You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The examples in the Azure Firewall articles assume that you have already enabled the Azure Firewall public preview. For more information, see [Enable the Azure Firewall public preview](public-preview.md).
19
-
20
16
This template creates a firewall and a test network environment. The network has one VNet, with three subnets: *AzureFirewallSubnet*, *ServersSubnet*, and a *JumpboxSubnet*. The ServersSubnet and JumpboxSubnet each have one 2-core Windows Server in them.
21
17
22
18
The firewall is in the AzureFirewallSubnet and is configured with an Application Rule Collection with a single rule that allows access to www.microsoft.com.
description: Learn about the FQDN tags in Azure Firewall
4
+
services: firewall
5
+
author: vhorne
6
+
ms.service: firewall
7
+
ms.topic: article
8
+
ms.date: 9/24/2018
9
+
ms.author: victorh
10
+
---
11
+
12
+
# FQDN tags overview
13
+
14
+
A FQDN tag represents a group of fully qualified domain names (FQDNs) associated with well known Microsoft services. You can use a FQDN tag in application rules to allow the required outbound network traffic through your firewall.
15
+
16
+
>[!NOTE]
17
+
>The FQDN tags feature is currently available in Azure PowerShell and REST only.
18
+
19
+
For example, to manually allow Windows Update network traffic through your firewall, you need to create multiple application rules per the Microsoft documentation. Using FQDN tags, you can create an application rule, include the **Windows Updates** tag, and now network traffic to Microsoft Windows Update endpoints can flow through your firewall.
20
+
21
+
You can't create your own FQDN tags, nor can you specify which FQDNs are included within a tag. Microsoft manages the FQDNs encompassed by the FQDN tag, and updates the tag as FQDNs change.
22
+
23
+
<!--- screenshot of application rule with a FQDN tag.-->
24
+
25
+
The following table shows the current FQDN tags you can use. Microsoft maintains these tags and you can expect additional tags to be added periodically.
26
+
27
+
|FQDN tag |Description |
28
+
|---------|---------|
29
+
|Windows Update |Allow outbound access to Microsoft Update as described in [How to Configure a Firewall for Software Updates](https://technet.microsoft.com/library/bb693717.aspx).|
30
+
|Windows Diagnostics|Allow outbound access to all [Windows Diagnostics endpoints](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization#endpoints).|
31
+
|Microsoft Active Protection Service (MAPS)|Allow outbound access to [MAPS](https://cloudblogs.microsoft.com/enterprisemobility/2016/05/31/important-changes-to-microsoft-active-protection-service-maps-endpoint/).|
32
+
|App Service Environment (ASE)|Allows outbound access to ASE platform traffic. This tag doesn’t cover customer-specific Storage and SQL endpoints created by ASE. These should be enabled via [Service Endpoints](../virtual-network/tutorial-restrict-network-access-to-resources.md) or added manually.|
33
+
|Azure Backup|Allows outbound access to the Azure Backup services.
34
+
35
+
## Next steps
36
+
37
+
To learn how to deploy an Azure Firewall, see [Tutorial: Deploy and configure Azure Firewall using the Azure portal](tutorial-firewall-deploy-portal.md).
Copy file name to clipboardExpand all lines: articles/firewall/index.yml
+3-1Lines changed: 3 additions & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -8,7 +8,7 @@ metadata:
8
8
author: vhorne
9
9
ms.service: firewall
10
10
ms.topic: landing-page
11
-
ms.date: 7/11/2018
11
+
ms.date: 9/24/2018
12
12
ms.author: victorh
13
13
abstract:
14
14
description: Learn how to deploy Azure Firewall, a cloud-based network security service. Tutorials, API references, and other documentation show you how to set up application-level and network-level policies to protect your Azure virtual network resources.
@@ -21,6 +21,8 @@ sections:
21
21
style: unordered
22
22
items:
23
23
- html: <a href="/azure/firewall/tutorial-firewall-deploy-portal">Deploy and configure Azure Firewall using the Azure portal</a>
24
+
- html: <a href="/azure/firewall/tutorial-hybrid-ps">Deploy in a hybrid network</a>
25
+
- html: <a href="/azure/firewall/tutorial-firewall-dnat">Filter inbound traffic with DNAT</a>
description: Learn about infrastructure FQDNs in Azure Firewall
4
+
services: firewall
5
+
author: vhorne
6
+
ms.service: firewall
7
+
ms.topic: article
8
+
ms.date: 9/24/2018
9
+
ms.author: victorh
10
+
---
11
+
12
+
# Infrastructure FQDNs
13
+
14
+
Azure Firewall includes a built-in rule collection for infrastructure FQDNs that are allowed by default. These FQDNs are specific for the platform and can't be used for other purposes.
15
+
16
+
The following services are included in the built-in rule collection:
17
+
18
+
- Compute access to storage Platform Image Repository (PIR)
19
+
- Managed disks status storage access
20
+
- Azure Diagnostics and Logging (MDS)
21
+
- Azure Active Directory
22
+
23
+
## Overriding
24
+
25
+
You can override this built-in infrastructure rule collection by creating a deny all application rule collection that is processed last. It will always be processed before the infrastructure rule collection. Anything not in the infrastructure rule collection is denied by default.
26
+
27
+
## Next steps
28
+
29
+
- Learn how to [deploy and configure an Azure Firewall](tutorial-firewall-deploy-portal.md).
description: This article is an overview of the Azure Firewall diagnostic logs.
4
+
services: firewall
5
+
author: vhorne
6
+
ms.service: firewall
7
+
ms.topic: article
8
+
ms.date: 9/24/2018
9
+
ms.author: victorh
10
+
---
11
+
12
+
# Azure Firewall logs
13
+
14
+
You can monitor Azure Firewall using firewall logs. You can also use activity logs to audit operations on Azure Firewall resources.
15
+
16
+
You can access some of these logs through the portal. Logs can be sent to [Log Analytics](../log-analytics/log-analytics-azure-networking-analytics.md), Storage, and Event Hubs and analyzed in Log Analytics or by different tools such as Excel and Power BI.
17
+
18
+
## Diagnostic logs
19
+
20
+
The following diagnostic logs are available for Azure Firewall:
21
+
22
+
***Application rule log**
23
+
24
+
The Application rule log is saved to a storage account, streamed to Event hubs and/or sent to Log Analytics only if you have enabled it for each Azure Firewall. Each new connection that matches one of your configured application rules results in a log for the accepted/denied connection. The data is logged in JSON format, as shown in the following example:
25
+
26
+
```
27
+
Category: application rule logs.
28
+
Time: log timestamp.
29
+
Properties: currently contains the full message.
30
+
note: this field will be parsed to specific fields in the future, while maintaining backward compatibility with the existing properties field.
"msg": "HTTPS request from 10.1.0.5:55640 to mydestination.com:443. Action: Allow. Rule Collection: collection1000. Rule: rule1002"
41
+
}
42
+
}
43
+
```
44
+
45
+
***Network rule log**
46
+
47
+
The Network rule log is saved to a storage account, streamed to Event hubs and/or sent Log Analytics only if you have enabled it for each Azure Firewall. Each new connection that matches one of your configured network rules results in a log for the accepted/denied connection. The data is logged in JSON format, as shown in the following example:
48
+
49
+
```
50
+
Category: network rule logs.
51
+
Time: log timestamp.
52
+
Properties: currently contains the full message.
53
+
note: this field will be parsed to specific fields in the future, while maintaining backward compatibility with the existing properties field.
"msg": "TCP request from 111.35.136.173:12518 to 13.78.143.217:2323. Action: Deny"
64
+
}
65
+
}
66
+
67
+
```
68
+
69
+
You have three options for storing your logs:
70
+
71
+
***Storage account**: Storage accounts are best used for logs when logs are stored for a longer duration and reviewed when needed.
72
+
***Event hubs**: Event hubs are a great option for integrating with other security information and event management (SEIM) tools to get alerts on your resources.
73
+
***Log Analytics**: Log Analytics is best used for general real-time monitoring of your application or looking at trends.
74
+
75
+
## Activity logs
76
+
77
+
Activity log entries are collected by default, and you can view them in the Azure portal.
78
+
79
+
You can use [Azure activity logs](../azure-resource-manager/resource-group-audit.md) (formerly known as operational logs and audit logs) to view all operations that are submitted to your Azure subscription.
80
+
81
+
82
+
## Next steps
83
+
84
+
To learn how to monitor Azure Firewall logs and metrics, see [Tutorial: Monitor Azure Firewall logs](tutorial-diagnostics.md).
Copy file name to clipboardExpand all lines: articles/firewall/overview.md
+16-12Lines changed: 16 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,60 +6,64 @@ ms.service: firewall
6
6
services: firewall
7
7
ms.topic: overview
8
8
ms.custom: mvc
9
-
ms.date: 7/16/2018
9
+
ms.date: 9/24/2018
10
10
ms.author: victorh
11
11
#Customer intent: As an administrator, I want to evaluate Azure Firewall so I can determine if I want to use it.
12
12
---
13
13
# What is Azure Firewall?
14
14
15
15
Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources. It is a fully stateful firewall as a service with built-in high availability and unrestricted cloud scalability.
You can centrally create, enforce, and log application and network connectivity policies across subscriptions and virtual networks. Azure Firewall uses a static public IP address for your virtual network resources allowing outside firewalls to identify traffic originating from your virtual network. The service is fully integrated with Azure Monitor for logging and analytics.
24
20
25
21
## Features
26
22
27
-
The Azure Firewall public preview offers the following features:
23
+
Azure Firewall offers the following features:
28
24
29
25
### Built-in high availability
30
26
High availability is built in, so no additional load balancers are required and there is nothing you need to configure.
31
27
32
28
### Unrestricted cloud scalability
33
29
Azure Firewall can scale up as much as you need to accommodate changing network traffic flows, so you don't need to budget for your peak traffic.
34
30
35
-
### FQDN filtering
31
+
### Application FQDN filtering rules
32
+
36
33
You can limit outbound HTTP/S traffic to a specified list of fully qualified domain names (FQDN) including wild cards. This feature does not require SSL termination.
37
34
38
35
### Network traffic filtering rules
39
36
40
37
You can centrally create *allow* or *deny* network filtering rules by source and destination IP address, port, and protocol. Azure Firewall is fully stateful, so it can distinguish legitimate packets for different types of connections. Rules are enforced and logged across multiple subscriptions and virtual networks.
41
38
39
+
### FQDN tags
40
+
41
+
FQDN tags make it easy for you to allow well known Azure service network traffic through your firewall. For example, say you want to allow Windows Update network traffic through your firewall. You create an application rule and include the Windows Update tag. Now network traffic from Windows Update can flow through your firewall.
42
+
42
43
### Outbound SNAT support
43
44
44
45
All outbound virtual network traffic IP addresses are translated to the Azure Firewall public IP (Source Network Address Translation). You can identify and allow traffic originating from your virtual network to remote Internet destinations.
45
46
47
+
### Inbound DNAT support
48
+
49
+
Inbound network traffic to your firewall public IP address is translated (Destination Network Address Translation) and filtered to the private IP addresses on your virtual networks.
50
+
46
51
### Azure Monitor logging
47
52
48
53
All events are integrated with Azure Monitor, allowing you to archive logs to a storage account, stream events to your Event Hub, or send them to Log Analytics.
49
54
50
55
## Known issues
51
56
52
-
The Azure Firewall public preview has the following known issues:
57
+
Azure Firewall has the following known issues:
53
58
54
59
55
60
|Issue |Description |Mitigation |
56
61
|---------|---------|---------|
57
-
|Interoperability with NSGs |If a network security group (NSG) is applied on the firewall subnet, it may block outbound Internet connectivity even if the NSG is configured to allow outbound internet access. Outbound Internet connections are marked as coming from a VirtualNetwork and the destination is Internet. An NSG has VirtualNetwork to VirtualNetwork *allow* by default, but not when destination is Internet.|To mitigate, add the following inbound rule to the NSG that is applied on the firewall subnet:<br><br>Source: VirtualNetwork Source ports: Any <br><br>Destination: Any Destination Ports: Any <br><br>Protocol: All Access: Allow|
58
62
|Conflict with Azure Security Center (ASC) Just-in-Time (JIT) feature|If a virtual machine is accessed using JIT, and is in a subnet with a user-defined route that points to Azure Firewall as a default gateway, ASC JIT doesn’t work. This is a result of asymmetric routing – a packet comes in via the virtual machine public IP (JIT opened the access), but the return path is via the firewall, which drops the packet because no session is established on the firewall.|To work around this issue, place the JIT virtual machines on a separate subnet that doesn’t have a user-defined route to the firewall.|
59
63
|Hub and spoke with global peering doesn’t work|The hub and spoke model, where the hub and firewall are deployed in one Azure region, with the spokes in another Azure region, connected to the hub via Global VNet Peering is not supported.|For more information, see [Create, change, or delete a virtual network peering](https://docs.microsoft.com/azure/virtual-network/virtual-network-manage-peering#requirements-and-constraints)|
60
-
Network filtering rules for non-TCP/UDP protocols (for example ICMP) don't work for Internet bound traffic|Network filtering rules for non-TCP/UDP protocols don’t work with SNAT to your public IP address. Non-TCP/UDP protocols are supported between spoke subnets and VNets.|Azure Firewall uses the Standard Load Balancer, [which doesn't support SNAT for IP protocols today](https://docs.microsoft.com/azure/load-balancer/load-balancer-standard-overview#limitations). We are exploring options to support this scenario in a future release.
61
-
62
-
64
+
Network filtering rules for non-TCP/UDP protocols (for example ICMP) don't work for Internet bound traffic|Network filtering rules for non-TCP/UDP protocols don’t work with SNAT to your public IP address. Non-TCP/UDP protocols are supported between spoke subnets and VNets.|Azure Firewall uses the Standard Load Balancer, [which doesn't support SNAT for IP protocols today](https://docs.microsoft.com/azure/load-balancer/load-balancer-standard-overview#limitations). We are exploring options to support this scenario in a future release.|
65
+
|Destination NAT (DNAT) doesn’t work for port 80 and 22.|Destination Port field in NAT rule collection cannot include port 80 or port 22.|We are working to fix this in the near future. Meanwhile, use any other port as the destination port in NAT rules. Port 80 or 22 can still be used as the translated port (for example, you can map public ip:81 to private ip:80).|
The examples in the Azure Firewall articles assume that you have already enabled the Azure Firewall public preview. For more information, see [Enable the Azure Firewall public preview](../public-preview.md).
18
-
19
15
This script sample creates a firewall and a test network environment. The network has one VNet, with three subnets: an *AzureFirewallSubnet*, and *ServersSubnet*, and a *JumpboxSubnet*. The ServersSubnet and JumpboxSubnet each have one 2-core Windows Server in them.
20
16
21
17
The firewall is in the AzureFirewallSubnet and is configured with an Application Rule Collection with a single rule that allows access to www.microsoft.com.
@@ -24,7 +20,7 @@ A user defined route is created that points the network traffic from the Servers
24
20
25
21
You can run the script from the Azure [Cloud Shell](https://shell.azure.com/powershell), or from a local PowerShell installation.
26
22
27
-
If you run PowerShell locally, this script requires the AzureRM PowerShell module version 6.4.0 or later. To find the installed version, run `Get-Module -ListAvailable AzureRM`.
23
+
If you run PowerShell locally, this script requires the latest AzureRM PowerShell module version. To find the installed version, run `Get-Module -ListAvailable AzureRM`.
28
24
29
25
You can use `PowerShellGet` if you need to upgrade, which is built into Windows 10 and Windows Server 2016.
30
26
@@ -36,12 +32,6 @@ For more information, see [Install Azure PowerShell on Windows with PowerShellGe
36
32
37
33
Any existing Azure PowerShell installation done with the Web Platform installer will conflict with the PowerShellGet installation and needs to be removed.
38
34
39
-
Additionally, you must install the preview version of AzureRM.Network (version 6.4.0). If have an older module, run `Uninstall-Module AzureRM.Network -Force` to remove it. Then run:
0 commit comments