You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
explanation: "That's correct. You use DNAT to translate Azure Firewall's public IP address to the private IP address of the virtual server."
29
+
explanation: "That's correct. You use DNAT to translate Azure Firewall's public IP address to the private IP address of the virtual server."
30
30
- content: "Suppose a company wants to allow access to an Azure SQL Database instance. Which of the following network rules types should they use to configure Azure Firewall?"
Copy file name to clipboardExpand all lines: learn-pr/azure-networking/introduction-azure-firewall/includes/1-introduction.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,10 +1,10 @@
1
-
Azure Firewall protects your Azure Virtual Network by enabling you to control and monitor access to Azure resources. Azure Firewall Manager provides a central point of configuration and management of multiple Azure Firewall instances.
1
+
Azure Firewall protects your Azure Virtual Network by allowing you to control and monitor access to Azure resources. Azure Firewall Manager provides a central point of configuration and management of multiple Azure Firewall instances.
2
2
3
-
Suppose you work at Contoso, Ltd., a financialservices company in Seattle with major offices located throughout the world. Contoso's compute environment is spread across multiple Azure regions, each with multiple virtual networks and a connection to an on-premises network.
3
+
Suppose you work at Contoso, Ltd., a financial-services company in Seattle with major offices located throughout the world. Contoso's compute environment is spread across multiple Azure regions, each with multiple virtual networks and a connection to an on-premises network.
4
4
5
5
Contoso IT staff is concerned about external threats in the form of malicious actors attempting to infiltrate the network. IT is also concerned about internal threats in the form of employees inadvertently attempting to access malicious websites. Suppose you're a Contoso network security engineer. You’re responsible for determining whether Azure Firewall enables Contoso to deny incoming and outgoing threats while also allowing legitimate traffic. Your mandate also includes finding the most efficient way to implement firewall policies across Contoso's multiple Azure regions.
6
6
7
-
In this module, you learn the fundamentals of Azure Firewall, Azure Firewall Premium, and Azure Firewall Manager. You learn what they are, how they work, and when you should use them. By the end of this module, you can evaluate whether Azure Firewall is a suitable solution for controlling and monitoring access to Contoso's virtual resources. You're also able to evaluate whether Azure Firewall Manager can help reduce the complexity of deploying policies to multiple firewalls.
7
+
In this module, you learn the fundamentals of Azure Firewall, Azure Firewall Premium, and Azure Firewall Manager. You learn what they are, how they work, and when you should use them. By the end of this module, you can evaluate whether Azure Firewall is a suitable solution for controlling and monitoring access to Contoso's virtual resources. You'll also be able to evaluate whether Azure Firewall Manager can help reduce the complexity of deploying policies to multiple firewalls.
Copy file name to clipboardExpand all lines: learn-pr/azure-networking/introduction-azure-firewall/includes/2-what-is-azure-firewall.md
+19-20Lines changed: 19 additions & 20 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,12 +1,12 @@
1
-
Here you learn the basics of both Azure Firewall and Azure Firewall Manager. This overview should help you decide whether Azure Firewall and Azure Firewall Manager are a good fit with Contoso's network security strategy.
1
+
Here, you learn the basics of both Azure Firewall and Azure Firewall Manager. This overview should help you decide whether Azure Firewall and Azure Firewall Manager are a good fit with Contoso's network security strategy.
2
2
3
3
## Overview of Azure Firewall
4
4
5
5
Azure Firewall is a cloud-based security service that protects your Azure virtual network resources from incoming and outgoing threats. In the next few sections, you learn the fundamentals and key features of Azure Firewall.
6
6
7
7
### What is a firewall?
8
8
9
-
A *firewall* is a networksecurity feature that sits between a trusted network and an untrusted network, such as the internet. The firewall's job is to analyze all incoming and outgoing network traffic. Based on that analysis, the firewall either allows the traffic to pass, or it denies the traffic. Ideally, the firewall allows all legitimate traffic while denying malicious traffic such as malware and intrusion attempts.
9
+
A *firewall* is a network-security feature that sits between a trusted network and an untrusted network, such as the internet. The firewall's job is to analyze all incoming and outgoing network traffic. Based on that analysis, the firewall either allows the traffic to pass, or it denies the traffic. Ideally, the firewall allows all legitimate traffic while denying malicious traffic such as malware and intrusion attempts.
10
10
11
11
By default, most firewalls deny all incoming and outgoing traffic. When a firewall analyzes network traffic, it checks for certain conditions to be met before it allows the traffic to pass through. Those conditions could be a specified IP address, FQDN, network port, network protocol, or any combination.
12
12
@@ -37,20 +37,20 @@ The following table lists key features of Azure Firewall Standard.
37
37
|Destination network address translation (DNAT) |All inbound traffic from external sources is sent to the public IP address of the Azure Firewall instance. Allowed traffic is translated to the private IP address of the destination resource on your virtual network. |
38
38
|Application rules |Rules that limit outbound traffic to a list of FQDNs. For example, you can allow outbound traffic to access the FQDN of a specified SQL database instance. |
39
39
|Network rules |Rules for incoming and outgoing traffic based on network parameters. These parameters include the destination or source IP address; the network port; and the network protocol. |
40
-
|Threat intelligence |Filters incoming and outgoing traffic based on the Microsoft threat intelligence rules, which define known malicious IP addresses and domain names. You can configure Azure Firewall with one of two threat intelligence modes: alert you when traffic fails a threat intelligence rule or alert you and deny the traffic. |
40
+
|Threat intelligence |Filters incoming and outgoing traffic based on the Microsoft threat intelligence rules, which define known malicious IP addresses and domain names. You can configure Azure Firewall with one of two threat intelligence modes: alert you when traffic fails a threat intelligence rule, or alert you and deny the traffic. |
41
41
|Stateful |Examines network packets in context, not just individually. If one or more packets arrive unexpectedly given current traffic, Azure Firewall treats the packets as malicious and denies them. |
42
42
|Forced tunneling |Enables Azure Firewall to route all outbound traffic to a specified network resource rather than directly to the internet. The network resource might be an on-premises hardware firewall or a network virtual appliance that processes traffic before allowing it to pass through to the internet. |
43
43
|Tag support |Azure Firewall supports service tags and FQDN tags for easier rule configuration. A *service tag* is a text entity that represents an Azure service. For example, **AzureCosmosDB** is the service tag for the Azure Cosmos DB service. An *FQDN tag* is a text entity that represents a group of domain names associated with popular Microsoft services. For example, **WindowsVirtualDesktop** is the FQDN tag for Azure Virtual Desktop traffic. |
44
-
|DNS proxy|With DNS proxy enabled, Azure Firewall can process and forward DNS queries from a Virtual Network(s) to your desired DNS server.|
45
-
|Custom DNS|Allows you to configure Azure Firewall to use your own DNS server, while ensuring the firewall outbound dependencies are still resolved with Azure DNS.|
46
-
|Web categories|The Web categories feature lets administrators allow or deny user access to web site categories such as gambling websites, social media websites, and others.|
44
+
|DNS proxy|With DNS proxy enabled, Azure Firewall can process and forward DNS queries from a Virtual Network(s) to your desired DNS server.|
45
+
|Custom DNS|Allows you to configure Azure Firewall to use your own DNS server, while ensuring the firewall outbound dependencies are still resolved with Azure DNS.|
46
+
|Web categories|The Web categories feature lets administrators allow or deny user access to web site categories such as gambling websites, social media websites, and others.|
47
47
|Monitoring |Azure Firewall logs all incoming and outgoing network traffic, and you can analyze the resulting logs using Azure Monitor, Power BI, Excel, and other tools. |
48
48
49
49
### What is Azure Firewall Premium?
50
50
51
51
Azure Firewall Premium provides advanced threat protection that meets the needs of highly sensitive and regulated environments, such as the payment and healthcare industries.
:::image type="content" source="../media/2-firewall-premium.png" alt-text="Diagram of the Azure Firewall Premium architecture.":::
54
54
55
55
#### Key features of Azure Firewall Premium
56
56
@@ -60,40 +60,39 @@ The following table lists key features of Azure Firewall Premium.
60
60
|---------|---------|
61
61
|TLS Inspection|Decrypts outbound traffic, processes the data, then encrypts the data and sends it to the destination.|
62
62
|IDPS|A network intrusion detection and prevention system (IDPS) allows you to monitor network activities for malicious activity, log information about this activity, report it, and optionally attempt to block it.|
63
-
|URL filtering|Extends Azure Firewall’s FQDN filtering capability to consider an entire URL. For example, `www.contoso.com/a/c` instead of `www.contoso.com`.
63
+
|URL filtering|Extends Azure Firewall’s FQDN filtering capability to consider an entire URL. For example, `www.contoso.com/a/c` instead of `www.contoso.com`.|
64
64
|Web categories|Administrators can allow or deny user access to website categories such as gambling websites, social media websites, and others. Web categories can be more fine-tuned in Azure Firewall Premium.|
65
65
66
66
### What is Azure Firewall Basic?
67
67
68
-
Azure Firewall Basic is intended for small and medium size (SMB) customers to secure their Azure cloud
69
-
environments. It provides the essential protection SMB customers need at an affordable price point.
68
+
Azure Firewall Basic is intended for small- and medium-size (SMB) customers to secure their Azure cloud environments. It provides the essential protection SMB customers need at an affordable price point.
Azure Firewall Basic is similar to Firewall Standard, but has the following main limitations:
74
73
75
-
- Supports Threat Intel *alert mode* only.
76
-
- Fixed scale unit to run the service on two virtual machine backend instances.
77
-
- Recommended for environments with an estimated throughput of 250 Mbps.
74
+
- Supports Threat Intel *alert mode* only
75
+
- Fixed scale unit to run the service on two virtual machine backend instances
76
+
- Recommended for environments with an estimated throughput of 250 Mbps
78
77
79
78
## Overview of Azure Firewall Manager
80
79
81
80
Azure Firewall Manager provides a central point of configuration and management of multiple Azure Firewall instances. Azure Firewall Manager enables you to create one or more firewall policies and rapidly apply them to multiple firewalls.
82
81
83
82
### What is a firewall policy?
84
83
85
-
The configuration of a single Azure Firewall can be complicated. For example, the firewall might be configured with multiple rule collections. A *collection* is a combination of any or all of the following items:
84
+
Configuring a single Azure Firewall can be complicated. For example, the firewall might be configured with multiple rule collections. A *collection* is a combination of any or all of the following items:
86
85
87
86
- One or more network address translation (NAT) rules
88
87
- One or more network rules
89
88
- One or more application rules
90
89
91
-
When you include other firewall settings such as custom DNS and threatintelligence rules, configuring just a single firewall can be a burden. Adding to that burden are two common network security scenarios:
90
+
When you include other firewall settings such as custom DNS and threat-intelligence rules, configuring just a single firewall can be a burden. Adding to that burden are two common network security scenarios:
92
91
93
92
- Your network architectures require multiple firewalls.
94
93
- You want each firewall to implement both a base level of security rules that apply to everyone, plus special rules for designated groups such as developers, database users, and the marketing department.
95
94
96
-
To simplify the complexity of managing these and similar firewall scenarios, you can implement firewall policies. A *firewall policy* is an Azure resource that contains one or more collections of NAT, network, and application rules. It also contains custom DNS settings, threatintelligence settings, and more.
95
+
To simplify the complexity of managing these and similar firewall scenarios, you can implement firewall policies. A *firewall policy* is an Azure resource that contains one or more collections of NAT, network, and application rules. It also contains custom DNS settings, threat-intelligence settings, and more.
97
96
98
97
The key point is that Azure offers a resource called Firewall Policy. A firewall policy that you create is an instance of that resource. As a separate resource, you can rapidly apply the policy to multiple firewalls using Azure Firewall Manager. You can create one policy to be the base policy, then have more specialized policies inherit the base policy's rules.
99
98
@@ -108,7 +107,7 @@ The following table lists key features of Azure Firewall Manager.
108
107
|Supports multiple network architectures |Protects both standard Azure virtual networks and Azure Virtual WAN Hubs. |
109
108
|Automated traffic routing |Network traffic is automatically routed to the firewall (when used with Azure Virtual WAN Hub only). |
110
109
|Hierarchical policies |Enables you to create so-called parent and child firewall policies. A *parent* policy contains the rules and settings you want to apply globally. A *child* policy inherits all the rules and settings of its parent. |
111
-
|Support for third-party security providers |Enables you to integrate third-party security as a service (SECaaS) solutions to protect your network's internet connection. |
110
+
|Support for third-party security providers |Allows you to integrate third-party security as a service (SECaaS) solutions to protect your network's internet connection. |
112
111
|DDoS protection plan|You can associate your virtual networks with a DDoS protection plan within Azure Firewall Manager.|
113
112
|Manage Web Application Firewall policies|You can centrally create and associate Web Application Firewall (WAF) policies for your application delivery platforms, including Azure Front Door and Azure Application Gateway.|
114
113
@@ -119,5 +118,5 @@ The following table lists key features of Azure Firewall Manager.
119
118
120
119
Azure Firewall Manager provides security management for the following two network architectures:
121
120
122
-
- Hub virtual network. A standard Azure virtual network where one or more firewall policies are applied.
123
-
- Secured virtual hub. An Azure Virtual WAN Hub where one or more firewall policies are applied.
121
+
-**Hub virtual network**: A standard Azure virtual network where one or more firewall policies are applied.
122
+
-**Secured virtual hub**: An Azure Virtual WAN Hub where one or more firewall policies are applied.
0 commit comments