some copy edits

Author: vhorne

articles/firewall/firewall-best-practices.md

@@ -5,7 +5,7 @@ services: firewall
 author: vhorne
 ms.service: firewall
 ms.topic: conceptual
-ms.date: 11/16/2023
+ms.date: 11/17/2023
 ms.author: victorh
 ---
 
@@ -17,7 +17,7 @@ To maximize the [performance](firewall-performance.md) of your Azure Firewall an
 
 - **Exceeding rule limitations**
 
-   If you exceed limitations, such as using over 20,000 unique source/destination combinations in rules, can affect firewall traffic processing and cause latency. Even though this is a soft limit, if you surpass this value it can affect overall firewall performance. For more information, see the [documented limits](../nat-gateway/tutorial-hub-spoke-nat-firewall.md).
+   If you exceed limitations, such as using over 20,000 unique source/destination combinations in rules, it can affect firewall traffic processing and cause latency. Even though this is a soft limit, if you surpass this value it can affect overall firewall performance. For more information, see the [documented limits](../nat-gateway/tutorial-hub-spoke-nat-firewall.md).
 
 - **High traffic throughput**
 
@@ -39,16 +39,16 @@ To maximize the [performance](firewall-performance.md) of your Azure Firewall an
    - Use [IP Groups](ip-groups.md) or IP prefixes to reduce the number of IP table rules.
    - Prioritize rules with the highest number of hits.
    - Ensure that you are within the following [rule limitations](../nat-gateway/tutorial-hub-spoke-nat-firewall.md).
-- **Use or migrate to Azure Firewall Premium version**
-   - The Azure Firewall Premium version uses advanced hardware and offers a higher-performing underlying engine.
+- **Use or migrate to Azure Firewall Premium**
+   - Azure Firewall Premium uses advanced hardware and offers a higher-performing underlying engine.
    - Best for heavier workloads and higher traffic volumes. 
    - It also includes built-in accelerated networking software, which can achieve throughput of up to 100 Gbps, unlike the Standard version.
 - **Add multiple public IP addresses to the firewall to prevent SNAT port exhaustion**
    - To prevent SNAT port exhaustion, consider adding multiple public IP addresses (PIPs) to your firewall. Azure Firewall provides [2,496 SNAT ports per each additional PIP](../nat-gateway/tutorial-hub-spoke-nat-firewall.md). 
    - If you prefer not to add more PIPs, you can add an Azure NAT Gateway to scale SNAT port usage. This provides advanced SNAT port allocation capabilities.
 - **Start with IDPS Alert mode before you enable Alert + Deny mode**
-   - While the Alert + Deny mode offers enhanced security by blocking suspicious traffic, it can also introduce more processing overhead. If you disable this mode, you might observe performance improvement, especially in scenarios where the firewall is primarily used for routing and not deep packet inspection.
-   - It's essential to remember that traffic through the firewall is denied by default until you explicitly configure *allow* rules. Therefore, even when IDPS Alert + Deny mode is disabled, your network remains protected, and only explicitly permitted traffic is allowed to pass through the firewall. It can be a strategic choice to disable this mode to optimize performance without compromising the core security features provided by the Azure Firewall.
+   - While the *Alert + Deny* mode offers enhanced security by blocking suspicious traffic, it can also introduce more processing overhead. If you disable this mode, you might observe performance improvement, especially in scenarios where the firewall is primarily used for routing and not deep packet inspection.
+   - It's essential to remember that traffic through the firewall is denied by default until you explicitly configure *allow* rules. Therefore, even when IDPS *Alert + Deny* mode is disabled, your network remains protected, and only explicitly permitted traffic is allowed to pass through the firewall. It can be a strategic choice to disable this mode to optimize performance without compromising the core security features provided by the Azure Firewall.
 
 ## Testing and monitoring
 
@@ -65,9 +65,9 @@ Use the following best practices for testing and monitoring:
 - **Measure data processed**
    - Keep track of the *data processed* metric to assess the volume of data processed by the firewall.
 - **Identify rule hits and performance spikes**
-   - Look for spikes in network performance or latency. Correlate rule hit timestamps, such as application rules hit count and network rules hit count, to determine if rule processing is a significant factor contributing to performance or latency issues. By analyzing these patterns, you can identify specific rules or configurations that might need optimization.
+   - Look for spikes in network performance or latency. Correlate rule hit timestamps, such as application rules hit count and network rules hit count, to determine if rule processing is a significant factor contributing to performance or latency issues. By analyzing these patterns, you can identify specific rules or configurations that you might need to optimize.
 - **Add alerts to key metrics**
-   - In addition to regular monitoring, it's crucial to set up alerts for key firewall metrics. This ensures that you're promptly notified when specific metrics surpass predefined thresholds. To configure alerts, see [Azure Firewall logs and metrics](logs-and-metrics.md#alert-on-azure-firewall-metrics) for detailed instructions on setting up effective alerting mechanisms. Proactive alerting enhances your ability to respond swiftly to potential issues and maintain optimal firewall performance.
+   - In addition to regular monitoring, it's crucial to set up alerts for key firewall metrics. This ensures that you're promptly notified when specific metrics surpass predefined thresholds. To configure alerts, see [Azure Firewall logs and metrics](logs-and-metrics.md#alert-on-azure-firewall-metrics) for detailed instructions about setting up effective alerting mechanisms. Proactive alerting enhances your ability to respond swiftly to potential issues and maintain optimal firewall performance.
 
 ## Next steps