Azure Firewall for centralized security - Mini Project: Build & Apply

Azure Firewall for centralized security

📖 Scenario: You are working as a cloud engineer for a company that wants to secure its network traffic centrally using Azure Firewall. The company has multiple virtual networks and wants to control inbound and outbound traffic with a single firewall.

🎯 Goal: Build an Azure Firewall resource with a firewall policy and apply it to a virtual network to centralize security management.

📋 What You'll Learn

Create an Azure Firewall resource named centralFirewall in resource group NetworkRG and location eastus.

Create a firewall policy named centralFirewallPolicy in the same resource group and location.

Add a network rule collection named AllowWebTraffic to the firewall policy that allows outbound TCP traffic on ports 80 and 443 to any destination.

Associate the firewall policy centralFirewallPolicy with the Azure Firewall centralFirewall.

💡 Why This Matters

🌍 Real World

Centralized network security is critical for organizations to control and monitor traffic across multiple virtual networks and regions. Azure Firewall provides a scalable and manageable solution.

💼 Career

Cloud engineers and network administrators use Azure Firewall to enforce security policies, protect resources, and comply with organizational standards.

1

Create Azure Firewall resource

Create an Azure Firewall resource named centralFirewall in resource group NetworkRG and location eastus using the Azure CLI command az network firewall create.

Azure

# Your code here

Hint

Use the az network firewall create command with the exact resource group, name, and location.

2

Create Azure Firewall Policy

Create an Azure Firewall Policy named centralFirewallPolicy in resource group NetworkRG and location eastus using the Azure CLI command az network firewall policy create.

Azure

az network firewall create --name centralFirewall --resource-group NetworkRG --location eastus
# Your code here

Hint

Use the az network firewall policy create command with the exact policy name, resource group, and location.

3

Add network rule collection to firewall policy

Add a network rule collection named AllowWebTraffic to the firewall policy centralFirewallPolicy that allows outbound TCP traffic on ports 80 and 443 to any destination using the Azure CLI command az network firewall policy rule-collection-group collection add-filter-collection.

Azure

az network firewall create --name centralFirewall --resource-group NetworkRG --location eastus
az network firewall policy create --name centralFirewallPolicy --resource-group NetworkRG --location eastus
# Your code here

Hint

Use the az network firewall policy rule-collection-group collection add-filter-collection command with the exact parameters to allow outbound web traffic.

4

Associate firewall policy with Azure Firewall

Associate the firewall policy centralFirewallPolicy with the Azure Firewall centralFirewall using the Azure CLI command az network firewall update with the --firewall-policy parameter.

Azure

az network firewall create --name centralFirewall --resource-group NetworkRG --location eastus
az network firewall policy create --name centralFirewallPolicy --resource-group NetworkRG --location eastus
az network firewall policy rule-collection-group collection add-filter-collection --policy-name centralFirewallPolicy --resource-group NetworkRG --rule-collection-group-name default --name AllowWebTraffic --action Allow --priority 100 --rule-name AllowWebRule --protocols TCP --source-addresses '*' --destination-addresses '*' --destination-ports 80 443 --rule-type NetworkRule
# Your code here

Hint

Use the az network firewall update command with the --firewall-policy parameter to link the policy.

Practice

1. What is the primary purpose of Azure Firewall in a cloud environment?

easy

A. To centralize network security and control traffic

B. To store large amounts of data securely

C. To provide virtual machines for computing

D. To manage user identities and access

Solution

1. Step 1: Understand Azure Firewall's role

   Azure Firewall is designed to protect cloud resources by controlling and monitoring network traffic centrally.

2. Step 2: Differentiate from other services

   Storing data, providing VMs, or managing identities are roles of other Azure services, not Azure Firewall.

3. Final Answer:

   To centralize network security and control traffic -> Option A

4. Quick Check:

   Azure Firewall = Centralized network security [OK]

Hint: Azure Firewall controls traffic centrally, not data or users [OK]

Common Mistakes:

• Confusing Azure Firewall with storage services
• Thinking it manages user identities
• Assuming it provides computing resources

2. Which subnet name is required when deploying Azure Firewall in a virtual network?

easy

A. Subnet1

B. AzureFirewallSubnet

C. FirewallSubnet

D. DefaultSubnet

Solution

1. Step 1: Recall Azure Firewall deployment requirements

   Azure Firewall requires a dedicated subnet named exactly 'AzureFirewallSubnet' for deployment.

2. Step 2: Check other options

   Other subnet names like 'FirewallSubnet' or 'DefaultSubnet' are incorrect and will cause deployment failure.

3. Final Answer:

   AzureFirewallSubnet -> Option B

4. Quick Check:

   Subnet name must be AzureFirewallSubnet [OK]

Hint: Use exact subnet name 'AzureFirewallSubnet' for firewall deployment [OK]

Common Mistakes:

• Using generic subnet names instead of required one
• Misspelling the subnet name
• Not creating a dedicated subnet for Azure Firewall

3. Given this Azure Firewall rule collection, what traffic will be allowed?

{
  "name": "AllowWeb",
  "rules": [
    {"name": "AllowHTTP", "protocol": "TCP", "port": 80, "action": "Allow"},
    {"name": "AllowHTTPS", "protocol": "TCP", "port": 443, "action": "Allow"}
  ]
}

medium

A. All traffic regardless of protocol or port

B. All TCP traffic on any port

C. Only HTTPS traffic on port 443

D. Only HTTP and HTTPS traffic on ports 80 and 443

Solution

1. Step 1: Analyze the rule collection

   The rules explicitly allow TCP traffic on ports 80 (HTTP) and 443 (HTTPS) only.

2. Step 2: Exclude other traffic

   Other ports or protocols are not allowed since no rules permit them.

3. Final Answer:

   Only HTTP and HTTPS traffic on ports 80 and 443 -> Option D

4. Quick Check:

   Rules allow TCP ports 80 and 443 only [OK]

Hint: Check ports and protocols in rules to find allowed traffic [OK]

Common Mistakes:

• Assuming all TCP traffic is allowed
• Ignoring port restrictions
• Confusing protocol types

4. You deployed Azure Firewall but traffic is not passing through. Which configuration mistake could cause this?

medium

A. Subnet name is not 'AzureFirewallSubnet'

B. Public IP address is assigned to the firewall

C. Firewall rules allow HTTP and HTTPS traffic

D. Virtual network has multiple subnets

Solution

1. Step 1: Identify deployment requirements

   Azure Firewall requires the subnet to be named 'AzureFirewallSubnet' exactly for proper routing.

2. Step 2: Understand impact of wrong subnet name

   If the subnet name is incorrect, firewall won't route traffic, causing blockage.

3. Final Answer:

   Subnet name is not 'AzureFirewallSubnet' -> Option A

4. Quick Check:

   Correct subnet name is critical for traffic flow [OK]

Hint: Check subnet name first if firewall blocks traffic [OK]

Common Mistakes:

• Assuming public IP causes blockage (it is required)
• Ignoring subnet naming rules
• Thinking multiple subnets cause traffic issues

5. You want to centralize security for multiple virtual networks using Azure Firewall. Which setup is best practice?

hard

A. Deploy separate Azure Firewalls in each virtual network without routing

B. Use network security groups only without Azure Firewall

C. Deploy one Azure Firewall in a hub virtual network and route traffic from spoke networks through it

D. Deploy Azure Firewall without a public IP address

Solution

1. Step 1: Understand centralized security architecture

   Using a hub-and-spoke model, one Azure Firewall in the hub network protects multiple spoke networks by routing traffic through it.

2. Step 2: Evaluate other options

   Deploying multiple firewalls increases cost and complexity; NSGs alone don't provide centralized control; firewall needs public IP for internet traffic.

3. Final Answer:

   Deploy one Azure Firewall in a hub virtual network and route traffic from spoke networks through it -> Option C

4. Quick Check:

   Hub-and-spoke with one firewall = centralized security [OK]

Hint: Use hub network firewall to protect multiple spokes [OK]

Common Mistakes:

• Deploying multiple firewalls unnecessarily
• Relying only on network security groups
• Omitting public IP for Azure Firewall