{"id":14963,"date":"2020-08-04T07:33:20","date_gmt":"2020-08-04T07:33:20","guid":{"rendered":"https:\/\/www.testpreptraining.com\/tutorial\/?page_id=14963"},"modified":"2022-03-15T07:35:54","modified_gmt":"2022-03-15T07:35:54","slug":"deploy-and-configure-azure-firewall","status":"publish","type":"page","link":"https:\/\/www.testpreptraining.ai\/tutorial\/deploy-and-configure-azure-firewall\/","title":{"rendered":"Deploy and configure Azure Firewall"},"content":{"rendered":"\n

This tutorial will guide you through the process to deploy and configure Azure Firewall. Controlling outbound network access is a critical component of a comprehensive network security strategy. You could, for example, want to restrict access to certain websites. You could also wish to restrict access to outgoing IP addresses and ports.<\/p>\n\n\n\n

Set up the network<\/strong><\/h3>\n\n\n\n

To begin, build a resource group to hold the resources required for the firewall deployment. Create a VNet, subnets, and a test server after that.<\/p>\n\n\n\n

Creating a resource group<\/strong><\/h3>\n\n\n\n

All of the tutorial’s resources are housed in the resource group.<\/p>\n\n\n\n

  1. Sign in to the Azure portal.<\/li>
  2. On the Azure portal menu, select Resource groups<\/strong> or search for and select Resource groups<\/em> from any page. Then select Add<\/strong>.<\/li>
  3. For Resource group name<\/strong>, enter Test-FW-RG<\/em>.<\/li>
  4. Also, For Subscription<\/strong>, select your subscription.<\/li>
  5. For Resource group location<\/strong>, select a location. All other resources that you create must be in the same location.<\/li>
  6. Select Create<\/strong>.<\/li><\/ol>\n\n\n\n

    Deploy the firewall<\/strong><\/h3>\n\n\n\n

    Install the firewall within the VNet.<\/p>\n\n\n\n

    1. On the Azure portal menu or from the Home<\/strong> page, select Create a resource<\/strong>.<\/li>
    2. Type firewall<\/strong> in the search box and press Enter<\/strong>.<\/li>
    3. Select Firewall<\/strong> and then select Create<\/strong>.<\/li>
    4. On the Create a Firewall<\/strong> page, use the following table to configure the firewall:TABLE 2SettingValueSubscription<your subscription>Resource groupTest-FW-RG<\/strong>NameTest-FW01<\/strong>LocationSelect the same location that you used previouslyChoose a virtual networkUse existing<\/strong>: Test-FW-VN<\/strong>Public IP addressAdd new<\/strong>
      Name<\/strong>: fw-pip<\/strong><\/li>
    5. Select Review + create<\/strong>.<\/li>
    6. Review the summary, and then select Create<\/strong> to create the firewall.This will take a few minutes to deploy.<\/li>
    7. After deployment completes, go to the Test-FW-RG<\/strong> resource group, and select the Test-FW01<\/strong> firewall.<\/li>
    8. Note the firewall private and public IP addresses. You’ll use these addresses later.<\/li><\/ol>\n\n\n\n

      Creating a default route<\/strong><\/h3>\n\n\n\n

      Configure the outbound default route for the Workload-SN subnet to go via the firewall.<\/p>\n\n\n\n

      1. On the Azure portal menu, select All services<\/strong> or search for and select All services<\/em> from any page.<\/li>
      2. Under Networking<\/strong>, select Route tables<\/strong>.<\/li>
      3. Select Add<\/strong>.<\/li>
      4. For Name<\/strong>, type Firewall-route<\/strong>.<\/li>
      5. Then, For Subscription<\/strong>, select your subscription.<\/li>
      6. For Resource group<\/strong>, select Test-FW-RG<\/strong>.<\/li>
      7. Also, For Location<\/strong>, select the same location that you used previously.<\/li>
      8. Select Create<\/strong>.<\/li>
      9. Select Refresh<\/strong>, and then select the Firewall-route<\/strong> route table.<\/li>
      10. Also, Select Subnets<\/strong> and then select Associate<\/strong>.<\/li>
      11. Select Virtual network<\/strong> > Test-FW-VN<\/strong>.<\/li>
      12. For Subnet<\/strong>, select Workload-SN<\/strong>. Make sure that you select only the Workload-SN<\/strong> subnet for this route, otherwise your firewall won’t work correctly.<\/li>
      13. Select OK<\/strong>.<\/li>
      14. Select Routes<\/strong> and then select Add<\/strong>.<\/li>
      15. For Route name<\/strong>, type fw-dg<\/strong>.<\/li>
      16. For Address prefix<\/strong>, type 0.0.0.0\/0<\/strong>.<\/li>
      17. Also, For Next hop type<\/strong>, select Virtual appliance<\/strong>.Azure Firewall is actually a managed service, but virtual appliance works in this situation.<\/li>
      18. For Next hop address<\/strong>, type the private IP address for the firewall that you noted previously.<\/li>
      19. Select OK<\/strong>.<\/li><\/ol>\n\n\n\n

        Configuring an application rule<\/strong><\/h3>\n\n\n\n

        This is the application rule that enables access to www.google.com from outside the network.<\/p>\n\n\n\n

        1. Open the Test-FW-RG<\/strong>, and select the Test-FW01<\/strong> firewall.<\/li>
        2. On the Test-FW01<\/strong> page, under Settings<\/strong>, select Rules<\/strong>.<\/li>
        3. Select the Application rule collection<\/strong> tab.<\/li>
        4. Select Add application rule collection<\/strong>.<\/li>
        5. For Name<\/strong>, type App-Coll01<\/strong>.<\/li>
        6. Subsequently, For Priority<\/strong>, type 200<\/strong>.<\/li>
        7. For Action<\/strong>, select Allow<\/strong>.<\/li>
        8. Under Rules<\/strong>, Target FQDNs<\/strong>, for Name<\/strong>, type Allow-Google<\/strong>.<\/li>
        9. Also, For Source type<\/strong>, select IP address<\/strong>.<\/li>
        10. For Source<\/strong>, type 10.0.2.0\/24<\/strong>.<\/li>
        11. Furthermore, For Protocol:port<\/strong>, type http, https<\/strong>.<\/li>
        12. For Target FQDNS<\/strong>, type www.google.com<\/code><\/strong><\/li>
        13. Select Add<\/strong>.<\/li><\/ol>\n\n\n\n

          Configure a network rule<\/strong><\/h3>\n\n\n\n

          This is the network rule that permits two IP addresses to access port 53 outward (DNS).<\/p>\n\n\n\n

          1. Select the Network rule collection<\/strong> tab.<\/li>
          2. Select Add network rule collection<\/strong>.<\/li>
          3. For Name<\/strong>, type Net-Coll01<\/strong>.<\/li>
          4. Also, For Priority<\/strong>, type 200<\/strong>.<\/li>
          5. For Action<\/strong>, select Allow<\/strong>.<\/li>
          6. Under Rules<\/strong>, IP addresses<\/strong>, for Name<\/strong>, type Allow-DNS<\/strong>.<\/li>
          7. For Protocol<\/strong>, select UDP<\/strong>.<\/li>
          8. For Source type<\/strong>, select IP address<\/strong>.<\/li>
          9. Also, For Source<\/strong>, type 10.0.2.0\/24<\/strong>.<\/li>
          10. For Destination type<\/strong> select IP address<\/strong>.<\/li>
          11. Also, For Destination address<\/strong>, type 209.244.0.3,209.244.0.4<\/strong>These are public DNS servers operated by CenturyLink.<\/li>
          12. For Destination Ports<\/strong>, type 53<\/strong>.<\/li>
          13. Select Add<\/strong>.<\/li><\/ol>\n\n\n\n

            Configure a DNAT rule<\/strong><\/h3>\n\n\n\n

            Through the firewall, you may connect a remote desktop to the Srv-Work virtual machine using this rule.<\/p>\n\n\n\n

            1. Select the NAT rule collection<\/strong> tab.<\/li>
            2. Select Add NAT rule collection<\/strong>.<\/li>
            3. For Name<\/strong>, type rdp<\/strong>.<\/li>
            4. For Priority<\/strong>, type 200<\/strong>.<\/li>
            5. Under Rules<\/strong>, for Name<\/strong>, type rdp-nat<\/strong>.<\/li>
            6. For Protocol<\/strong>, select TCP<\/strong>.<\/li>
            7. Also, For Source type<\/strong>, select IP address<\/strong>.<\/li>
            8. For Source<\/strong>, type *<\/strong>.<\/li>
            9. Furthermore, For Destination address<\/strong>, type the firewall public IP address.<\/li>
            10. For Destination Ports<\/strong>, type 3389<\/strong>.<\/li>
            11. Also, For Translated address<\/strong>, type the Srv-work<\/strong> private IP address.<\/li>
            12. For Translated port<\/strong>, type 3389<\/strong>.<\/li>
            13. Select Add<\/strong>.<\/li><\/ol>\n\n\n\n

              Test the firewall<\/strong><\/h3>\n\n\n\n

              Now test the firewall to make sure it’s working properly.<\/p>\n\n\n\n

              1. Connect a remote desktop to firewall public IP address and sign in to the Srv-Work<\/strong> virtual machine.<\/li>
              2. Open Internet Explorer and browse to https:\/\/www.google.com<\/code>.<\/li>
              3. Select OK<\/strong> > Close<\/strong> on the Internet Explorer security alerts.You should see the Google home page.<\/li>
              4. Browse to https:\/\/www.microsoft.com<\/code>.You should be blocked by the firewall.<\/li><\/ol>\n\n\n\n

                So now you’ve verified that the firewall rules are working:<\/p>\n\n\n\n