Merge pull request #88204 from JackStromberg/patch-19

Verbiage about maintenance

Author: PRMerger14

articles/firewall/firewall-faq.md

@@ -146,6 +146,9 @@ If you configure ***.contoso.com**, it allows *anyvalue*.contoso.com, but not co
 
 Whenever a configuration change is applied, Azure Firewall attempts to update all its underlying backend instances. In rare cases, one of these backend instances may fail to update with the new configuration and the update process  stops with a failed provisioning state. Your Azure Firewall is still operational, but the applied configuration may be in an inconsistent state, where some instances have the previous configuration where others have the updated rule set. If this happens, try updating your configuration one more time until the operation succeeds and your Firewall is in a *Succeeded* provisioning state.
 
+### How does Azure Firewall handle planned maintenance and unplanned failures?
+Azure Firewall consists of several backend nodes in an active-active configuration.  For any planned maintenance, we have connection draining logic to gracefully update nodes.  Updates are planned during non-business hours for each of the Azure regions to further limit risk of disruption.  For unplanned issues, we instantiate a new node to replace the failed node.  Connectivity to the new node is typically reestablished within 10 seconds from the time of the failure.
+
 ## Is there a character limit for a firewall name?
 
 Yes. There is a 50 character limit for a firewall name.
@@ -156,4 +159,4 @@ Azure Firewall must provision more virtual machine instances as it scales. A /26
 
 ## Does the firewall subnet size need to change as the service scales?
 
-No. Azure Firewall does not need a subnet bigger than /26.
+No. Azure Firewall does not need a subnet bigger than /26.