Azure Firewall Manager now supports virtual networks

This post was co-authored by Yair Tor, Principal Program Manager, Azure Networking.

Last November we introduced Microsoft Azure Firewall Manager preview for Azure Firewall policy and route management in secured virtual hubs. This also included integration with key Security as a Service partners, Zscaler, iboss, and soon Check Point. These partners support branch to internet and virtual network to internet scenarios.

Today, we are extending Azure Firewall Manager preview to include automatic deployment and central security policy management for Azure Firewall in hub virtual networks.

Azure Firewall Manager preview is a network security management service that provides central security policy and route management for cloud-based security perimeters. It makes it easy for enterprise IT teams to centrally define network and application-level rules for traffic filtering across multiple Azure Firewall instances that spans different Azure regions and subscriptions in hub-and-spoke architectures for traffic governance and protection. In addition, it empowers DevOps for better agility with derived local firewall security policies that are implemented across organizations.

For more information see Azure Firewall Manager documentation.

Azure Firewall Manager getting started page

Figure one – Azure Firewall Manger Getting Started page

 

Hub virtual networks and secured virtual hubs

Azure Firewall Manager can provide security management for two network architecture types:

  •  Secured virtual hub—An Azure Virtual WAN Hub is a Microsoft-managed resource that lets you easily create hub-and-spoke architectures. When security and routing policies are associated with such a hub, it is referred to as a secured virtual hub.
  •  Hub virtual network—This is a standard Azure Virtual Network that you create and manage yourself. When security policies are associated with such a hub, it is referred to as a hub virtual network. At this time, only Azure Firewall Policy is supported. You can peer spoke virtual networks that contain your workload servers and services. It is also possible to manage firewalls in standalone virtual networks that are not peered to any spoke.

Whether to use a hub virtual network or a secured virtual depends on your scenario:

  •  Hub virtual network—Hub virtual networks are probably the right choice if your network architecture is based on virtual networks only, requires multiple hubs per regions, or doesn’t use hub-and-spoke at all.
  •  Secured virtual hubs—Secured virtual hubs might address your needs better if you need to manage routing and security policies across many globally distributed secured hubs. Secure virtual hubs have high scale VPN connectivity, SDWAN support, and third-party Security as Service integration. You can use Azure to secure your Internet edge for both on-premises and cloud resources.

The following comparison table in Figure 2 can assist in making an informed decision:

 

  Hub virtual network Secured virtual hub
Underlying resource Virtual network Virtual WAN hub
Hub-and-Spoke Using virtual network peering Automated using hub virtual network connection
On-prem connectivity

VPN Gateway up to 10 Gbps and 30 S2S connections; ExpressRoute

More scalable VPN Gateway up to 20 Gbps and 1000 S2S connections; ExpressRoute

Automated branch connectivity using SDWAN Not supported Supported
Hubs per region Multiple virtual networks per region

Single virtual hub per region. Multiple hubs possible with multiple Virtual WANs

Azure Firewall – multiple public IP addresses Customer provided Auto-generated (to be available by general availability)
Azure Firewall Availability Zones Supported Not available in preview. To be available availabilityavailablity

Advanced internet security with 3rd party Security as a service partners

Customer established and managed VPN connectivity to partner service of choice

Automated via Trusted Security Partner flow and partner management experience

Centralized route management to attract traffic to the hub

Customer managed UDR; Roadmap: UDR default route automation for spokes

Supported using BGP
Web Application Firewall on Application Gateway Supported in virtual network Roadmap: can be used in spoke
Network Virtual Appliance Supported in virtual network Roadmap: can be used in spoke

Figure 2 – Hub virtual network vs. secured virtual hub

Firewall policy

Firewall policy is an Azure resource that contains network address translation (NAT), network, and application rule collections as well as threat intelligence settings. It's a global resource that can be used across multiple Azure Firewall instances in secured virtual hubs and hub virtual networks. New policies can be created from scratch or inherited from existing policies. Inheritance allows DevOps to create local firewall policies on top of organization mandated base policy. Policies work across regions and subscriptions.

Azure Firewall Manager orchestrates Firewall policy creation and association. However, a policy can also be created and managed via REST API, templates, Azure PowerShell, and CLI.

Once a policy is created, it can be associated with a firewall in a Virtual WAN Hub (aka secured virtual hub) or a firewall in a virtual network (aka hub virtual network).

Firewall Policies are billed based on firewall associations. A policy with zero or one firewall association is free of charge. A policy with multiple firewall associations is billed at a fixed rate.

For more information, see Azure Firewall Manager pricing.

The following table compares the new firewall policies with the existing firewall rules:

 

Policy

Rules

Contains

NAT, Network, Application rules, and Threat Intelligence settings

NAT, Network, and Application rules

Protects

Virtual hubs and virtual networks

Virtual networks only

Portal experience

Central management using Firewall Manager

Standalone firewall experience

Multiple firewall support

Firewall Policy is a separate resource that can be used across firewalls

Manually export and import rules or using 3rd party management solutions

Pricing

Billed based on firewall association. See Pricing

Free

Supported deployment mechanisms

Portal, REST API, templates, PowerShell, and CLI

Portal, REST API, templates, PowerShell, and CLI

Release Status

Preview

General Availability

Figure 3 – Firewall Policy vs. Firewall Rules

Next steps

For more information on topics covered here, see the following blogs, documentation, and videos:

Azure Firewall central management partners:

40 Comments

  1. Once I originally commented I clicked the -Notify me when new comments are added- checkbox and now every time a comment is added I get 4 emails with the identical comment. Is there any means you’ll be able to take away me from that service? Thanks!

  2. Some genuinely nice and useful information on this website , besides I believe the design and style holds great features.

  3. Enjoyed reading this, very good stuff, thanks. “Success doesn’t come to you…you go to it.” by Marva Collins.

  4. I have been exploring for a little bit for any high quality articles or weblog posts on this sort of area . Exploring in Yahoo I ultimately stumbled upon this web site. Studying this information So i am glad to express that I have a very excellent uncanny feeling I discovered just what I needed. I so much no doubt will make sure to do not disregard this web site and give it a look regularly.

  5. I don’t even understand how I finished up here, but I thought this put up was once good. I do not recognize who you’re however certainly you are going to a famous blogger in case you aren’t already 😉 Cheers!

  6. Hiya, I am really glad I’ve found this info. Nowadays bloggers publish only about gossips and web and this is really irritating. A good site with interesting content, this is what I need. Thanks for keeping this site, I will be visiting it. Do you do newsletters? Can not find it.

  7. Thank you for sharing excellent informations. Your website is very cool. I am impressed by the details that you have on this blog. It reveals how nicely you perceive this subject. Bookmarked this website page, will come back for more articles. You, my friend, ROCK! I found simply the info I already searched all over the place and simply could not come across. What a perfect site.

  8. Excellent post. I was checking continuously this blog and I am impressed! Very helpful information specifically the last part 🙂 I care for such info a lot. I was looking for this particular info for a very long time. Thank you and best of luck.

  9. Hey! This is my 1st comment here so I just wanted to give a quick shout out and tell you I genuinely enjoy reading your posts. Can you suggest any other blogs/websites/forums that cover the same topics? Thank you!

  10. Thank you from the bottom of my heart for everything

  11. I’m truly enjoying the design and layout of your site. It’s a very easy on the eyes which makes it much more enjoyable for me to come here and visit more often. Did you hire out a developer to create your theme? Exceptional work!

  12. Excellent read, I just passed this onto a colleague who was doing a little research on that. And he just bought me lunch because I found it for him smile Thus let me rephrase that: Thanks for lunch! “Not only is the universe stranger than we imagine, it is stranger than we can imagine.” by Sir Arthur Eddington.

  13. After study a few of the blog posts on your website now, and I truly like your way of blogging. I bookmarked it to my bookmark website list and will be checking back soon. Pls check out my web site as well and let me know what you think.

  14. I conceive other website proprietors should take this site as an example , very clean and superb user pleasant design and style.

  15. But wanna input on few general things, The website design is perfect, the content material is real great : D.

  16. Hmm it seems like your blog ate my first comment (it was super long) so I guess I’ll just sum it up what I had written and say, I’m thoroughly enjoying your blog. I as well am an aspiring blog writer but I’m still new to the whole thing. Do you have any helpful hints for first-time blog writers? I’d really appreciate it.

  17. I love your blog.. very nice colors & theme. Did you create this website yourself? Plz reply back as I’m looking to create my own blog and would like to know wheere u got this from. thanks

  18. Im no longer certain the place you are getting your info, but great topic. I must spend some time studying more or understanding more. Thanks for fantastic information I used to be looking for this information for my mission.

  19. I?¦m not certain where you are getting your information, but good topic. I needs to spend a while learning much more or understanding more. Thanks for excellent information I used to be searching for this information for my mission.

  20. Great write-up, I am regular visitor of one’s blog, maintain up the nice operate, and It’s going to be a regular visitor for a lengthy time.

  21. Hi, i read your blog occasionally and i own a similar one and i was just wondering if you get a lot of spam comments? If so how do you stop it, any plugin or anything you can advise? I get so much lately it’s driving me crazy so any assistance is very much appreciated.

  22. Everything is very open and very clear explanation of issues. was truly information. Your website is very useful. Thanks for sharing.

  23. It is perfect time to make a few plans for the longer term and it’s time to be happy. I have learn this post and if I could I wish to counsel you few fascinating things or advice. Perhaps you could write next articles relating to this article. I want to learn even more things about it!

  24. I’ve been browsing online more than 3 hours today, yet I never found any interesting article like yours. It’s pretty worth enough for me. In my opinion, if all webmasters and bloggers made good content as you did, the net will be much more useful than ever before.

  25. Hello.This post was really fascinating, especially since I was looking for thoughts on this issue last week.

  26. Useful information. Lucky me I discovered your site accidentally, and I am shocked why this twist of fate didn’t came about earlier! I bookmarked it.

  27. I think this is one of the most important info for me. And i am glad reading your article. But wanna remark on some general things, The web site style is perfect, the articles is really excellent : D. Good job, cheers

  28. Aw, this was a really nice post. In thought I want to put in writing like this additionally – taking time and actual effort to make an excellent article… however what can I say… I procrastinate alot and on no account seem to get something done.

Leave a Reply

Your email address will not be published.