Skip to content

Commit 12bf971

Browse files
JillGrant615JillGrant615
authored
Merge pull request #313455 from mbender-ms/zero-trust-remove-includes
Networking | Maintenance | Replace INCLUDE directives with markdown links in zero-trust-network-security.md
2 parents 7411b1d + 075dafc commit 12bf971

10 files changed

Lines changed: 130 additions & 63 deletions

‎articles/networking/security/includes/25535.md‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,13 @@ ms.custom: Network-Secure-Recommendation
1313
# userimpact: Low
1414
# implementationcost: Medium
1515
---
16-
Azure Firewall is a cloud-native network security service that provides centralized inspection, logging, and enforcement for outbound traffic. However, using Azure Firewall alone for outbound connectivity can lead to SNAT port exhaustion under high-traffic workloads. The recommendation is to deploy NAT Gateway alongside Azure Firewall — Azure Firewall handles outbound security inspection (threat intelligence filtering, intrusion detection and prevention, TLS inspection, and egress policy enforcement), while NAT Gateway provides scalable SNAT ports for the actual outbound traffic flow. In a secure network architecture, outbound traffic from VNet-integrated workloads such as VMs, AKS clusters, App Service, and Functions should be explicitly routed through Azure Firewall before reaching external services, with NAT Gateway configured on the AzureFirewallSubnet to handle outbound translation. Without this combined approach, organizations risk either uninspected outbound traffic or SNAT port exhaustion leading to dropped connections. This check verifies that effective network routes direct outbound traffic to the firewall's private IP address for eligible workloads across all subscriptions.
16+
Azure Firewall is a cloud-native network security service that provides centralized inspection, logging, and enforcement for outbound traffic. In a secure network architecture, outbound traffic from VNet-integrated workloads such as VMs, AKS clusters, App Service, and Functions should be explicitly routed through Azure Firewall before reaching external services. This routing ensures that outbound security inspection — including threat intelligence filtering, intrusion detection and prevention, TLS inspection, and egress policy enforcement — is applied to all outbound flows. Without this routing, outbound traffic bypasses the firewall entirely, leaving the environment exposed to data exfiltration and command-and-control communication. This check verifies that effective network routes direct outbound traffic to the firewall's private IP address for eligible workloads across all subscriptions.
17+
18+
For high-traffic workloads that risk SNAT port exhaustion, consider deploying [Azure NAT Gateway alongside Azure Firewall](/azure/firewall/integrate-with-nat-gateway). NAT Gateway provides up to 64,512 SNAT ports per public IP address compared to Azure Firewall's 2,496 SNAT ports per public IP per instance. When associated with the AzureFirewallSubnet, NAT Gateway handles outbound translation while Azure Firewall continues to inspect traffic — with no double NAT.
1719

1820
**Remediation action**
1921

20-
- [Configure Azure Firewall routing](/azure/firewall/tutorial-firewall-deploy-portal#configure-routing)
22+
- [Configure Azure Firewall routing](/azure/firewall/tutorial-firewall-deploy-portal#create-a-default-route)
2123
- [Manage route tables and routes](/azure/virtual-network/manage-route-table)
2224
- [Control App Service outbound traffic with Azure Firewall](/azure/app-service/network-secure-outbound-traffic-azure-firewall)
2325
- [Azure Firewall security rules](/azure/firewall/rule-processing)

‎articles/networking/security/includes/25537.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ ms.custom: Network-Secure-Recommendation
1515
---
1616
Azure Firewall Threat Intelligence-based filtering alerts and denies traffic from and to known malicious IP addresses, fully qualified domain names (FQDNs), and URLs sourced from the Microsoft Threat Intelligence feed. When enabled, Azure Firewall evaluates traffic against threat intelligence rules before applying network address translation (NAT), network, or application rules. This check verifies that Threat Intelligence is enabled in "Alert and deny" mode in the Azure Firewall policy. Without this feature enabled, the environment remains exposed to known malicious IPs, domains, and URLs, creating risk of compromise or data exfiltration.
1717

18+
> [!NOTE]
19+
> "Alert and deny" mode requires Azure Firewall Standard or Premium. Azure Firewall Basic supports alert mode only. For a full feature comparison, see [Choose the right Azure Firewall SKU](/azure/firewall/choose-firewall-sku).
20+
1821
**Remediation action**
1922

2023
- [Azure Firewall threat intelligence configuration](/azure/firewall-manager/threat-intelligence-settings)

‎articles/networking/security/includes/26885.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ Azure DDoS Protection provides advanced mitigation capabilities for public IP ad
1717

1818
**Remediation action**
1919

20-
- [Configure Azure DDoS Protection metrics and diagnostic logs](/azure/ddos-protection/diagnostic-logging)
20+
- [Configure Azure DDoS Protection metrics and diagnostic logs](/azure/ddos-protection/ddos-view-diagnostic-logs)
2121
- [Configure diagnostic settings for Azure resources](/azure/azure-monitor/essentials/diagnostic-settings)
2222
- [Azure DDoS Protection overview](/azure/ddos-protection/ddos-protection-overview)
2323
- [Create and configure Azure DDoS Network Protection using the Azure portal](/azure/ddos-protection/manage-ddos-protection)

‎articles/networking/security/includes/26886.md‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,5 @@ When Azure DDoS Protection is enabled for public IP addresses, diagnostic loggin
1717

1818
**Remediation action**
1919

20-
- [Configure Azure DDoS Protection diagnostic logging](/azure/ddos-protection/diagnostic-logging)
21-
- [View and configure DDoS diagnostic logs](/azure/ddos-protection/diagnostic-logging#configure-ddos-diagnostic-logs)
22-
- [Azure DDoS Protection monitoring and logging](/azure/ddos-protection/monitor-ddos-protection)
23-
- [View and analyze DDoS logs](/azure/ddos-protection/monitor-ddos-protection)
20+
- [View and configure DDoS Protection diagnostic logs](/azure/ddos-protection/ddos-view-diagnostic-logs)
21+
- [Monitor Azure DDoS Protection](/azure/ddos-protection/monitor-ddos-protection)

‎articles/networking/security/index.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,10 @@ highlightedContent:
2525
itemType: overview # controls the icon image and super-title text
2626
url: /azure/networking/security/network-security
2727
# Card
28+
- title: Azure network security Zero Trust recommendations
29+
itemType: concept
30+
url: /azure/networking/security/zero-trust-network-security
31+
# Card
2832
- title: Azure best practices for network security
2933
itemType: concept
3034
url: ../../security/fundamentals/network-best-practices.md

‎articles/networking/security/zero-trust-application-gateway-waf.md‎

Lines changed: 31 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -17,16 +17,37 @@ For a summary of all Azure network security Zero Trust recommendations, see [Azu
1717

1818
## Recommendations
1919

20-
| Recommendation | Risk level | User impact | Implementation cost |
21-
|---|---|---|---|
22-
| [!INCLUDE [Application Gateway WAF is enabled in prevention mode](includes/25541.md)] | High | Low | Low |
23-
| [!INCLUDE [Request body inspection is enabled in Application Gateway WAF](includes/26879.md)] | High | Low | Low |
24-
| [!INCLUDE [Default rule set is enabled in Application Gateway WAF](includes/26881.md)] | High | Low | Low |
25-
| [!INCLUDE [Bot protection rule set is enabled and assigned in Application Gateway WAF](includes/26882.md)] | High | Low | Low |
26-
| [!INCLUDE [HTTP DDoS protection rule set is enabled in Application Gateway WAF](includes/27015.md)] | High | Low | Low |
27-
| [!INCLUDE [Rate limiting is enabled in Application Gateway WAF](includes/27016.md)] | High | Low | Medium |
28-
| [!INCLUDE [JavaScript challenge is enabled in Application Gateway WAF](includes/27017.md)] | Medium | Low | Low |
29-
| [!INCLUDE [Diagnostic logging is enabled in Application Gateway WAF](includes/26888.md)] | High | Low | Low |
20+
### Application Gateway WAF is enabled in prevention mode
21+
22+
[!INCLUDE [Application Gateway WAF is enabled in prevention mode](includes/25541.md)]
23+
24+
### Request body inspection is enabled in Application Gateway WAF
25+
26+
[!INCLUDE [Request body inspection is enabled in Application Gateway WAF](includes/26879.md)]
27+
28+
### Default rule set is enabled in Application Gateway WAF
29+
30+
[!INCLUDE [Default rule set is enabled in Application Gateway WAF](includes/26881.md)]
31+
32+
### Bot protection rule set is enabled and assigned in Application Gateway WAF
33+
34+
[!INCLUDE [Bot protection rule set is enabled and assigned in Application Gateway WAF](includes/26882.md)]
35+
36+
### HTTP DDoS protection rule set is enabled in Application Gateway WAF
37+
38+
[!INCLUDE [HTTP DDoS protection rule set is enabled in Application Gateway WAF](includes/27015.md)]
39+
40+
### Rate limiting is enabled in Application Gateway WAF
41+
42+
[!INCLUDE [Rate limiting is enabled in Application Gateway WAF](includes/27016.md)]
43+
44+
### JavaScript challenge is enabled in Application Gateway WAF
45+
46+
[!INCLUDE [JavaScript challenge is enabled in Application Gateway WAF](includes/27017.md)]
47+
48+
### Diagnostic logging is enabled in Application Gateway WAF
49+
50+
[!INCLUDE [Diagnostic logging is enabled in Application Gateway WAF](includes/26888.md)]
3051

3152
## Related content
3253

‎articles/networking/security/zero-trust-azure-firewall.md‎

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,25 @@ For a summary of all Azure network security Zero Trust recommendations, see [Azu
1717

1818
## Recommendations
1919

20-
| Recommendation | Risk level | User impact | Implementation cost |
21-
|---|---|---|---|
22-
| [!INCLUDE [Outbound traffic from VNet-integrated workloads is routed through Azure Firewall](includes/25535.md)] | High | Low | Medium |
23-
| [!INCLUDE [Threat intelligence is enabled in deny mode on Azure Firewall](includes/25537.md)] | High | Low | Low |
24-
| [!INCLUDE [IDPS inspection is enabled in deny mode on Azure Firewall](includes/25539.md)] | High | Low | Low |
25-
| [!INCLUDE [Inspection of outbound TLS traffic is enabled on Azure Firewall](includes/25550.md)] | High | Low | Low |
26-
| [!INCLUDE [Diagnostic logging is enabled in Azure Firewall](includes/26887.md)] | High | Low | Low |
20+
### Outbound traffic from VNet-integrated workloads is routed through Azure Firewall
21+
22+
[!INCLUDE [Outbound traffic from VNet-integrated workloads is routed through Azure Firewall](includes/25535.md)]
23+
24+
### Threat intelligence is enabled in deny mode on Azure Firewall
25+
26+
[!INCLUDE [Threat intelligence is enabled in deny mode on Azure Firewall](includes/25537.md)]
27+
28+
### IDPS inspection is enabled in deny mode on Azure Firewall
29+
30+
[!INCLUDE [IDPS inspection is enabled in deny mode on Azure Firewall](includes/25539.md)]
31+
32+
### Inspection of outbound TLS traffic is enabled on Azure Firewall
33+
34+
[!INCLUDE [Inspection of outbound TLS traffic is enabled on Azure Firewall](includes/25550.md)]
35+
36+
### Diagnostic logging is enabled in Azure Firewall
37+
38+
[!INCLUDE [Diagnostic logging is enabled in Azure Firewall](includes/26887.md)]
2739

2840
## Related content
2941

‎articles/networking/security/zero-trust-ddos-protection.md‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,11 +17,17 @@ For a summary of all Azure network security Zero Trust recommendations, see [Azu
1717

1818
## Recommendations
1919

20-
| Recommendation | Risk level | User impact | Implementation cost |
21-
|---|---|---|---|
22-
| [!INCLUDE [DDoS Protection is enabled for all public IP addresses in VNets](includes/25533.md)] | High | Low | Low |
23-
| [!INCLUDE [Metrics are enabled for DDoS-protected public IPs](includes/26885.md)] | Medium | Low | Low |
24-
| [!INCLUDE [Diagnostic logging is enabled for DDoS-protected public IPs](includes/26886.md)] | Medium | Low | Low |
20+
### DDoS Protection is enabled for all public IP addresses in VNets
21+
22+
[!INCLUDE [DDoS Protection is enabled for all public IP addresses in VNets](includes/25533.md)]
23+
24+
### Metrics are enabled for DDoS-protected public IPs
25+
26+
[!INCLUDE [Metrics are enabled for DDoS-protected public IPs](includes/26885.md)]
27+
28+
### Diagnostic logging is enabled for DDoS-protected public IPs
29+
30+
[!INCLUDE [Diagnostic logging is enabled for DDoS-protected public IPs](includes/26886.md)]
2531

2632
## Related content
2733

‎articles/networking/security/zero-trust-front-door-waf.md‎

Lines changed: 31 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -17,16 +17,37 @@ For a summary of all Azure network security Zero Trust recommendations, see [Azu
1717

1818
## Recommendations
1919

20-
| Recommendation | Risk level | User impact | Implementation cost |
21-
|---|---|---|---|
22-
| [!INCLUDE [Azure Front Door WAF is enabled in prevention mode](includes/25543.md)] | High | Low | Low |
23-
| [!INCLUDE [Request body inspection is enabled in Azure Front Door WAF](includes/26880.md)] | High | Low | Low |
24-
| [!INCLUDE [Default rule set is assigned in Azure Front Door WAF](includes/26883.md)] | High | Low | Low |
25-
| [!INCLUDE [Bot protection rule set is enabled and assigned in Azure Front Door WAF](includes/26884.md)] | High | Low | Low |
26-
| [!INCLUDE [Rate limiting is enabled in Azure Front Door WAF](includes/27018.md)] | High | Low | Medium |
27-
| [!INCLUDE [JavaScript challenge is enabled in Azure Front Door WAF](includes/27019.md)] | Medium | Low | Low |
28-
| [!INCLUDE [CAPTCHA challenge is enabled in Azure Front Door WAF](includes/27020.md)] | Medium | Low | Low |
29-
| [!INCLUDE [Diagnostic logging is enabled in Azure Front Door WAF](includes/26889.md)] | High | Low | Low |
20+
### Azure Front Door WAF is enabled in prevention mode
21+
22+
[!INCLUDE [Azure Front Door WAF is enabled in prevention mode](includes/25543.md)]
23+
24+
### Request body inspection is enabled in Azure Front Door WAF
25+
26+
[!INCLUDE [Request body inspection is enabled in Azure Front Door WAF](includes/26880.md)]
27+
28+
### Default rule set is assigned in Azure Front Door WAF
29+
30+
[!INCLUDE [Default rule set is assigned in Azure Front Door WAF](includes/26883.md)]
31+
32+
### Bot protection rule set is enabled and assigned in Azure Front Door WAF
33+
34+
[!INCLUDE [Bot protection rule set is enabled and assigned in Azure Front Door WAF](includes/26884.md)]
35+
36+
### Rate limiting is enabled in Azure Front Door WAF
37+
38+
[!INCLUDE [Rate limiting is enabled in Azure Front Door WAF](includes/27018.md)]
39+
40+
### JavaScript challenge is enabled in Azure Front Door WAF
41+
42+
[!INCLUDE [JavaScript challenge is enabled in Azure Front Door WAF](includes/27019.md)]
43+
44+
### CAPTCHA challenge is enabled in Azure Front Door WAF
45+
46+
[!INCLUDE [CAPTCHA challenge is enabled in Azure Front Door WAF](includes/27020.md)]
47+
48+
### Diagnostic logging is enabled in Azure Front Door WAF
49+
50+
[!INCLUDE [Diagnostic logging is enabled in Azure Front Door WAF](includes/26889.md)]
3051

3152
## Related content
3253

0 commit comments

Comments
 (0)