Skip to content

Commit c999d57

Browse files
vhornevhorne
committed
add Basic preview
1 parent bce7f67 commit c999d57

File tree

4 files changed

+314
-2
lines changed

4 files changed

+314
-2
lines changed

‎articles/firewall/deploy-firewall-basic-portal-policy.md

Lines changed: 285 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,285 @@
1+
---
2+
title: 'Deploy & configure Azure Firewall Basic (preview) and policy using the Azure portal'
3+
description: In this how-to, you learn how to deploy and configure Azure Firewall Basic (preview) and policy rules using the Azure portal.
4+
services: firewall
5+
author: vhorne
6+
ms.service: firewall
7+
ms.topic: how-to
8+
ms.date: 09/07/2022
9+
ms.author: victorh
10+
ms.custom: mvc
11+
#Customer intent: As an administrator new to this service, I want to control outbound network access from resources located in an Azure subnet.
12+
---
13+
14+
# Deploy and configure Azure Firewall Basic (preview) and policy using the Azure portal
15+
16+
> [!IMPORTANT]
17+
> Azure Firewall Basic is currently in PREVIEW.
18+
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
19+
20+
Controlling outbound network access is an important part of an overall network security plan. For example, you may want to limit access to web sites. Or, you may want to limit the outbound IP addresses and ports that can be accessed.
21+
22+
One way you can control outbound network access from an Azure subnet is with Azure Firewall and Firewall Policy. With Azure Firewall and Firewall Policy, you can configure:
23+
24+
* Application rules that define fully qualified domain names (FQDNs) that can be accessed from a subnet.
25+
* Network rules that define source address, protocol, destination port, and destination address.
26+
27+
Network traffic is subjected to the configured firewall rules when you route your network traffic to the firewall as the subnet default gateway.
28+
29+
For this how-to, you create a simplified single VNet with two subnets for easy deployment.
30+
31+
For production deployments, a [hub and spoke model](/azure/architecture/reference-architectures/hybrid-networking/hub-spoke) is recommended, where the firewall is in its own VNet. The workload servers are in peered VNets in the same region with one or more subnets.
32+
33+
* **AzureFirewallSubnet** - the firewall is in this subnet.
34+
* **Workload-SN** - the workload server is in this subnet. This subnet's network traffic goes through the firewall.
35+
36+
![Tutorial network infrastructure](media/tutorial-firewall-deploy-portal/tutorial-network.png)
37+
38+
In this tutorial, you learn how to:
39+
40+
> [!div class="checklist"]
41+
> * Set up a test network environment
42+
> * Deploy a basic firewall and basic firewall policy
43+
> * Create a default route
44+
> * Configure an application rule to allow access to www.google.com
45+
> * Configure a network rule to allow access to external DNS servers
46+
> * Configure a NAT rule to allow a remote desktop to the test server
47+
> * Test the firewall
48+
49+
If you prefer, you can complete this procedure using [Azure PowerShell](deploy-ps-policy.md).
50+
51+
## Prerequisites
52+
53+
If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
54+
55+
## Set up the network
56+
57+
First, create a resource group to contain the resources needed to deploy the firewall. Then create a VNet, subnets, and a test server.
58+
59+
### Create a resource group
60+
61+
The resource group contains all the resources for the tutorial.
62+
63+
1. Sign in to the Azure portal at [https://portal.azure.com](https://portal.azure.com).
64+
2. On the Azure portal menu, select **Resource groups** or search for and select *Resource groups* from any page. Then select **Add**.
65+
4. For **Subscription**, select your subscription.
66+
1. For **Resource group name**, enter *Test-FW-RG*.
67+
1. For **Region**, select a region. All other resources that you create must be in the same region.
68+
1. Select **Review + create**.
69+
1. Select **Create**.
70+
71+
### Create a VNet
72+
73+
This VNet will have two subnets.
74+
75+
> [!NOTE]
76+
> The size of the AzureFirewallSubnet subnet is /26. For more information about the subnet size, see [Azure Firewall FAQ](firewall-faq.yml#why-does-azure-firewall-need-a--26-subnet-size).
77+
78+
1. On the Azure portal menu or from the **Home** page, select **Create a resource**.
79+
1. Select **Networking**.
80+
1. Search for **Virtual network** and select it.
81+
1. Select **Create**.
82+
1. For **Subscription**, select your subscription.
83+
1. For **Resource group**, select **Test-FW-RG**.
84+
1. For **Name**, type **Test-FW-VN**.
85+
1. For **Region**, select the same location that you used previously.
86+
1. Select **Next: IP addresses**.
87+
1. For **IPv4 Address space**, accept the default **10.0.0.0/16**.
88+
1. Under **Subnet**, select **default**.
89+
1. For **Subnet name** change the name to **AzureFirewallSubnet**. The firewall will be in this subnet, and the subnet name **must** be AzureFirewallSubnet.
90+
1. For **Address range**, type **10.0.1.0/26**.
91+
1. Select **Save**.
92+
93+
Next, create a subnet for the workload server.
94+
95+
1. Select **Add subnet**.
96+
4. For **Subnet name**, type **Workload-SN**.
97+
5. For **Subnet address range**, type **10.0.2.0/24**.
98+
6. Select **Add**.
99+
7. Select **Review + create**.
100+
8. Select **Create**.
101+
102+
### Create a virtual machine
103+
104+
Now create the workload virtual machine, and place it in the **Workload-SN** subnet.
105+
106+
1. On the Azure portal menu or from the **Home** page, select **Create a resource**.
107+
2. Select **Windows Server 2016 Datacenter**.
108+
4. Enter these values for the virtual machine:
109+
110+
|Setting |Value |
111+
|---------|---------|
112+
|Resource group |**Test-FW-RG**|
113+
|Virtual machine name |**Srv-Work**|
114+
|Region |Same as previous|
115+
|Image|Windows Server 2016 Datacenter|
116+
|Administrator user name |Type a user name|
117+
|Password |Type a password|
118+
119+
4. Under **Inbound port rules**, **Public inbound ports**, select **None**.
120+
6. Accept the other defaults and select **Next: Disks**.
121+
7. Accept the disk defaults and select **Next: Networking**.
122+
8. Make sure that **Test-FW-VN** is selected for the virtual network and the subnet is **Workload-SN**.
123+
9. For **Public IP**, select **None**.
124+
11. Accept the other defaults and select **Next: Management**.
125+
12. Select **Disable** to disable boot diagnostics. Accept the other defaults and select **Review + create**.
126+
13. Review the settings on the summary page, and then select **Create**.
127+
1. After the deployment completes, select the **Srv-Work** resource and note the private IP address for later use.
128+
129+
## Deploy the firewall and policy
130+
131+
Deploy the firewall into the VNet.
132+
133+
1. On the Azure portal menu or from the **Home** page, select **Create a resource**.
134+
2. Type **firewall** in the search box and press **Enter**.
135+
3. Select **Firewall** and then select **Create**.
136+
4. On the **Create a Firewall** page, use the following table to configure the firewall:
137+
138+
|Setting |Value |
139+
|---------|---------|
140+
|Subscription |\<your subscription\>|
141+
|Resource group |**Test-FW-RG** |
142+
|Name |**Test-FW01**|
143+
|Region |Select the same location that you used previously|
144+
|Firewall Tier|**Basic**|
145+
|Firewall management|**Use a Firewall Policy to manage this firewall**|
146+
|Firewall policy|**Add new**:<br>**fw-test-pol**<br>Policy tier should default to **Basic**<br>Your selected region
147+
|Choose a virtual network |**Use existing**: **Test-FW-VN**|
148+
|Public IP address |**Add new**:<br>**Name**: **fw-pip**|
149+
150+
5. Accept the other default values, then select **Review + create**.
151+
6. Review the summary, and then select **Create** to create the firewall.
152+
153+
This will take a few minutes to deploy.
154+
7. After deployment completes, go to the **Test-FW-RG** resource group, and select the **Test-FW01** firewall.
155+
8. Note the firewall private and public IP addresses. You'll use these addresses later.
156+
157+
## Create a default route
158+
159+
For the **Workload-SN** subnet, configure the outbound default route to go through the firewall.
160+
161+
1. On the Azure portal menu, select **All services** or search for and select *All services* from any page.
162+
2. Under **Networking**, select **Route tables**.
163+
3. Select **Add**.
164+
5. For **Subscription**, select your subscription.
165+
6. For **Resource group**, select **Test-FW-RG**.
166+
7. For **Region**, select the same location that you used previously.
167+
4. For **Name**, type **Firewall-route**.
168+
1. Select **Review + create**.
169+
1. Select **Create**.
170+
171+
After deployment completes, select **Go to resource**.
172+
173+
1. On the Firewall-route page, select **Subnets** and then select **Associate**.
174+
1. Select **Virtual network** > **Test-FW-VN**.
175+
1. For **Subnet**, select **Workload-SN**. Make sure that you select only the **Workload-SN** subnet for this route, otherwise your firewall won't work correctly.
176+
177+
13. Select **OK**.
178+
14. Select **Routes** and then select **Add**.
179+
15. For **Route name**, type **fw-dg**.
180+
16. For **Address prefix**, type **0.0.0.0/0**.
181+
17. For **Next hop type**, select **Virtual appliance**.
182+
183+
Azure Firewall is actually a managed service, but virtual appliance works in this situation.
184+
18. For **Next hop address**, type the private IP address for the firewall that you noted previously.
185+
19. Select **OK**.
186+
187+
## Configure an application rule
188+
189+
This is the application rule that allows outbound access to `www.google.com`.
190+
191+
1. Open the **Test-FW-RG**, and select the **fw-test-pol** firewall policy.
192+
1. Select **Application rules**.
193+
1. Select **Add a rule collection**.
194+
1. For **Name**, type **App-Coll01**.
195+
1. For **Priority**, type **200**.
196+
1. For **Rule collection action**, select **Allow**.
197+
1. Under **Rules**, for **Name**, type **Allow-Google**.
198+
1. For **Source type**, select **IP address**.
199+
1. For **Source**, type **10.0.2.0/24**.
200+
1. For **Protocol:port**, type **http, https**.
201+
1. For **Destination Type**, select **FQDN**.
202+
1. For **Destination**, type **`www.google.com`**
203+
1. Select **Add**.
204+
205+
Azure Firewall includes a built-in rule collection for infrastructure FQDNs that are allowed by default. These FQDNs are specific for the platform and can't be used for other purposes. For more information, see [Infrastructure FQDNs](infrastructure-fqdns.md).
206+
207+
## Configure a network rule
208+
209+
This is the network rule that allows outbound access to two IP addresses at port 53 (DNS).
210+
211+
1. Select **Network rules**.
212+
2. Select **Add a rule collection**.
213+
3. For **Name**, type **Net-Coll01**.
214+
4. For **Priority**, type **200**.
215+
5. For **Rule collection action**, select **Allow**.
216+
1. For **Rule collection group**, select **DefaultNetworkRuleCollectionGroup**.
217+
1. Under **Rules**, for **Name**, type **Allow-DNS**.
218+
1. For **Source type**, select **IP Address**.
219+
1. For **Source**, type **10.0.2.0/24**.
220+
1. For **Protocol**, select **UDP**.
221+
1. For **Destination Ports**, type **53**.
222+
1. For **Destination type** select **IP address**.
223+
1. For **Destination**, type **209.244.0.3,209.244.0.4**.<br>These are public DNS servers operated by CenturyLink.
224+
2. Select **Add**.
225+
226+
## Configure a DNAT rule
227+
228+
This rule allows you to connect a remote desktop to the Srv-Work virtual machine through the firewall.
229+
230+
1. Select the **DNAT rules**.
231+
2. Select **Add a rule collection**.
232+
3. For **Name**, type **rdp**.
233+
1. For **Priority**, type **200**.
234+
1. For **Rule collection group**, select **DefaultDnatRuleCollectionGroup**.
235+
1. Under **Rules**, for **Name**, type **rdp-nat**.
236+
1. For **Source type**, select **IP address**.
237+
1. For **Source**, type **\***.
238+
1. For **Protocol**, select **TCP**.
239+
1. For **Destination Ports**, type **3389**.
240+
1. For **Destination Type**, select **IP Address**.
241+
1. For **Destination**, type the firewall public IP address.
242+
1. For **Translated address**, type the **Srv-work** private IP address.
243+
1. For **Translated port**, type **3389**.
244+
1. Select **Add**.
245+
246+
247+
### Change the primary and secondary DNS address for the **Srv-Work** network interface
248+
249+
For testing purposes in this tutorial, configure the server's primary and secondary DNS addresses. This isn't a general Azure Firewall requirement.
250+
251+
1. On the Azure portal menu, select **Resource groups** or search for and select *Resource groups* from any page. Select the **Test-FW-RG** resource group.
252+
2. Select the network interface for the **Srv-Work** virtual machine.
253+
3. Under **Settings**, select **DNS servers**.
254+
4. Under **DNS servers**, select **Custom**.
255+
5. Type **209.244.0.3** in the **Add DNS server** text box, and **209.244.0.4** in the next text box.
256+
6. Select **Save**.
257+
7. Restart the **Srv-Work** virtual machine.
258+
259+
## Test the firewall
260+
261+
Now, test the firewall to confirm that it works as expected.
262+
263+
1. Connect a remote desktop to firewall public IP address and sign in to the **Srv-Work** virtual machine.
264+
3. Open Internet Explorer and browse to `https://www.google.com`.
265+
4. Select **OK** > **Close** on the Internet Explorer security alerts.
266+
267+
You should see the Google home page.
268+
269+
5. Browse to `https://www.microsoft.com`.
270+
271+
You should be blocked by the firewall.
272+
273+
So now you've verified that the firewall rules are working:
274+
275+
* You can browse to the one allowed FQDN, but not to any others.
276+
* You can resolve DNS names using the configured external DNS server.
277+
278+
## Clean up resources
279+
280+
You can keep your firewall resources for the next tutorial, or if no longer needed, delete the **Test-FW-RG** resource group to delete all firewall-related resources.
281+
282+
## Next steps
283+
284+
> [!div class="nextstepaction"]
285+
> [Deploy and configure Azure Firewall Premium](premium-deploy.md)

‎articles/firewall/index.yml

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ metadata:
1111
ms.topic: landing-page
1212
author: vhorne
1313
ms.author: victorh
14-
ms.date: 08/29/2022
14+
ms.date: 09/07/2022
1515
ms.custom: e2e-hybrid
1616

1717
# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | whats-new
@@ -70,6 +70,10 @@ landingContent:
7070
url: tutorial-hybrid-portal-policy.md
7171
- text: Filter inbound traffic
7272
url: tutorial-firewall-dnat-policy.md
73+
- linkListType: how-to-guide
74+
links:
75+
- text: Deploy Firewall Basic
76+
url: deploy-firewall-basic-portal-policy.md
7377

7478
# Card
7579
- title: Integrate with Load Balancer

‎articles/firewall/overview.md

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,8 @@ ms.date: 06/17/2022
1818

1919
Azure Firewall is a cloud-native and intelligent network firewall security service that provides the best of breed threat protection for your cloud workloads running in Azure. It's a fully stateful, firewall as a service with built-in high availability and unrestricted cloud scalability. It provides both east-west and north-south traffic inspection.
2020

21-
Azure Firewall is offered in two SKUs: Standard and Premium.
21+
Azure Firewall is offered in three SKUs: Standard, Premium, and Basic.
22+
2223

2324
## Azure Firewall Standard
2425

@@ -38,6 +39,26 @@ To learn about Firewall Standard features, see [Azure Firewall Standard features
3839

3940
To learn about Firewall Premium features, see [Azure Firewall Premium features](premium-features.md).
4041

42+
## Azure Firewall Basic (preview)
43+
44+
> [!IMPORTANT]
45+
> Azure Firewall Basic is currently in PREVIEW.
46+
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
47+
48+
Azure Firewall Basic is a managed, stateful, highly available, fixed-scale with limited throughput cloud-native network
49+
security service. It supports 99.99% SLA, Threat intelligence (Alert mode), Availability Zones, application rules
50+
filtering (HTTP/s), FQDN tags, 5-tuple network rule filtering, service tags, central logging, and analytics.
51+
52+
Azure Firewall Basic is intended mainly for small and medium size companies who need to secure their cloud
53+
environment. It provides the essential protection they need at an affordable price point.
54+
55+
Firewall Basic is similar to Firewall Standard, but has the following limitations:
56+
57+
- Supports *alert mode* only.
58+
- Fixed support to run the service on two virtual machines.
59+
- Support for approximately 250-500 Mbps throughput for public preview. This may increase for feature general availability (GA).
60+
61+
To deploy a Basic Firewall, see [Deploy and configure Azure Firewall Basic (preview) and policy using the Azure portal](deploy-firewall-basic-portal-policy.md).
4162

4263
## Azure Firewall Manager
4364

‎articles/firewall/toc.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,8 @@ items:
9797
href: tutorial-firewall-deploy-portal.md
9898
- name: Deploy in hybrid network - classic
9999
href: tutorial-hybrid-portal.md
100+
- name: Deploy Firewall Basic
101+
href: deploy-firewall-basic-portal-policy.md
100102
- name: Filter inbound traffic with DNAT - classic
101103
href: tutorial-firewall-dnat.md
102104
- name: Deploy using Azure PowerShell

0 commit comments

Comments
 (0)