
## Configure a DNAT rule
220+
221+
This rule allows you to connect a remote desktop to the Srv-Work virtual machine through the firewall.
222+
223+
1. Select the **DNAT rules**.
224+
2. Select **Add a rule collection**.
225+
3. For **Name**, type **rdp**.
226+
1. For **Priority**, type **200**.
227+
1. For **Rule collection group**, select **DefaultDnatRuleCollectionGroup**.
228+
1. Under **Rules**, for **Name**, type **rdp-nat**.
229+
1. For **Source type**, select **IP address**.
230+
1. For **Source**, type **\***.
231+
1. For **Protocol**, select **TCP**.
232+
1. For **Destination Ports**, type **3389**.
233+
1. For **Destination Type**, select **IP Address**.
234+
1. For **Destination**, type the firewall public IP address (fw-pip).
235+
1. For **Translated address**, type the **Srv-work** private IP address.
236+
1. For **Translated port**, type **3389**.
237+
1. Select **Add**.
238+
239+
240+
### Change the primary and secondary DNS address for the **Srv-Work** network interface
241+
242+
For testing purposes in this how-to, configure the server's primary and secondary DNS addresses. This isn't a general Azure Firewall requirement.
243+
244+
1. On the Azure portal menu, select **Resource groups** or search for and select *Resource groups* from any page. Select the **Test-FW-RG** resource group.
245+
2. Select the network interface for the **Srv-Work** virtual machine.
246+
3. Under **Settings**, select **DNS servers**.
247+
4. Under **DNS servers**, select **Custom**.
248+
5. Type **209.244.0.3** in the **Add DNS server** text box, and **209.244.0.4** in the next text box.
249+
6. Select **Save**.
250+
7. Restart the **Srv-Work** virtual machine.
251+
252+
## Test the firewall
253+
254+
Now, test the firewall to confirm that it works as expected.
255+
256+
1. Connect a remote desktop to firewall public IP address (fw-pip) and sign in to the **Srv-Work** virtual machine.
257+
3. Open Internet Explorer and browse to `https://www.google.com`.
258+
4. Select **OK** > **Close** on the Internet Explorer security alerts.
259+
260+
You should see the Google home page.
261+
262+
5. Browse to `http://www.microsoft.com`.
263+
264+
You should be blocked by the firewall.
265+
266+
So now you've verified that the firewall rules are working:
267+
268+
* You can connect a remote desktop to the Srv-Work virtual machine.
269+
* You can browse to the one allowed FQDN, but not to any others.
270+
* You can resolve DNS names using the configured external DNS server.
271+
272+
## Clean up resources
273+
274+
You can keep your firewall resources for further testing, or if no longer needed, delete the **Test-FW-RG** resource group to delete all firewall-related resources.
275+
276+
## Next steps
277+
278+
> [!div class="nextstepaction"]
279+
> [Deploy and configure Azure Firewall Premium](premium-deploy.md)

‎articles/firewall/index.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,10 @@ landingContent:
7070
url: tutorial-hybrid-portal-policy.md
7171
- text: Filter inbound traffic
7272
url: tutorial-firewall-dnat-policy.md
73+
- linkListType: how-to-guide
74+
links:
75+
- text: Deploy Firewall Basic
76+
url: deploy-firewall-basic-portal-policy.md
7377

7478
# Card
7579
- title: Integrate with Load Balancer

‎articles/firewall/media/overview/firewall-basic-diagram.png

50.9 KB
Loading

‎articles/firewall/overview.md

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ms.service: firewall
77
services: firewall
88
ms.topic: overview
99
ms.custom: mvc, contperf-fy21q1
10-
ms.date: 06/17/2022
10+
ms.date: 09/26/2022
1111

1212
# Customer intent: As an administrator, I want to evaluate Azure Firewall so I can determine if I want to use it.
1313
---
@@ -18,7 +18,8 @@ ms.date: 06/17/2022
1818

1919
Azure Firewall is a cloud-native and intelligent network firewall security service that provides the best of breed threat protection for your cloud workloads running in Azure. It's a fully stateful, firewall as a service with built-in high availability and unrestricted cloud scalability. It provides both east-west and north-south traffic inspection.
2020

21-
Azure Firewall is offered in two SKUs: Standard and Premium.
21+
Azure Firewall is offered in three SKUs: Standard, Premium, and Basic.
22+
2223

2324
## Azure Firewall Standard
2425

@@ -38,6 +39,24 @@ To learn about Firewall Standard features, see [Azure Firewall Standard features
3839

3940
To learn about Firewall Premium features, see [Azure Firewall Premium features](premium-features.md).
4041

42+
## Azure Firewall Basic (preview)
43+
44+
> [!IMPORTANT]
45+
> Azure Firewall Basic is currently in PREVIEW.
46+
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
47+
48+
Azure Firewall Basic is intended for small and medium size (SMB) customers to secure their Azure cloud
49+
environments. It provides the essential protection SMB customers need at an affordable price point.
50+
51+
:::image type="content" source="media/overview/firewall-basic-diagram.png" alt-text="Diagram showing Firewall Basic.":::
52+
53+
Azure Firewall Basic is similar to Firewall Standard, but has the following limitations:
54+
55+
- Supports Threat Intel *alert mode* only.
56+
- Fixed scale unit to run the service on two virtual machine backend instances.
57+
- Recommended for environments with maximum throughput of 250 Mbps. The throughput may increase for feature general availability (GA).
58+
59+
To deploy a Basic Firewall, see [Deploy and configure Azure Firewall Basic (preview) and policy using the Azure portal](deploy-firewall-basic-portal-policy.md).
4160

4261
## Azure Firewall Manager
4362

‎articles/firewall/toc.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,8 @@ items:
9999
href: tutorial-firewall-deploy-portal.md
100100
- name: Deploy in hybrid network - classic
101101
href: tutorial-hybrid-portal.md
102+
- name: Deploy Firewall Basic
103+
href: deploy-firewall-basic-portal-policy.md
102104
- name: Filter inbound traffic with DNAT - classic
103105
href: tutorial-firewall-dnat.md
104106
- name: Deploy using Azure PowerShell

0 commit comments

Comments
 (0)