azure-firewall

Name: azure-firewall
Author: vinayaklatthe

53installs34forks

How to install azure-firewall?

vinayaklatthe/microsoft-security-skills/azure-firewall

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-firewall

Installs into the current project.

Summary

Guidance for Azure Firewall — managed cloud-native L3-L7 stateful network firewall for centralised egress, east-west, and ingress control. Covers SKU choice (Basic vs Standard vs Premium), Firewall Policy hierarchy, application/network/DNAT rules, threat intelligence and IDPS, TL

Files · 1

View on GitHub

SKILL.md

1	# Azure Firewall
2
3	Azure Firewall is a managed, highly available, cloud-native stateful network firewall used
4	to centrally govern and log traffic, typically deployed in the hub of a hub-spoke network.
5	It is the choke point that enforces a default-deny egress posture across an Azure estate.
6
7	## When to use
8	Centralising egress (and east-west / ingress) traffic control and inspection across an Azure
9	network estate. Use this skill to pick the SKU, design rules, and deploy in the hub.
10
11	Do not use this skill for L7 web app protection (WAF on Front Door / App Gateway), subnet
12	microsegmentation (NSGs - see `azure-network-security-design`), or third-party NVA design.
13
14	## Pick the SKU by capability need
15
16	\| Requirement \| SKU \| Notes \|
17	\|---\|---\|---\|
18	\| SMB / dev / small estate, < 250 Mbps \| Basic \| Cost-optimised; no threat intel deny \|
19	\| Standard egress filtering, FQDN, threat intel \| Standard \| Default for most enterprise hubs \|
20	\| TLS inspection, IDPS signatures, URL filtering, web categories \| Premium \| Regulated / high-assurance \|
21	\| Multi-hub global deployment \| Premium + Firewall Manager + Virtual WAN \| Centralised policy at scale \|
22
23	> Rule of thumb: Standard SKU is right for most enterprise hubs in 2026. Move to Premium
24	> only when you have a concrete TLS-inspection or IDPS requirement - the certificate /
25	> PKI overhead of TLS inspection is real and breaks some apps. Basic only for SMB or sandbox.
26
27	## Approach
28
29	1. Deploy in the hub — Single firewall per region in the hub VNet (with at least two
30	availability zones for resilience). All spokes peer to the hub; egress and east-west
31	traffic flows through.
32	*Verify: firewall has public IP for egress, deployed across ≥ 2 AZs, capacity baseline
33	established.*
34
35	2. Use Firewall Policy (not classic rules) — Author rules in Azure Firewall Policy with
36	hierarchical parent + child policies (e.g. parent = enterprise baseline, child =
37	region-specific). Don't author rules per firewall.
38	Verify: policy hierarchy mapped; one base policy reused across regional firewalls.
39
40	3. Default-deny + structured rule collections — Order: DNAT (inbound) → **Network
41	rules (IP/port/protocol) → Application rules** (FQDN/URL). Inside each collection group,
42	priority controls evaluation. Default action = deny.
43	Verify: a probe from a spoke to an unallowed FQDN is logged as deny.
44
45	4. Application rules with FQDN tags — Use built-in FQDN tags (WindowsUpdate,
46	AzureKubernetesService, Office365) for Microsoft service egress instead of hand-curated
47	lists. Custom FQDNs for third-party SaaS.
48
49	5. Force spoke egress through firewall via UDRs — User-defined routes on spoke subnets:
50	`0.0.0.0/0` next hop = firewall private IP. Without UDRs, traffic bypasses the firewall.
51	Verify: `Get-AzEffectiveRouteTable` on a spoke NIC shows next hop = firewall.
52
53	6. Enable threat intel + IDPS (Premium) — Threat-intel-based filtering in Deny mode
54	for known-bad IPs / FQDNs. Premium: enable IDPS in Alert+Deny for high-severity
55	signatures; tune false positives.
56
57	7. Stream logs and monitor capacity — Send to Log Analytics / Sentinel using **structured
58	firewall logs**. Use the workbook for top denied flows, capacity / throughput.
59	Verify: firewall workbook populated; alert on > 80% throughput sustained for 15 minutes.
60
61	## Guardrails
62	- **Azure Firewall complements, not replaces, NSGs (subnet/NIC microsegmentation) and WAF
63	(L7 web).** Layered defence; each does a different job.
64	- TLS inspection (Premium) requires certificate / PKI planning. Internal CA cert chain
65	trusted on clients; some apps (cert-pinning, mTLS) break under inspection. Pilot first.
66	- Plan capacity and availability zones for resilient hub deployments. Single-zone =
67	single zone outage takes the hub down.
68	- UDRs are the enforcement. Without `0.0.0.0/0 → firewall` on spokes, traffic doesn't go
69	through. Audit UDRs as part of landing zone.
70	- Firewall Policy is hierarchical for a reason. Don't author per-firewall rules at scale -
71	they drif

People who liked this also viewed

6 picks

Type

azure-firewall

53installs34forks

View on GitHub

How to install azure-firewall?

vinayaklatthe/microsoft-security-skills/azure-firewall

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-firewall

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Azure Firewall
2
3	Azure Firewall is a managed, highly available, cloud-native stateful network firewall used
4	to centrally govern and log traffic, typically deployed in the hub of a hub-spoke network.
5	It is the choke point that enforces a default-deny egress posture across an Azure estate.
6
7	## When to use
8	Centralising egress (and east-west / ingress) traffic control and inspection across an Azure
9	network estate. Use this skill to pick the SKU, design rules, and deploy in the hub.
10
11	Do not use this skill for L7 web app protection (WAF on Front Door / App Gateway), subnet
12	microsegmentation (NSGs - see `azure-network-security-design`), or third-party NVA design.
13
14	## Pick the SKU by capability need
15
16	\| Requirement \| SKU \| Notes \|
17	\|---\|---\|---\|
18	\| SMB / dev / small estate, < 250 Mbps \| Basic \| Cost-optimised; no threat intel deny \|
19	\| Standard egress filtering, FQDN, threat intel \| Standard \| Default for most enterprise hubs \|
20	\| TLS inspection, IDPS signatures, URL filtering, web categories \| Premium \| Regulated / high-assurance \|
21	\| Multi-hub global deployment \| Premium + Firewall Manager + Virtual WAN \| Centralised policy at scale \|
22
23	> Rule of thumb: Standard SKU is right for most enterprise hubs in 2026. Move to Premium
24	> only when you have a concrete TLS-inspection or IDPS requirement - the certificate /
25	> PKI overhead of TLS inspection is real and breaks some apps. Basic only for SMB or sandbox.
26
27	## Approach
28
29	1. Deploy in the hub — Single firewall per region in the hub VNet (with at least two
30	availability zones for resilience). All spokes peer to the hub; egress and east-west
31	traffic flows through.
32	*Verify: firewall has public IP for egress, deployed across ≥ 2 AZs, capacity baseline
33	established.*
34
35	2. Use Firewall Policy (not classic rules) — Author rules in Azure Firewall Policy with
36	hierarchical parent + child policies (e.g. parent = enterprise baseline, child =
37	region-specific). Don't author rules per firewall.
38	Verify: policy hierarchy mapped; one base policy reused across regional firewalls.
39
40	3. Default-deny + structured rule collections — Order: DNAT (inbound) → **Network
41	rules (IP/port/protocol) → Application rules** (FQDN/URL). Inside each collection group,
42	priority controls evaluation. Default action = deny.
43	Verify: a probe from a spoke to an unallowed FQDN is logged as deny.
44
45	4. Application rules with FQDN tags — Use built-in FQDN tags (WindowsUpdate,
46	AzureKubernetesService, Office365) for Microsoft service egress instead of hand-curated
47	lists. Custom FQDNs for third-party SaaS.
48
49	5. Force spoke egress through firewall via UDRs — User-defined routes on spoke subnets:
50	`0.0.0.0/0` next hop = firewall private IP. Without UDRs, traffic bypasses the firewall.
51	Verify: `Get-AzEffectiveRouteTable` on a spoke NIC shows next hop = firewall.
52
53	6. Enable threat intel + IDPS (Premium) — Threat-intel-based filtering in Deny mode
54	for known-bad IPs / FQDNs. Premium: enable IDPS in Alert+Deny for high-severity
55	signatures; tune false positives.
56
57	7. Stream logs and monitor capacity — Send to Log Analytics / Sentinel using **structured
58	firewall logs**. Use the workbook for top denied flows, capacity / throughput.
59	Verify: firewall workbook populated; alert on > 80% throughput sustained for 15 minutes.
60
61	## Guardrails
62	- **Azure Firewall complements, not replaces, NSGs (subnet/NIC microsegmentation) and WAF
63	(L7 web).** Layered defence; each does a different job.
64	- TLS inspection (Premium) requires certificate / PKI planning. Internal CA cert chain
65	trusted on clients; some apps (cert-pinning, mTLS) break under inspection. Pilot first.
66	- Plan capacity and availability zones for resilient hub deployments. Single-zone =
67	single zone outage takes the hub down.
68	- UDRs are the enforcement. Without `0.0.0.0/0 → firewall` on spokes, traffic doesn't go
69	through. Audit UDRs as part of landing zone.
70	- Firewall Policy is hierarchical for a reason. Don't author per-firewall rules at scale -
71	they drif

People who liked this also viewed

6 picks

Type