Determine when to use Azure Firewall.
Key takeaway 1
Session objective(s): help you prepare for
Implement Azure Firewall including firewall exam AZ‐900, AZ 104 & AZ 700 Exam
rules
Key takeaway 2
Exam study material, links, resources
Key takeaway 3
Exam topics and breakdown of questions
Your company is spread across multiple Azure regions. The networking infrastructure includes
multiple virtual networks and connections to an on‐premises network.
The IT staff is concerned about malicious actors trying to infiltrate the network.
You need to implement Azure Firewall. You need to configure Azure Firewall to deny incoming and
outgoing threats while also allowing legitimate traffic.
• You can centrally create,
enforce, and log application
and network connectivity
policies across subscriptions
and virtual networks.
• Depends upon your size of
data center multiple firewall
instance required
Its a fully stateful firewall as a service with built‐in high availability and unrestricted cloud scalability.
You can centrally create, enforce, and log application and network connectivity policies across
subscriptions and virtual networks.
Managed network security service to control traffic In & Out of an Azure Virtual network
Centralized configuration : With one azure firewall you can control traffic to multiple virtual network
across multiple subscription also
Eg : If your enterprise has 10 Virtual networks across multiple subscriptions with 100 + VMs, you
can control traffic with one azure firewall
Integrate with Azure Monitor and provides Loggins and Analytics
Azure firewall is for all resource
It's recommended to use a hub‐spoke network topology when deploying a firewall.
The hub is a virtual network in Azure that acts as a central point of connectivity to your on‐premises
network.
The spokes are virtual networks that peer with the hub and can be used to isolate workloads.
Traffic flows between the on‐premises datacenter and the hub through an ExpressRoute or VPN
gateway connection.
By default, Azure Firewall blocks all traffic, unless you enable it.
There are three kinds of rules that you can configure in the Azure Firewall.
An Azure Firewall denies all traffic by default, until rules are manually configured to allow traffic.
When a packet is being inspected to determine if it is allowed or not, the rules are processed in this
order:
Network Rules
Application Rules (network and application)
Once a rule is found that allows the traffic through, no more rules are checked.
Module - Labs
Knowledge Check
Midway Quiz
Q 1 :‐ Suppose a company wants to allow access to an Azure SQL Database instance using a FQDN
address. Which of the following network rule types should they use to configure Azure firewall?
A. Application
B. NAT
C. Network Rule
Midway Quiz
Q 2 :‐ Which of the following describes the Azure firewall IP address?
A. The firewall has a dynamically assigned public IP address.
B. The firewall has a statically assigned public IP address
C. The firewall has an IP address assigned from a pool of designated addresses.
Module Review Questions Microsoft Learn Modules ([Link]/Learn)
• Azure Firewall acts as a barrier between your Azure
virtual network and the internet
• Azure Firewall examines all inbound and outbound
traffic.
• Azure Firewall uses threat intelligence, rules, and other
policy settings to allow legitimate traffic and deny
threatening or unknown traffic.
End of presentation
Thank You