freshness review - March 2025

Author: duongau

articles/firewall/policy-rule-sets.md

@@ -5,56 +5,56 @@ services: firewall
 author: duongau
 ms.service: azure-firewall
 ms.topic: concept-article
-ms.date: 05/09/2024
+ms.date: 03/17/2025
 ms.author: duau
 ---
 
 # Azure Firewall Policy rule sets
 
-Firewall Policy is a top-level resource that contains security and operational settings for Azure Firewall. You can use Firewall Policy to manage rule sets that the Azure Firewall uses to filter traffic. Firewall policy organizes, prioritizes, and processes the rule sets based on a hierarchy with the following components: rule collection groups, rule collections, and rules.
+Firewall Policy is a top-level resource that contains security and operational settings for Azure Firewall. It allows you to manage rule sets that Azure Firewall uses to filter traffic. Firewall Policy organizes, prioritizes, and processes rule sets based on a hierarchy with the following components: rule collection groups, rule collections, and rules.
 
 :::image type="content" source="media/policy-rule-sets/policy-rule-sets.png" alt-text="Azure Policy rule set hierarchy":::
 
 ## Rule collection groups
 
-A rule collection group is used to group rule collections. They're the first unit that the firewall processes, and they follow a priority order based on values. There are three default rule collection groups, and their priority values are preset by design. They're processed in the following order:
+A rule collection group is used to group rule collections. It is the first unit processed by the firewall and follows a priority order based on values. There are three default rule collection groups with preset priority values, processed in the following order:
 
+| Rule collection group name | Priority |
+|----------------------------|----------|
+| Default DNAT (Destination Network Address Translation) rule collection group | 100 |
+| Default Network rule collection group | 200 |
+| Default Application rule collection group | 300 |
 
-|Rule collection group name  |Priority  |
-|---------|---------|
-|Default DNAT (Destination Network Address Translation) rule collection group      |100|
-|Default Network rule collection group      |200|
-|Default Application rule collection group      |300|
+Although you cannot delete the default rule collection groups or modify their priority values, you can change the processing order by creating custom rule collection groups with your desired priority values. In this case, you would not use the default rule collection groups and instead use only the custom ones to define the processing logic.
 
-Even though you can't delete the default rule collection groups nor modify their priority values, you can manipulate their processing order in a different way. If you need to define a priority order that is different than the default design, you can create custom rule collection groups with your wanted priority values. In this scenario, you don't use the default rule collection groups at all and use only the ones you create to customize the processing logic.  
-
-Rule collection groups contain one or multiple rule collections, which can be of type DNAT, network, or application. For example, you can group rules belonging to the same workloads or a virtual in a rule collection group. 
+Rule collection groups contain one or multiple rule collections, which can be of type DNAT, network, or application. For example, you can group rules belonging to the same workloads or a virtual network in a rule collection group.
 
 For rule collection group size limits, see [Azure subscription and service limits, quotas, and constraints](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-firewall-limits).
 
 
 ## Rule collections
 
-A rule collection belongs to a rule collection group, and it contains one or multiple rules. They're the second unit processed by the firewall and they follow a priority order based on values. Rule collections must have a defined action (allow or deny) and a priority value. The defined action applies to all the rules within the rule collection. The priority value determines order the rule collections are processed.
-  
+A rule collection belongs to a rule collection group and contains one or more rules. It is the second unit processed by the firewall and follows a priority order based on values. Each rule collection must have a defined action (allow or deny) and a priority value. The action applies to all rules within the collection, and the priority value determines the order in which the rule collections are processed.
+
 There are three types of rule collections:
 
 - DNAT
 - Network
 - Application
 
-Rule types must match their parent rule collection category. For example, a DNAT rule can only be part of a DNAT rule collection.
+The rule types must match their parent rule collection category. For example, a DNAT rule can only be part of a DNAT rule collection.
 
 ## Rules
 
-A rule belongs to a rule collection, and it specifies which traffic is allowed or denied in your network. They're the third unit that the firewall processes and they don't follow a priority order based on values. The processing logic for rules follows a top-down approach. The firewall uses defined rules to evaluate all traffic passing through the firewall to determine whether it matches an allow or deny condition. If there's no rule that allows the traffic, then the traffic is denied by default.
+A rule belongs to a rule collection and specifies which traffic is allowed or denied in your network. It is the third unit processed by the firewall and does not follow a priority order based on values. The firewall processes rules in a top-down approach, evaluating all traffic against the defined rules to determine if it matches an allow or deny condition. If no rule allows the traffic, it is denied by default.
 
 Our built-in [infrastructure rule collection](infrastructure-fqdns.md) processes traffic for application rules before denying it by default.
+
 ### Inbound vs. outbound
 
-An **inbound** firewall rule protects your network from threats that originate from outside your network (traffic sourced from the Internet) and attempts to infiltrate your network inwardly.
+An **inbound** firewall rule protects your network from threats originating outside your network (traffic sourced from the Internet) attempting to infiltrate inwardly.
 
-An **outbound** firewall rule protects against nefarious traffic that originates internally (traffic sourced from a private IP address within Azure) and travels outwardly. This is usually traffic from within Azure resources being redirected via the Firewall before reaching a destination.
+An **outbound** firewall rule protects against malicious traffic originating internally (traffic sourced from a private IP address within Azure) and traveling outwardly. This typically involves traffic from within Azure resources being redirected via the Firewall before reaching a destination.
 
 ### Rule types
 
@@ -66,21 +66,16 @@ There are three types of rules:
 
 #### DNAT rules
 
-DNAT rules allow or deny inbound traffic through one or more firewall public IP addresses. 
-You can use a DNAT rule when you want a public IP address to be translated into a private IP address. The Azure Firewall public IP addresses can be used to listen to inbound traffic from the Internet, filter the traffic and translate this traffic to internal resources in Azure.
+DNAT rules manage inbound traffic through one or more firewall public IP addresses. Use a DNAT rule to translate a public IP address into a private IP address. Azure Firewall public IP addresses can listen to inbound traffic from the Internet, filter it, and translate it to internal Azure resources.
 
 #### Network rules
 
-Network rules allow or deny inbound, outbound, and east-west traffic based on the network layer (L3) and transport layer (L4).  
-You can use a network rule when you want to filter traffic based on IP addresses, any ports, and any protocols.
-
+Network rules control inbound, outbound, and east-west traffic based on the network layer (L3) and transport layer (L4). Use a network rule to filter traffic based on IP addresses, ports, and protocols.
 
 #### Application rules
 
-Application rules allow or deny outbound and east-west traffic based on the application layer (L7). 
-You can use an application rule when you want to filter traffic based on fully qualified domain names (FQDNs), URLs, and HTTP/HTTPS protocols. 
-
+Application rules manage outbound and east-west traffic based on the application layer (L7). Use an application rule to filter traffic based on fully qualified domain names (FQDNs), URLs, and HTTP/HTTPS protocols.
 
 ## Next steps
 
-- Learn more about Azure Firewall rule processing: [Configure Azure Firewall rules](rule-processing.md).
+- To learn more about how Azure Firewall processes rules, see [Configure Azure Firewall rules](rule-processing.md).