Skip to content

Commit ee46cab

Browse files
denreadenrea
authored
Merge pull request #278897 from vhorne/fwm-dns-set-fresh
freshness updates
2 parents c6949ea + a921bf6 commit ee46cab

File tree

1 file changed

+149
-23
lines changed

1 file changed

+149
-23
lines changed

‎articles/firewall-manager/dns-settings.md

Lines changed: 149 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -5,53 +5,179 @@ services: firewall-manager
55
author: vhorne
66
ms.service: firewall-manager
77
ms.topic: how-to
8-
ms.date: 04/06/2023
8+
ms.date: 06/21/2024
99
ms.author: victorh
1010
---
1111

1212
# Azure Firewall policy DNS settings
1313

14-
You can configure a custom DNS server and enable DNS proxy for Azure Firewall policies. You can configure these settings when you deploy the firewall or later from the **Settings**, **DNS** page.
14+
You can configure a custom DNS server and enable DNS proxy for Azure Firewall. Configure these settings when you deploy the firewall, or configure them later from the **DNS settings** page. By default, Azure Firewall uses Azure DNS and DNS Proxy is disabled.
1515

1616
## DNS servers
1717

18-
A DNS server maintains and resolves domain names to IP addresses. By default, Azure Firewall uses Azure DNS for name resolution. The **DNS servers** setting lets you configure your own DNS servers for Azure Firewall name resolution. You can configure a single or multiple servers.
18+
A DNS server maintains and resolves domain names to IP addresses. By default, Azure Firewall uses Azure DNS for name resolution. The **DNS server** setting lets you configure your own DNS servers for Azure Firewall name resolution. You can configure a single server or multiple servers. If you configure multiple DNS servers, the server used is chosen randomly. You can configure a maximum of 15 DNS servers in **Custom DNS**.
19+
20+
> [!NOTE]
21+
> For instances of Azure Firewall that are managed by using Azure Firewall Manager, the DNS settings are configured in the associated Azure Firewall policy.
22+
23+
### Configure custom DNS servers
24+
25+
#### [Portal](#tab/browser)
26+
27+
1. Under Azure Firewall **Settings**, select **DNS Settings**.
28+
2. Under **DNS servers**, you can type or add existing DNS servers that were previously specified in your virtual network.
29+
3. Select **Apply**.
30+
31+
The firewall now directs DNS traffic to the specified DNS servers for name resolution.
32+
33+
:::image type="content" source="../firewall/media/dns-settings/dns-servers.png" alt-text="Screenshot showing settings for DNS servers.":::
34+
35+
#### [CLI](#tab/azure-devops-cli)
36+
37+
The following example updates Azure Firewall with custom DNS servers by using the Azure CLI.
38+
39+
```azurecli-interactive
40+
az network firewall update \
41+
--name fwName \
42+
--resource-group fwRG \
43+
--dns-servers 10.1.0.4 10.1.0.5
44+
```
45+
46+
> [!IMPORTANT]
47+
> The command `az network firewall` requires the Azure CLI extension `azure-firewall` to be installed. You can install it by using the command `az extension add --name azure-firewall`.
48+
49+
#### [PowerShell](#tab/powershell)
50+
51+
The following example updates Azure Firewall with custom DNS servers by using Azure PowerShell.
52+
53+
```azurepowershell
54+
$dnsServers = @("10.1.0.4", "10.1.0.5")
55+
$azFw = Get-AzFirewall -Name "fwName" -ResourceGroupName "fwRG"
56+
$azFw.DNSServer = $dnsServers
57+
58+
$azFw | Set-AzFirewall
59+
```
60+
---
1961

2062
## DNS proxy
2163

22-
You can configure Azure Firewall to act as a DNS proxy. A DNS proxy acts as an intermediary for DNS requests from client virtual machines to a DNS server. If you configure a custom DNS server, you should enable DNS proxy to avoid DNS resolution mismatch, and enable FQDN filtering in network rules.
64+
You can configure Azure Firewall to act as a DNS proxy. A DNS proxy is an intermediary for DNS requests from client virtual machines to a DNS server.
65+
66+
If you want to enable FQDN (fully qualified domain name) filtering in network rules, enable DNS proxy and update the virtual machine configuration to use the firewall as a DNS proxy.
67+
68+
:::image type="content" source="../firewall/media/dns-settings/dns-proxy-2.png" alt-text="Diagram showing DNS proxy configuration using a custom DNS server.":::
69+
70+
If you enable FQDN filtering in network rules, and you don't configure client virtual machines to use the firewall as a DNS proxy, then DNS requests from these clients might travel to a DNS server at a different time or return a different response compared to that of the firewall. It’s recommended to configure client virtual machines to use the Azure Firewall as their DNS proxy. This puts Azure Firewall in the path of the client requests to avoid inconsistency.
2371

24-
If you don't enable DNS proxy, DNS requests from the client may travel to a DNS server at a different time or return a different response compared to that of the firewall. DNS proxy puts Azure Firewall in the path of the client requests to avoid inconsistency.
72+
When Azure Firewall is a DNS proxy, two caching function types are possible:
2573

26-
DNS Proxy configuration requires three steps:
74+
- **Positive cache**: DNS resolution is successful. The firewall caches these responses according to the TTL (time to live) in the response up to a maximum of 1 hour.
2775

28-
1. Enable DNS proxy in Azure Firewall DNS settings.
29-
2. Optionally configure your custom DNS server or use the provided default.
30-
3. Finally, you must configure the Azure Firewall’s private IP address as a Custom DNS address in your virtual network DNS server settings. This ensures DNS traffic is directed to Azure Firewall.
76+
- **Negative cache**: DNS resolution results in no response or no resolution. The firewall caches these responses according to the TTL in the response, up to a max of 30 minutes.
3177

32-
## Configure firewall policy DNS
78+
The DNS proxy stores all resolved IP addresses from FQDNs in network rules. As a best practice, use FQDNs that resolve to one IP address.
3379

34-
1. Select your firewall policy.
35-
2. Under **Settings**, select **DNS**.
36-
1. Select **Enabled** to enable DNS settings for this policy.
37-
1. Under **DNS servers**, you can accept the **Default (Azure provided)** setting, or select **Custom** to add custom DNS servers you'll configure for your virtual network.
38-
1. Under **DNS Proxy**, select **Enabled** to enable DNS Proxy if you configured a customer DNS server.
39-
1. Select **Apply**.
80+
### Policy inheritance
4081

82+
Policy DNS settings applied to a standalone firewall override the standalone firewall’s DNS settings. A child policy inherits all parent policy DNS settings, but it can override the parent policy.
4183

42-
## Configure virtual network
84+
For example, to use FQDNs in network rule, DNS proxy should be enabled. But if a parent policy does **not** have DNS proxy enabled, the child policy won't support FQDNs in network rules unless you locally override this setting.
4385

44-
To configure DNS proxy, you must also configure your virtual network DNS servers setting to use the firewall private IP address.
86+
### DNS proxy configuration
4587

46-
### Configure virtual network DNS servers
88+
DNS proxy configuration requires three steps:
89+
1. Enable the DNS proxy in Azure Firewall DNS settings.
90+
2. Optionally, configure your custom DNS server or use the provided default.
91+
3. Configure the Azure Firewall private IP address as a custom DNS address in your virtual network DNS server settings. This setting ensures DNS traffic is directed to Azure Firewall.
4792

48-
1. Select the virtual network where the DNS traffic will be routed through the Azure Firewall.
93+
#### [Portal](#tab/browser)
94+
95+
To configure DNS proxy, you must configure your virtual network DNS servers setting to use the firewall private IP address. Then enable the DNS proxy in the Azure Firewall **DNS settings**.
96+
97+
##### Configure virtual network DNS servers
98+
99+
1. Select the virtual network where the DNS traffic is routed through the Azure Firewall instance.
49100
2. Under **Settings**, select **DNS servers**.
50-
3. Select **Custom** under **DNS servers**.
51-
4. Enter the firewall’s private IP address.
101+
3. Under **DNS servers**, select **Custom**.
102+
4. Enter the firewall's private IP address.
103+
5. Select **Save**.
104+
6. Restart the VMs that are connected to the virtual network so they're assigned the new DNS server settings. VMs continue to use their current DNS settings until they're restarted.
105+
106+
##### Enable DNS proxy
107+
108+
1. Select your Azure Firewall instance.
109+
2. Under **Settings**, select **DNS settings**.
110+
3. By default, **DNS Proxy** is disabled. When this setting is enabled, the firewall listens on port 53 and forwards DNS requests to the configured DNS servers.
111+
4. Review the **DNS servers** configuration to make sure that the settings are appropriate for your environment.
52112
5. Select **Save**.
53113

114+
:::image type="content" source="../firewall/media/dns-settings/dns-proxy.png" alt-text="Screenshot showing settings for the DNS proxy.":::
115+
116+
#### [CLI](#tab/azure-devops-cli)
117+
118+
You can use the Azure CLI to configure DNS proxy settings in Azure Firewall. You can also use it to update virtual networks to use Azure Firewall as the DNS server.
119+
120+
##### Configure virtual network DNS servers
121+
122+
The following example configures the virtual network to use Azure Firewall as the DNS server.
123+
124+
```azurecli-interactive
125+
az network vnet update \
126+
--name VNetName \
127+
--resource-group VNetRG \
128+
--dns-servers <firewall-private-IP>
129+
```
130+
131+
##### Enable DNS proxy
132+
133+
The following example enables the DNS proxy feature in Azure Firewall.
134+
135+
```azurecli-interactive
136+
az network firewall update \
137+
--name fwName \
138+
--resource-group fwRG \
139+
--enable-dns-proxy true
140+
```
141+
142+
#### [PowerShell](#tab/powershell)
143+
144+
You can use Azure PowerShell to configure DNS proxy settings in Azure Firewall. You can also use it to update virtual networks to use Azure Firewall as the DNS server.
145+
146+
##### Configure virtual network DNS servers
147+
148+
The following example configures the virtual network to use Azure Firewall as a DNS server.
149+
150+
```azurepowershell
151+
$dnsServers = @("<firewall-private-IP>")
152+
$VNet = Get-AzVirtualNetwork -Name "VNetName" -ResourceGroupName "VNetRG"
153+
$VNet.DhcpOptions.DnsServers = $dnsServers
154+
155+
$VNet | Set-AzVirtualNetwork
156+
```
157+
158+
##### Enable DNS proxy
159+
160+
The following example enables the DNS proxy feature in Azure Firewall.
161+
162+
```azurepowershell
163+
$azFw = Get-AzFirewall -Name "fwName" -ResourceGroupName "fwRG"
164+
$azFw.DNSEnableProxy = $true
165+
166+
$azFw | Set-AzFirewall
167+
```
168+
---
169+
170+
### High availability failover
171+
172+
DNS proxy has a failover mechanism that stops using a detected unhealthy server and uses another DNS server that is available.
173+
174+
If all DNS servers are unavailable, there's no fallback to another DNS server.
175+
176+
### Health checks
177+
178+
DNS proxy performs five-second health check loops for as long as the upstream servers report as unhealthy. The health checks are a recursive DNS query to the root name server. Once an upstream server is considered healthy, the firewall stops health checks until the next error. When a healthy proxy returns an error, the firewall selects another DNS server in the list.
54179

55180
## Next steps
56181

57-
[FQDN filtering in network rules](fqdn-filtering-network-rules.md)
182+
- [Azure Firewall DNS Proxy details](../firewall/dns-details.md)
183+
- [FQDN filtering in network rules](fqdn-filtering-network-rules.md)

0 commit comments

Comments
 (0)