In this post, I will explain why you should choose Azure Firewall over third-party firewall network virtual appliances (NVAs) from the likes of Cisco, Palo Alto, Check Point, and so on.<\/p>\n
Microsoft has a partner-friendly line on Azure Firewall versus third-parties. Microsoft says that third-party solutions offer more than Azure Firewall. If you want you can use them side-by-side.<\/p>\n
Now that\u2019s out of the way, let me be blunt \u2026 like I\u2019d be anything else! \ud83d\ude0a<\/p>\n
At their base, a firewall blocks or allows TCP\/UDP\/etc and does NAT. Some firewalls offer a \u201csecurity bundle\u201d of extra features such as:<\/p>\n
But those cool things either make no sense in Azure or are just not available from the NVA vendors in their cloud appliances. So what you are left with is central logging and filtering.<\/p>\n
With the exception of Palo Alto (their whitepaper for Azure is very good \u2013 not perfect) and maybe Check Point, the vendors have pretty awful documentation. I\u2019ve been reading a certain data centre mainstay\u2019s documents this week and they are incomplete and rubbish.<\/p>\n
It\u2019s quite clear that some of the vendors are clueless about The Cloud and\/or Azure. Every single vendor has written docs about deploying everything into a single VNet \u2013 if you can afford NVAs then you are not putting all your VMs into a single VNet (see hub & spoke VNet peering). Some have never heard of availability zones \u2013 if you can afford NVAs then you want as high an SLA as you can get. Most do not offer scale-out (active\/active clusters) \u2013 so a single VM becomes your bottleneck on VM performance (3000 Mbps in a D3_v2). Some don\u2019t even support highly available firewall clusters \u2013 so a single VM becomes the single point of failure in your entire cloud network! And their lack of documentation or understanding of VNet peering or route tables in a large cloud deployment is laughable.<\/p>\n
So, what I\u2019m getting at is that the third-party NVAs suck. Azure Firewall isn\u2019t perfect either, but it\u2019s a true cloud platform service and it is improving fast \u2013 just last night Microsoft announced<\/a> Threat Intelligence-Based Filtering and Service Tags Filtering (this appeared recently). I know more things are on the way too \ud83d\ude0a<\/p>\n Here is my breakdown of how Azure Firewall stacks up against firewall NVAs:<\/p>\n
| <\/td>\n | Azure Firewall<\/strong><\/td>\n| NVA<\/strong><\/td>\n<\/tr>\n | Deployment<\/strong><\/td>\n | Platform<\/td>\n | Linux VM + Software<\/td>\n<\/tr>\n | Licensing<\/strong><\/td>\n | Consumption: instance + GB<\/td>\n | Linux VM + Software<\/td>\n<\/tr>\n | Scaling<\/strong><\/td>\n | Automatic<\/td>\n | Add VMs + Software<\/td>\n<\/tr>\n | Ownership<\/strong><\/td>\n | Set & monitor<\/td>\n | Manage VM \/ OS \/ Software<\/td>\n<\/tr>\n | Layer -7<\/strong><\/td>\n | Logging & filtering<\/td>\n | Potentially<\/u><\/em><\/strong>*<\/sup> deep inspection<\/td>\n<\/tr>\n | Networking<\/strong><\/td>\n | 1 subnet & PIP<\/td>\n | 1+ subnets & 1 PIP<\/td>\n<\/tr>\n | Complexity<\/strong><\/td>\n | Simple<\/td>\n | Difficult<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n | I know: you laugh when you hear \u201cMicrosoft\u201d and \u201cFirewall\u201d in the same sentence. You think of ISA Server. Azure Firewall is different. This is baked into the fabric of Azure, the strategic future of Microsoft. It is already rapidly improving, and it does more<\/strong> than the third parties.<\/p>\n Heck, what does the third-party offer compared to NSGs? NSGs filter TCP\/UDP, they can log to a storage account, you can centrally log using Event Hubs, and does advanced reporting\/analysis using NSG Flo Logs with Azure Monitor Logs (Log Analytics). Azure Firewall takes that another step with a hub deployment, an understanding of HTTP\/S, and is now using machine learning for dynamic threat prevention!<\/p>\n Some people will always prefer a non-Microsoft firewall. But my counter would be, what are you getting that is superior \u2013 really? With Azure Firewall, I create a firewall, set my rules, configure my logging, and I\u2019m done. Azure Firewall scales and it is highly available. Logging can be done to storage accounts, event hubs (SIEM), and Azure Monitor Logs. And here\u2019s the best bit \u2026 it is SIMPLE to deploy and there is almost no cost of ownership. Compare that to some of the HACK solutions from the NVA vendors and you’d laugh.<\/p>\n The Azure Firewall was designed for The Cloud. It was designed for the way that Azure works. And it was designed for how we should use The Cloud … at scale. And that scale isn’t just about Mbps, but in terms of backend services and networks. From what I have seen so far, the same cannot be said for firewall NVAs. For me, the decision is easy: Azure Firewall. Every time.<\/p>\n","protected":false},"excerpt":{"rendered":" In this post, I will explain why you should choose Azure Firewall over third-party firewall network virtual appliances (NVAs) from the likes of Cisco, Palo Alto, Check Point, and so on. Microsoft\u2019s Opinion Microsoft has a partner-friendly line on Azure Firewall versus third-parties. Microsoft says that third-party solutions offer more than Azure Firewall. If you … Continue reading “Why Choose the Azure Firewall over a Virtual Firewall Appliance?”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":19553,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"_wpcom_ai_launchpad_first_post":false,"footnotes":""},"categories":[5],"tags":[170,306,311,309,308,242,307,80,305,312,289,281,310],"class_list":["post-21469","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure","tag-azure","tag-azure-firewall","tag-barracuda","tag-check-point","tag-cisco","tag-firewall","tag-network-virtual-appliance","tag-networking","tag-nva","tag-palo-alto","tag-virtual-network","tag-vnet","tag-watchguard"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t |