What's changed: Deepened AZ-500 Chapter 2 (ja figures; comparison tables/scenarios/FAQ/traps/deep paragraphs in all sections)
2.2Azure Firewall and Secure Management Access
Understand Azure Firewall for centralized VNet traffic control, Azure Bastion for secure VM access without public IPs, and NAT gateway to consolidate outbound to one IP—the basics of perimeter defense and secure operational access.
If NSGs control individual subnets/NICs, Azure Firewall is a stateful, centralized firewall for the whole VNet. Management access to VMs is then done securely via Bastion.
2.2.1Perimeter defense and operational access
For large hub-and-spoke topologies, use Azure Virtual WAN with a secured virtual hub hosting Azure Firewall to centrally inspect and route branch-to-branch and VNet-to-VNet traffic. For server threat protection, the Microsoft Defender for Servers plan in Microsoft Defender for Cloud provides vulnerability assessment, agentless scanning, and JIT.
- Azure Firewall: a stateful, centralized firewall with FQDN-based application rules, network rules, and threat intelligence.
- Bastion: connect via RDP/SSH from the browser without assigning public IPs to VMs.
- NAT gateway: consolidate outbound to a single public IP, avoiding direct inbound reachability to VMs.
- Hub-and-spoke: it’s common to centralize the firewall in a hub VNet and inspect traffic for multiple spoke VNets.
Common on AZ-500: centralized stateful firewall for the whole VNet = Azure Firewall, secure VM access without public IPs = Bastion, consolidate outbound to one IP = NAT gateway. Use Firewall for FQDN-based control (NSGs are IP/port only).
Exposing VM public IPs with open RDP/SSH ports to the internet is risky. Use Bastion or Just-In-Time VM access (Defender for Cloud).
Azure Firewall rules come in three kinds: application rules allow egress by FQDN (e.g., *.windows.net), network rules control by IP/port/protocol, and DNAT rules translate inbound to internal resources (port forwarding). To force all VNet egress through the firewall, a user-defined route (UDR) points the 0.0.0.0/0 next hop to the firewall’s private IP. A Firewall Policy applies rules centrally across multiple firewalls; IDPS (intrusion detection/prevention) and TLS inspection are Premium-SKU features. For operational access, Bastion is a standing jump host, whereas JIT VM access inserts a temporary allow rule into the NSG/Firewall only when needed and auto-closes it when the window ends.
| Need | Use | Layer/notes |
|---|---|---|
| Allow/deny at subnet/NIC | NSG | L3/L4, distributed, stateful but not centralized |
| Centralized VNet control, FQDN filtering | Azure Firewall | L3–L7, centralized, threat intel, IDPS on Premium |
| VM mgmt access without public IP | Bastion | Browser RDP/SSH, standing jump host |
| Open mgmt ports only temporarily | JIT VM access | Defender for Cloud, time-bound allow |
Scenario: multiple spoke VNets, and you must inspect all egress and allow only approved FQDNs out. → Place Azure Firewall in a hub VNet, apply a UDR (0.0.0.0/0 → firewall private IP) to each spoke subnet, and define allowed FQDNs in the firewall’s application rules. Centralize management access on a Bastion in the hub.
FAQ: Q. If I have NSGs, do I still need Azure Firewall? → A. Different roles—NSGs are distributed allow/deny; Firewall adds centralized control, FQDN filtering, and threat intel. Most designs use both. Q. Bastion vs VPN/JIT? → A. Bastion is an always-available browser jump host; JIT keeps ports closed and opens them temporarily only when needed.
Trap: “use an NSG to allow egress by FQDN (domain name)” is wrong—NSGs are IP/port only; FQDN-based control is Azure Firewall application rules. Also “Bastion requires the VM to have a public IP” is wrong—Bastion removes that need.
2.2.2Section summary
- Azure Firewall = centralized, stateful, FQDN rules
- Bastion = secure RDP/SSH without public IP, NAT = consolidate outbound IP
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which stateful managed firewall centrally controls VNet traffic with FQDN-based app rules and threat intelligence?
Q2. You want secure browser-based RDP/SSH to a VM without assigning it a public IP. What do you use?
Q3. Which correctly distinguishes an NSG from Azure Firewall?