Microsoft blogged a couple of posts in the last month to announce some interesting news about Azure Firewall, a resource that I\u2019m using with every customer that I dealt with in the last year.<\/p>\n
I first played with Azure Firewall Manager in the Secure Virtual Hub preview. Now the feature is in preview with the \u201cnetwork SKU\u201d of Azure Firewall. The concept starts with Azure Firewall Manager, an Azure Portal GUI that isn\u2019t a resource; it\u2019s a way to centrally manage one or more Azure Firewall resources in one region or in many regions.<\/p>\n
Azure Firewall Manager does control a new top-level resource: a firewall policy. Policies move the management of Azure Firewall configuration and rules from the firewall resource to the policy resource. You can create a simple hierarchy of policies.<\/p>\n
For example, I find myself creating the same collections\/rules in every Azure Firewall; if a customer has 3 network deployments around the world with identical base requirements then you can create a \u201cparent\u201d policy. Then you can create a child policy for each firewall instance that is a child of the parent; that means it inherits the current and future configurations of the parent policy. And then you associate the child policy with the correct firewall. Now you do the network-specific changes in the child. Any future global changes go into the parent, and they will inherit down to each firewall.<\/p>\n
Cool, right?<\/p>\n
This is another cool top-level resource. Let\u2019s say I\u2019m managing an Azure Firewall with a site-to-site network connection. There\u2019s a pretty good chance that I am constantly creating rules for specific groups of addresses, sets of networks, or even all the \u201csuper-nets\u201d of the WAN. Do I really want to remember\/type each of those addresses? Surely a mistake will be made?<\/p>\n
IP Groups allow you to create an abstraction. For example, I can put each of my WAN super-nets into an IP Group resource called wan-ipg. Then I can use wan-ipg instead of listing each address. Nice!<\/p>\n
One of those base configurations that I\u2019m constantly deploying is to enable Active Directory Domain Services (ADDS) domain controllers to replicate through the Azure Firewall. If you go look at the TCP\/UDP requirements you\u2019ll find that one of the rules requires a huge range, with the high port being 65535. However, Azure Firewall only supported up to TCP\/UDP 64000. It did not affect me, but there were reports of issues with ADDS replication. Now you can create rules up to the normal maximum port number.<\/p>\n
This is for those of you who live in 1990 or have tinfoil on your heads. Now you can force all outbound traffic to go back to on-premises instead of to the Internet. I guess that this one is for the US government or someone with equally large purchasing power (influence).<\/p>\n
I\u2019m working with a customer that has used public IP addressing behind their on-premises firewall. One of my colleagues at work has a similar customer. I know of others with the same sort of customer.<\/p>\n
Azure Firewall has not been compatible with that configuration. Imagine this:<\/p>\n
And that\u2019s where it all goes wrong. Azure Firewall sees that the destination is a non-RFC1918 IP address (not 10.0.0.0\/8, 172.16.0.0\/12, or 192.168.0.0\/16) and forcefully SNAT\u2019s the packets to the Internet, and the packets never reach the on-premises destination.<\/p>\n
With this update, you can use PowerShell\/JSON to configure public IP ranges that are to route via the AzureFirewallSubnet (propagated routes from GatewaySubnet) and not to the Internet.<\/p>\n
Certifications are good, and some customers probably compare using these sorts of things.<\/p>\n","protected":false},"excerpt":{"rendered":"
Microsoft blogged a couple of posts in the last month to announce some interesting news about Azure Firewall, a resource that I\u2019m using with every customer that I dealt with in the last year. New Azure Firewall certification and features in Q1 CY2020 Azure Firewall Manager now supports virtual networks Azure Firewall Manager (Preview) I … Continue reading “Azure Firewall Improvements – February 2020”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":21812,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"_wpcom_ai_launchpad_first_post":false,"footnotes":""},"categories":[5],"tags":[170,306],"class_list":["post-21813","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure","tag-azure","tag-azure-firewall"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t