SEP 26, 2023 | Ask-Me-Anything | Azure Firewall, Azure WAF and Azure DDoS

[Valon_Kolica]

UPDATED, post-AMA: Here is the AMA recording in case you

missed the live session.

*************************************************************

Please join us in this Ask Me Anything session with the Azure Network Security CxE PM team. During this session, the Azure Network Security SME (Subject Matter Experts), will answer your questions on Azure Firewall, Azure Firewall Manager, Azure Web Application Firewall and Azure DDoS. This will be a great forum for our Public Community members to learn, interact and have their feedback listened to by the Azure Network Security team. Feel free to post your questions about Azure Network Security solution areas anytime in the comments before the event starts. The team will be answering questions during the live session, with priority given to the pre-submitted questions from the comments below. If you are new to Microsoft Tech-Community, please follow the sign-in instructions. To register for the upcoming live AMA Sep 26, 2023, visit aka.ms/SecurityCommunity. @Mohit_Kumar @andrewmathu @SaleemBseeu  @davidfrazee @ShabazShaik @tobiotolorin @gusmodena

[#2]

Please submit your questions/feedback here.

[#3]

@Valon_Kolica Since Azure Firewall is a highly available solution, I assume that the underlying mechanism for this resource employs some sort of VM/app cluster. Could you give us a bit more insight into how HA is achieved at the backend level? Also, could you let us know if such HA mode is done via either an active-passive (where only one firewall device takes care of the entire traffic load) or active-active (where two or more firewall devices handle the traffic) modes? Finally, how is traffic flow consistency, especially in regard to stateful connections, achieved if HA is done following an active-active model? Thank you

[#4]

@Valon_Kolica 

It might seem obvious but I have not got a consensus (or even a strong trend) on whether it is recommended to have a Firewall in front of the WAF, since we know that this has disadvantages like the visibility and tuning of WAF policies. I would like to hear the architecture recommendation for WAF and FW in a typical hub and spoke customer scenario. If I use WAF in the Hub I could have limitations on distributing Billing per subscription. If I put the WAF with PIP on the spokes I think it goes against the practice of not allowing connectivity from the Internet to an application in an internal zone. I would like to hear clear recommendations on this.

[#5]

Will Azure Firewall support application rules on ports other than 80 and 443.

[#6]

@Valon_Kolica 

I would like to know how Azure Firewall IDPS can be configured in following sceanrio. That is Website traffic/incoming request for site  from Internet->ApplicationGateway (Sku1)->Azure Firewall Premium->Azure App service

In above scenario How do we configure IDPS (Firewall) Certificate. can we use website's third part certificate (intermediate) while configuring TLS/IDPS  or do we need to generate Firewall certificate. Also in Application Gateway do i need to Configure Azure Firewall as backend also upload firewall certificate on Azure Application Gateway.

[#7]

Can you make custom body inspection rules with WAF? For instance if the request body contains some value allow or block connection.

[#8]

Will we be having RBAC based ACLs for Firewall or VPNs?

Scenario - I have 5 VNets in my environment, VNet1......VNet5. All in hub and spoke architecture. with HUB having Azure VPN and possibility of Azure firewall is also there.
I have 3 users, User1.......User3.
All these users are using P2S VPN to connect to Azure.
Conditions -
User1 should only be allowed to access Vnet1 and VNet3.
user2 should be allowed to access VNet2,Vnet3 and VNet5
user3 should be allowed to access only VNet5.
This is one of the major requirements which currently isn't fulfilled by either Azure VPN or Azure Firewall, and I have customers switching to a different NVA provider like Barracuda just for this.

Do we have this feature anywhere in the roadmap?

Thanks!

[#9]

Nice article describing all the scenarios: https://learn.microsoft.com/en-us/azure/architecture/example-scenario/gateway/firewall-application-g...

[#10]

1.how we can backup our rules in firewall?
2.whats best practice for north-south and east west traffic?
3.do we need to have ELB in front of firewall ?

[#11]

@Valon_Kolica 

Is it possible to use the Azure WAF to create an allow list of IP ranges and block traffic from all other sources?

[#12]

sorry new here - is there a webinar link or ? I'm all signed up but not seeing a link...
thx

[#13]

Hi, my enterprise lacks the following capabilities in Azure:
* Firewall doesn't support ASG
* NSG doesn't support IP Groups
* neither Firewall nor NSG support targeting cloud resources (subnets, VMs) by their Resource ID
* ASG doesn't work behind Vnet peering
This makes ASG a useless segmentation construct for my enterprise.

I raised this question on the call, you expressed interest in learning more about these use-cases which I would be more than happy to demonstrate. Let me know how to proceed. :)

[#14]

I think the answer on the call proved the point: We have to choose either Client IPs or IDPS&TI. There is demand for solution that does both. :)
Looks to me that these features could be integrated into WAF/AppGW if Microsoft wanted to.

[#15]

@RodrigoFerraz, Azure Firewall is a cloud-native resource. It is a fully stateful firewall as a service with built-in high availability and unrestricted cloud scalability. It is based off Virtual Machine Scale Set, and by default, there are two active VMSS instances. Azure Firewall gradually scales out when the average throughput or CPU consumption is at 60%, and it takes 5 to 7 minutes. The scale in also happens gradually when the average throughput or CPU consumption is below 20%. Note: The scaling doesn't apply to the Basic SKU, as it has a fixed scale unit to run the service on two virtual machine backend instances.

Azure Firewall doesn't share connection state between the instances. So, in case of scale in a VM instance is put in drain mode for 90 seconds before being recycled. It may also happen when there's a planned maintenance of the Firewall.

For reliability, we recommend deploying Azure Firewall with Availability Zones.

[#16]

@Rahulggupta25, please find my comments below:

1.how we can backup our rules in firewall? Answer: Take a look at the following blog post describing the steps to backup your Azure Firewall.

2.whats best practice for north-south and east west traffic? Answer: Could you elaborate more? You can use the same Azure Firewall deployment to protect both north-south and east-west traffic. Check the recommendations at this Well-Architected Framework document for Azure Firewall.
3.do we need to have ELB in front of firewall? Answer: No, you don't need to create an ELB in front of Azure Firewall. Azure Firewall is high available by design.

[#17]

Is there a way to show replies under the post the reply is to?

[#18]

@joshuabales, yes you can create a custom rule on Azure Web Application Firewall using RemoteAddr (IP address) as your match variable as described here. Custom rules allow you to create your own rules that are evaluated for each request that passes through the WAF and hold a higher priority than the rest of the rules in the managed rule sets. The custom rules contain a rule name, rule priority, and an array of matching conditions. If these conditions are met, an action is taken (to allow, block, or log). If a custom rule is triggered, and an allow or block action is taken, no further custom or managed rules are evaluated. Custom rules can be enabled/disabled on demand.

[#19]

@Tomáš Bohuněk, please submit your feedback via https://aka.ms/azurenetsecfeedback. I would also recommend you joining the Private Community where you can make a difference in helping us shape our products together by reviewing our product roadmaps, co-design participation, feature previews and stay up to date on announcements.

[#20]

For best insights into our roadmap and an opportunity to actively contribute your valuable feedback to our product team, we invite you to join our private community. You can access the community by visiting: https://aka.ms/PrSecCom

To effectively handle scenarios like these, I would recommend utilizing IP groups. With IP groups, you can categorize users based on their source IPs, such as administrators, sales teams, and accounting departments, and then configure your firewall rules accordingly.