Azure network security uses a layered approach, often called defense-in-depth, where different services protect at different levels of the network. This starts with the Virtual Network (VNet), which creates a private, isolated boundary for your resources. Within the VNet, you apply Network Security Groups (NSGs) directly to subnets or network interfaces to perform basic, stateful packet filtering based on IP addresses and ports. For broader perimeter security, you deploy Azure Firewall as a centralized, managed service that can enforce more complex rules across multiple VNets and inspect traffic from Layer 3 (network) up to Layer 7 (application).
A layered stack diagram showing Azure network security services from the outer perimeter to the inner workloads, including DDoS Protection, Application Gateway WAF, Azure Firewall, Virtual Network, and Network Security Groups, with Azure Monitor observing all layers.
Choosing and placing the right security service depends on the specific threat you need to mitigate and the workload's requirements. Use NSGs for simple, low-cost filtering right at the subnet or VM level. Deploy Azure Firewall when you need a centralized policy for an entire network, advanced threat intelligence, or intrusion detection. For any public-facing endpoint on a VNet, you should enable Azure DDoS Protection Standard to automatically detect and mitigate large-scale volumetric attacks. To protect web applications specifically, you place an Application Gateway with its Web Application Firewall (WAF) in front of your web servers to inspect HTTP/HTTPS traffic for common web exploits.
Optimizing Azure Firewall involves selecting the correct SKU and tuning its rules for performance and cost. The Basic SKU offers simple filtering, the Standard SKU adds threat intelligence feeds, and the Premium SKU provides signature-based intrusion detection and prevention. You optimize rule sets by creating explicit application rules for high-priority traffic first, enabling threat intelligence to block known malicious IPs, and managing throughput by scaling the firewall instance size or enabling autoscaling based on traffic load.
For the Application Gateway WAF, optimization starts by running it in Detection mode to establish a baseline of normal traffic without blocking. Once you understand the traffic patterns, you switch to Prevention mode to actively block identified threats. You can customize its protection by applying managed OWASP core rule sets, enabling bot protection, and creating custom rules for specific needs like geo-filtering or rate limiting. To maintain application performance, you create exclusions for trusted traffic patterns that cause false positives, ensuring the WAF protects effectively without unnecessary disruption.
A complete security solution integrates all these services, with their configurations aligned to meet compliance standards and budget limits. Centralized logging to services like Azure Monitor allows you to continuously evaluate the effectiveness of your NSG, Firewall, DDoS, and WAF configurations. You use this data to adjust rule sets, scale throughput, and ensure the overall network security posture remains resilient and cost-effective against evolving threats.
Venture into the world of Azure Infrastructure, where design meets functionality. Harness your skills and gain mastery over complex cloud structures to ace the AZ-305 Designing Microsoft Azure Infrastructure Solutions exam!
Prepare and test your skills
Prepare and test your skills
Azure Network Security Groups (NSGs) provide simple, low-cost, stateful packet filtering at the subnet or VM level based on IP addresses and ports. Azure Firewall is a centralized, managed service that enforces more complex rules across multiple VNets and inspects traffic from Layer 3 up to Layer 7.
You should use the Azure Firewall Premium SKU when you need signature-based intrusion detection and prevention. The Standard SKU adds threat intelligence feeds, while the Basic SKU offers only simple filtering.
You optimize an Application Gateway WAF by first running it in Detection mode to establish a baseline of normal traffic without blocking. After understanding traffic patterns, you switch to Prevention mode to actively block identified threats, and you can customize protection with managed OWASP rule sets, bot protection, and custom rules.
StudyCerts
StudyCerts