As organizations modernize their applications in Azure, secure and resilient outbound connectivity has become just as critical as inbound security. Workloads need reliable access to external APIs, SaaS services, operating system updates, and partner endpoints, while still meeting strong security controls, predictable egress IPs, and high availability.
Achieving all of this consistently requires using the right networking services together.
To make this easier, we’ve updated the Azure Firewall create experience in the Azure portal to include StandardV2 NAT Gateway directly in the deployment flow. This new experience makes it quick and seamless to adopt a secure, scalable, and zone‑resilient outbound architecture from day one by using Azure Firewall and Azure NAT Gateway together.
In this post, we’ll cover:
- Why pairing Azure Firewall with StandardV2 NAT Gateway is a recommended design
- How this combination simplifies secure and resilient outbound connectivity
- What’s new in the Azure Firewall portal experience and how to get started
Why Azure Firewall and StandardV2 NAT Gateway?
Azure Firewall and Azure NAT Gateway are designed to complement each other, each focusing on what they do best:
Azure NAT Gateway and Azure Firewall deployed in a hub and spoke architecture.- Azure Firewall provides centralized traffic inspection and policy enforcement, including IP address and FQDN filtering, threat intelligence, and logging.
- StandardV2 NAT Gateway delivers high‑scale outbound SNAT, static egress IPs, and built‑in zone redundancy.
StandardV2 NAT Gateway is zone‑redundant by default, automatically spanning availability zones within a region. This means outbound connectivity remains available even during a zonal failure without requiring multiple zonal NAT gateways or additional routing configurations.
Together, this pairing cleanly separates:
- Security policy and inspection handled by Azure Firewall
- Outbound scale, resiliency, and IP predictability handled by NAT Gateway
This separation is key for modern, large‑scale cloud workloads.
A recommended outbound architecture
In a typical hub‑and‑spoke design:
- Workloads in spoke virtual networks route outbound traffic to Azure Firewall in the hub
- Firewall policies inspect and allow the traffic
- StandardV2 NAT Gateway is attached to the AzureFirewallSubnet in the Hub
- Approved traffic flows through StandardV2 NAT Gateway for SNAT
- Traffic exits Azure using static, predictable public IPs
This approach provides several important benefits:
- Scalable SNAT capacity for high‑connection workloads
- Static outbound IPs for partner allow‑listing and compliance
- Zone‑resilient outbound connectivity by default
For step-by-step architectural guidance, see Integrate NAT gateway with Azure Firewall in a hub and spoke architecture.
Built for secure and resilient Azure environments
As customers increasingly adopt availability zones, large‑scale VMSS or AKS deployments, and zero‑trust network models, outbound connectivity must be secure, predictable, and resilient.
By pairing Azure Firewall with StandardV2 NAT Gateway—and now surfacing this pairing directly in the portal create experience—customers can start with a production‑ready outbound architecture that scales with their environment.
What's new in the Azure Firewall create experience in the portal
When creating a new Azure Firewall in the portal, customers can now:
- Select and associate a StandardV2 NAT Gateway during firewall deployment.
- Reduce post‑deployment configuration and manual touches.
- Start with a recommended zone-resilient outbound architecture by default.
By bringing NAT Gateway directly into the Firewall create flow, the portal helps guide customers toward a more secure and scalable outbound setup—without requiring them to stitch services together after the fact.
Get started
You can try the updated experience today by creating a new Azure Firewall in the Azure portal and selecting StandardV2 NAT Gateway during deployment.
With just a couple clicks of a button:
- In the Basics tab, configure your Firewall settings (ex., SKU, policy, virtual network).
- In the *new* Advanced tab, create a new or add an existing StandardV2 NAT gateway and associate StandardV2 public IP addresses or prefixes. The StandardV2 NAT gateway is automatically attached to the Firewall subnet—no additional routing or configuration required.
- Review and Create.
Note: StandardV2 NAT Gateway is not yet available in all regions. If your selected region does not support StandardV2 NAT Gateway, the option to enable StandardV2 NAT gateway will not appear during Firewall creation. Refer to StandardV2 NAT Gateway limitations for more information.
For more details, see:
Microsoft