Skip to content

Commit c142947

Browse files
PMEds28PMEds28
authored
Merge pull request #215007 from halkazwini/firewall
Azure Firewall: Freshness: Tutorial: Deploy and configure Azure Firewall and policy using the Azure portal
2 parents 5fe4f8e + bb7988c commit c142947

File tree

1 file changed

+96
-86
lines changed

1 file changed

+96
-86
lines changed

‎articles/firewall/tutorial-firewall-deploy-portal-policy.md

Lines changed: 96 additions & 86 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ services: firewall
55
author: vhorne
66
ms.service: firewall
77
ms.topic: tutorial
8-
ms.date: 08/26/2021
8+
ms.date: 10/18/2022
99
ms.author: victorh
1010
ms.custom: mvc
1111
#Customer intent: As an administrator new to this service, I want to control outbound network access from resources located in an Azure subnet.
@@ -24,13 +24,13 @@ Network traffic is subjected to the configured firewall rules when you route you
2424

2525
For this tutorial, you create a simplified single VNet with two subnets for easy deployment.
2626

27-
For production deployments, a [hub and spoke model](/azure/architecture/reference-architectures/hybrid-networking/hub-spoke) is recommended, where the firewall is in its own VNet. The workload servers are in peered VNets in the same region with one or more subnets.
28-
2927
* **AzureFirewallSubnet** - the firewall is in this subnet.
3028
* **Workload-SN** - the workload server is in this subnet. This subnet's network traffic goes through the firewall.
3129

3230
![Tutorial network infrastructure](media/tutorial-firewall-deploy-portal/tutorial-network.png)
3331

32+
For production deployments, a [hub and spoke model](/azure/architecture/reference-architectures/hybrid-networking/hub-spoke) is recommended, where the firewall is in its own VNet. The workload servers are in peered VNets in the same region with one or more subnets.
33+
3434
In this tutorial, you learn how to:
3535

3636
> [!div class="checklist"]
@@ -57,10 +57,14 @@ First, create a resource group to contain the resources needed to deploy the fir
5757
The resource group contains all the resources for the tutorial.
5858

5959
1. Sign in to the Azure portal at [https://portal.azure.com](https://portal.azure.com).
60-
2. On the Azure portal menu, select **Resource groups** or search for and select *Resource groups* from any page. Then select **Add**.
61-
4. For **Subscription**, select your subscription.
62-
1. For **Resource group name**, enter *Test-FW-RG*.
63-
1. For **Region**, select a region. All other resources that you create must be in the same region.
60+
1. On the Azure portal menu, select **Resource groups** or search for and select *Resource groups* from any page, then select **Add**. Enter or select the following values:
61+
62+
| Setting | Value |
63+
| -------- | ------ |
64+
| Subscription | Select your Azure subscription. |
65+
| Resource group | Enter *Test-FW-RG*. |
66+
| Region | Select a region. All other resources that you create must be in the same region. |
67+
6468
1. Select **Review + create**.
6569
1. Select **Create**.
6670

@@ -74,11 +78,15 @@ This VNet will have two subnets.
7478
1. On the Azure portal menu or from the **Home** page, select **Create a resource**.
7579
1. Select **Networking**.
7680
1. Search for **Virtual network** and select it.
77-
1. Select **Create**.
78-
1. For **Subscription**, select your subscription.
79-
1. For **Resource group**, select **Test-FW-RG**.
80-
1. For **Name**, type **Test-FW-VN**.
81-
1. For **Region**, select the same location that you used previously.
81+
1. Select **Create**, then enter or select the following values:
82+
83+
| Setting | Value |
84+
| -------- | ------ |
85+
| Subscription | Select your Azure subscription. |
86+
| Resource group | Select **Test-FW-RG**. |
87+
| Name | Enter *Test-FW-VN*. |
88+
| Region | Select the same location that you used previously. |
89+
8290
1. Select **Next: IP addresses**.
8391
1. For **IPv4 Address space**, accept the default **10.0.0.0/16**.
8492
1. Under **Subnet**, select **default**.
@@ -89,37 +97,37 @@ This VNet will have two subnets.
8997
Next, create a subnet for the workload server.
9098

9199
1. Select **Add subnet**.
92-
4. For **Subnet name**, type **Workload-SN**.
93-
5. For **Subnet address range**, type **10.0.2.0/24**.
94-
6. Select **Add**.
95-
7. Select **Review + create**.
96-
8. Select **Create**.
100+
1. For **Subnet name**, type **Workload-SN**.
101+
1. For **Subnet address range**, type **10.0.2.0/24**.
102+
1. Select **Add**.
103+
1. Select **Review + create**.
104+
1. Select **Create**.
97105

98106
### Create a virtual machine
99107

100108
Now create the workload virtual machine, and place it in the **Workload-SN** subnet.
101109

102110
1. On the Azure portal menu or from the **Home** page, select **Create a resource**.
103-
2. Select **Windows Server 2016 Datacenter**.
104-
4. Enter these values for the virtual machine:
105-
106-
|Setting |Value |
107-
|---------|---------|
108-
|Resource group |**Test-FW-RG**|
109-
|Virtual machine name |**Srv-Work**|
110-
|Region |Same as previous|
111-
|Image|Windows Server 2016 Datacenter|
112-
|Administrator user name |Type a user name|
113-
|Password |Type a password|
114-
115-
4. Under **Inbound port rules**, **Public inbound ports**, select **None**.
116-
6. Accept the other defaults and select **Next: Disks**.
117-
7. Accept the disk defaults and select **Next: Networking**.
118-
8. Make sure that **Test-FW-VN** is selected for the virtual network and the subnet is **Workload-SN**.
119-
9. For **Public IP**, select **None**.
120-
11. Accept the other defaults and select **Next: Management**.
121-
12. Select **Disable** to disable boot diagnostics. Accept the other defaults and select **Review + create**.
122-
13. Review the settings on the summary page, and then select **Create**.
111+
1. Select **Windows Server 2019 Datacenter**.
112+
1. Enter or select these values for the virtual machine:
113+
114+
| Setting | Value |
115+
| ------- | ----- |
116+
| Subscription | Select your Azure subscription. |
117+
| Resource group | Select **Test-FW-RG**. |
118+
| Virtual machine name | Enter *Srv-Work*.|
119+
| Region | Select the same location that you used previously. |
120+
| Username | Enter a username. |
121+
| Password | Enter a password. |
122+
123+
1. Under **Inbound port rules**, **Public inbound ports**, select **None**.
124+
1. Accept the other defaults and select **Next: Disks**.
125+
1. Accept the disk defaults and select **Next: Networking**.
126+
1. Make sure that **Test-FW-VN** is selected for the virtual network and the subnet is **Workload-SN**.
127+
1. For **Public IP**, select **None**.
128+
1. Accept the other defaults and select **Next: Management**.
129+
1. Select **Disable** to disable boot diagnostics. Accept the other defaults and select **Review + create**.
130+
1. Review the settings on the summary page, and then select **Create**.
123131
1. After the deployment completes, select the **Srv-Work** resource and note the private IP address for later use.
124132

125133
## Deploy the firewall and policy
@@ -131,16 +139,16 @@ Deploy the firewall into the VNet.
131139
3. Select **Firewall** and then select **Create**.
132140
4. On the **Create a Firewall** page, use the following table to configure the firewall:
133141

134-
|Setting |Value |
135-
|---------|---------|
136-
|Subscription |\<your subscription\>|
137-
|Resource group |**Test-FW-RG** |
138-
|Name |**Test-FW01**|
139-
|Region |Select the same location that you used previously|
140-
|Firewall management|**Use a Firewall Policy to manage this firewall**|
141-
|Firewall policy|**Add new**:<br>**fw-test-pol**<br>your selected region
142-
|Choose a virtual network |**Use existing**: **Test-FW-VN**|
143-
|Public IP address |**Add new**:<br>**Name**: **fw-pip**|
142+
| Setting | Value |
143+
| ------- | ----- |
144+
| Subscription | Select your Azure subscription. |
145+
| Resource group | Select **Test-FW-RG**. |
146+
| Name | Enter *Test-FW01*. |
147+
| Region | Select the same location that you used previously. |
148+
| Firewall management | Select **Use a Firewall Policy to manage this firewall**. |
149+
| Firewall policy | Select **Add new**, and enter *fw-test-pol*. <br> Select the same region that you used previously.
150+
| Choose a virtual network | Select **Use existing**, and then select **Test-FW-VN**. |
151+
| Public IP address | Select **Add new**, and enter *fw-pip* for the **Name**. |
144152

145153
5. Accept the other default values, then select **Review + create**.
146154
6. Review the summary, and then select **Create** to create the firewall.
@@ -154,47 +162,49 @@ Deploy the firewall into the VNet.
154162
For the **Workload-SN** subnet, configure the outbound default route to go through the firewall.
155163

156164
1. On the Azure portal menu, select **All services** or search for and select *All services* from any page.
157-
2. Under **Networking**, select **Route tables**.
158-
3. Select **Add**.
159-
5. For **Subscription**, select your subscription.
160-
6. For **Resource group**, select **Test-FW-RG**.
161-
7. For **Region**, select the same location that you used previously.
162-
4. For **Name**, type **Firewall-route**.
165+
1. Under **Networking**, select **Route tables**.
166+
1. Select **Create**, then enter or select the following values:
167+
168+
| Setting | Value |
169+
| ------- | ----- |
170+
| Subscription | Select your Azure subscription. |
171+
| Resource group | Select **Test-FW-RG**. |
172+
| Region | Select the same location that you used previously. |
173+
| Name | Enter *Firewall-route*. |
174+
163175
1. Select **Review + create**.
164176
1. Select **Create**.
165177

166178
After deployment completes, select **Go to resource**.
167179

168-
1. On the Firewall-route page, select **Subnets** and then select **Associate**.
180+
1. On the **Firewall-route** page, select **Subnets** and then select **Associate**.
169181
1. Select **Virtual network** > **Test-FW-VN**.
170182
1. For **Subnet**, select **Workload-SN**. Make sure that you select only the **Workload-SN** subnet for this route, otherwise your firewall won't work correctly.
171-
172-
13. Select **OK**.
173-
14. Select **Routes** and then select **Add**.
174-
15. For **Route name**, type **fw-dg**.
175-
16. For **Address prefix**, type **0.0.0.0/0**.
176-
17. For **Next hop type**, select **Virtual appliance**.
177-
183+
1. Select **OK**.
184+
1. Select **Routes** and then select **Add**.
185+
1. For **Route name**, enter *fw-dg*.
186+
1. For **Address prefix**, enter *0.0.0.0/0*.
187+
1. For **Next hop type**, select **Virtual appliance**.
178188
Azure Firewall is actually a managed service, but virtual appliance works in this situation.
179-
18. For **Next hop address**, type the private IP address for the firewall that you noted previously.
180-
19. Select **OK**.
189+
1. For **Next hop address**, enter the private IP address for the firewall that you noted previously.
190+
1. Select **OK**.
181191

182192
## Configure an application rule
183193

184194
This is the application rule that allows outbound access to `www.google.com`.
185195

186-
1. Open the **Test-FW-RG**, and select the **fw-test-pol** firewall policy.
196+
1. Open the **Test-FW-RG** resource group, and select the **fw-test-pol** firewall policy.
187197
1. Select **Application rules**.
188198
1. Select **Add a rule collection**.
189-
1. For **Name**, type **App-Coll01**.
190-
1. For **Priority**, type **200**.
199+
1. For **Name**, enter *App-Coll01*.
200+
1. For **Priority**, enter *200*.
191201
1. For **Rule collection action**, select **Allow**.
192-
1. Under **Rules**, for **Name**, type **Allow-Google**.
202+
1. Under **Rules**, for **Name**, enter *Allow-Google*.
193203
1. For **Source type**, select **IP address**.
194-
1. For **Source**, type **10.0.2.0/24**.
195-
1. For **Protocol:port**, type **http, https**.
204+
1. For **Source**, enter *10.0.2.0/24*.
205+
1. For **Protocol:port**, enter *http, https*.
196206
1. For **Destination Type**, select **FQDN**.
197-
1. For **Destination**, type **`www.google.com`**
207+
1. For **Destination**, enter *`www.google.com`*
198208
1. Select **Add**.
199209

200210
Azure Firewall includes a built-in rule collection for infrastructure FQDNs that are allowed by default. These FQDNs are specific for the platform and can't be used for other purposes. For more information, see [Infrastructure FQDNs](infrastructure-fqdns.md).
@@ -205,37 +215,37 @@ This is the network rule that allows outbound access to two IP addresses at port
205215

206216
1. Select **Network rules**.
207217
2. Select **Add a rule collection**.
208-
3. For **Name**, type **Net-Coll01**.
209-
4. For **Priority**, type **200**.
218+
3. For **Name**, enter *Net-Coll01*.
219+
4. For **Priority**, enter *200*.
210220
5. For **Rule collection action**, select **Allow**.
211221
1. For **Rule collection group**, select **DefaultNetworkRuleCollectionGroup**.
212-
1. Under **Rules**, for **Name**, type **Allow-DNS**.
222+
1. Under **Rules**, for **Name**, enter *Allow-DNS*.
213223
1. For **Source type**, select **IP Address**.
214-
1. For **Source**, type **10.0.2.0/24**.
224+
1. For **Source**, enter *10.0.2.0/24*.
215225
1. For **Protocol**, select **UDP**.
216-
1. For **Destination Ports**, type **53**.
226+
1. For **Destination Ports**, enter *53*.
217227
1. For **Destination type** select **IP address**.
218-
1. For **Destination**, type **209.244.0.3,209.244.0.4**.<br>These are public DNS servers operated by CenturyLink.
228+
1. For **Destination**, enter *209.244.0.3,209.244.0.4*.<br>These are public DNS servers operated by CenturyLink.
219229
2. Select **Add**.
220230

221231
## Configure a DNAT rule
222232

223-
This rule allows you to connect a remote desktop to the Srv-Work virtual machine through the firewall.
233+
This rule allows you to connect a remote desktop to the **Srv-Work** virtual machine through the firewall.
224234

225235
1. Select the **DNAT rules**.
226236
2. Select **Add a rule collection**.
227-
3. For **Name**, type **rdp**.
228-
1. For **Priority**, type **200**.
237+
3. For **Name**, enter *rdp*.
238+
1. For **Priority**, enter *200*.
229239
1. For **Rule collection group**, select **DefaultDnatRuleCollectionGroup**.
230-
1. Under **Rules**, for **Name**, type **rdp-nat**.
240+
1. Under **Rules**, for **Name**, enter *rdp-nat*.
231241
1. For **Source type**, select **IP address**.
232-
1. For **Source**, type **\***.
242+
1. For **Source**, enter *\**.
233243
1. For **Protocol**, select **TCP**.
234-
1. For **Destination Ports**, type **3389**.
244+
1. For **Destination Ports**, enter *3389*.
235245
1. For **Destination Type**, select **IP Address**.
236-
1. For **Destination**, type the firewall public IP address.
237-
1. For **Translated address**, type the **Srv-work** private IP address.
238-
1. For **Translated port**, type **3389**.
246+
1. For **Destination**, enter the firewall public IP address.
247+
1. For **Translated address**, enter the **Srv-work** private IP address.
248+
1. For **Translated port**, enter *3389*.
239249
1. Select **Add**.
240250

241251

@@ -247,7 +257,7 @@ For testing purposes in this tutorial, configure the server's primary and second
247257
2. Select the network interface for the **Srv-Work** virtual machine.
248258
3. Under **Settings**, select **DNS servers**.
249259
4. Under **DNS servers**, select **Custom**.
250-
5. Type **209.244.0.3** in the **Add DNS server** text box, and **209.244.0.4** in the next text box.
260+
5. Enter *209.244.0.3* in the **Add DNS server** text box, and *209.244.0.4* in the next text box.
251261
6. Select **Save**.
252262
7. Restart the **Srv-Work** virtual machine.
253263

0 commit comments

Comments
 (0)