Forum Discussion
MicrosoftSEP 26, 2023 | Ask-Me-Anything | Azure Firewall, Azure WAF and Azure DDoS
UPDATED, post-AMA: Here is the AMA recording in case you
missed the live session.
*************************************************************
- Will we be having RBAC based ACLs for Firewall or VPNs?
Scenario - I have 5 VNets in my environment, VNet1......VNet5. All in hub and spoke architecture. with HUB having Azure VPN and possibility of Azure firewall is also there.
I have 3 users, User1.......User3.
All these users are using P2S VPN to connect to Azure.
Conditions -
User1 should only be allowed to access Vnet1 and VNet3.
user2 should be allowed to access VNet2,Vnet3 and VNet5
user3 should be allowed to access only VNet5.
This is one of the major requirements which currently isn't fulfilled by either Azure VPN or Azure Firewall, and I have customers switching to a different NVA provider like Barracuda just for this.
Do we have this feature anywhere in the roadmap?
Thanks!- 1.how we can backup our rules in firewall?
2.whats best practice for north-south and east west traffic?
3.do we need to have ELB in front of firewall ?- sorry new here - is there a webinar link or ? I'm all signed up but not seeing a link...
thx
- SaleemBseeuFor best insights into our roadmap and an opportunity to actively contribute your valuable feedback to our product team, we invite you to join our private community. You can access the community by visiting: https://aka.ms/PrSecCom
To effectively handle scenarios like these, I would recommend utilizing IP groups. With IP groups, you can categorize users based on their source IPs, such as administrators, sales teams, and accounting departments, and then configure your firewall rules accordingly.
- Will Azure Firewall support application rules on ports other than 80 and 443.
- Can you make custom body inspection rules with WAF? For instance if the request body contains some value allow or block connection.
Valon_Kolica how does Microsoft position the WAF? As a centrally managed device by a network team? Or decentral managed by an application team? We are building an Azure Landing zone as per CAF. The network edge devices like Azure Firewall etc, are managed by a central team. We see the WAF as a centrally managed device.
- Valon_KolicaPlease submit your questions/feedback here.
It might seem obvious but I have not got a consensus (or even a strong trend) on whether it is recommended to have a Firewall in front of the WAF, since we know that this has disadvantages like the visibility and tuning of WAF policies. I would like to hear the architecture recommendation for WAF and FW in a typical hub and spoke customer scenario. If I use WAF in the Hub I could have limitations on distributing Billing per subscription. If I put the WAF with PIP on the spokes I think it goes against the practice of not allowing connectivity from the Internet to an application in an internal zone. I would like to hear clear recommendations on this.
AlanLaPietraNice article describing all the scenarios: https://learn.microsoft.com/en-us/azure/architecture/example-scenario/gateway/firewall-application-gateway
Valon_Kolica Since Azure Firewall is a highly available solution, I assume that the underlying mechanism for this resource employs some sort of VM/app cluster. Could you give us a bit more insight into how HA is achieved at the backend level? Also, could you let us know if such HA mode is done via either an active-passive (where only one firewall device takes care of the entire traffic load) or active-active (where two or more firewall devices handle the traffic) modes? Finally, how is traffic flow consistency, especially in regard to stateful connections, achieved if HA is done following an active-active model? Thank you
- gusmodena
RodrigoFerraz, Azure Firewall is a cloud-native resource. It is a fully stateful firewall as a service with built-in high availability and unrestricted cloud scalability. It is based off Virtual Machine Scale Set, and by default, there are two active VMSS instances. Azure Firewall gradually scales out when the average throughput or CPU consumption is at 60%, and it takes 5 to 7 minutes. The scale in also happens gradually when the average throughput or CPU consumption is below 20%. Note: The scaling doesn't apply to the Basic SKU, as it has a fixed scale unit to run the service on two virtual machine backend instances.
Azure Firewall doesn't share connection state between the instances. So, in case of scale in a VM instance is put in drain mode for 90 seconds before being recycled. It may also happen when there's a planned maintenance of the Firewall.
For reliability, we recommend deploying Azure Firewall with Availability Zones.
I would like to know how Azure Firewall IDPS can be configured in following sceanrio. That is Website traffic/incoming request for site from Internet->ApplicationGateway (Sku1)->Azure Firewall Premium->Azure App service
In above scenario How do we configure IDPS (Firewall) Certificate. can we use website's third part certificate (intermediate) while configuring TLS/IDPS or do we need to generate Firewall certificate. Also in Application Gateway do i need to Configure Azure Firewall as backend also upload firewall certificate on Azure Application Gateway.
- andrewmathuHello @htakur03,
Thanks for your question.
To begin with, we would recommend that you use Application Gateway (SKU version 2) as Application Gateway (SKU version 1) will be retired - Deprecation Announcement - April 23, 2023 - https://learn.microsoft.com/en-us/azure/application-gateway/v1-retirement.
For the Azure Firewall Premium, the intermediate certificate is used. You can view the certificate requirements from this page - https://learn.microsoft.com/en-us/azure/firewall/premium-certificates. For production deployments, you should use an Enterprise PKI to generate the certificates that you use with Azure Firewall Premium. This is outlined in this document - https://learn.microsoft.com/en-us/azure/firewall/premium-deploy-certificates-enterprise-ca.
For the Application Gateway backend settings, you will use the root certificate of the Azure Firewall. You can check out this link for the end-to-end setup of Application Gateway with Firewall - https://learn.microsoft.com/en-us/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall. You can also check out this blog on Zero Trust with Azure Network Security, which shows the steps when deploying Application Gateway with WAF, Azure Firewall and Azure DDoS - https://techcommunity.microsoft.com/t5/azure-network-security-blog/zero-trust-with-azure-network-security/ba-p/3668280
Is it possible to use the Azure WAF to create an allow list of IP ranges and block traffic from all other sources?
- gusmodena
joshuabales, yes you can create a custom rule on Azure Web Application Firewall using RemoteAddr (IP address) as your match variable as described here. Custom rules allow you to create your own rules that are evaluated for each request that passes through the WAF and hold a higher priority than the rest of the rules in the managed rule sets. The custom rules contain a rule name, rule priority, and an array of matching conditions. If these conditions are met, an action is taken (to allow, block, or log). If a custom rule is triggered, and an allow or block action is taken, no further custom or managed rules are evaluated. Custom rules can be enabled/disabled on demand.
- Is there a way to show replies under the post the reply is to?
