Skip to content

Commit 53fb29c

Browse files
duongauduongau
committed
docs: Fix metadata field order and ms.date, fix description, replace 'using' with 'by using', rewrite sentences for clarity
1 parent 20ee2ac commit 53fb29c

1 file changed

Lines changed: 38 additions & 38 deletions

File tree

‎articles/firewall/sql-fqdn-filtering.md‎

Lines changed: 38 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,45 +1,44 @@
11
---
22
title: Configure Azure Firewall application rules with SQL FQDNs
3-
description: In this article, you learn how to configure SQL FQDNs in Azure Firewall application rules.
4-
services: firewall
3+
description: Configure SQL FQDNs in Azure Firewall application rules to control access to SQL server instances from your virtual networks.
54
author: duau
5+
ms.author: duau
66
ms.service: azure-firewall
7-
ms.custom: devx-track-azurecli, devx-track-azurepowershell
87
ms.topic: how-to
9-
ms.date: 10/31/2022
10-
ms.author: duau
8+
ms.date: 03/28/2026
9+
ms.custom: devx-track-azurecli, devx-track-azurepowershell
1110
# Customer intent: "As a network administrator, I want to configure SQL FQDN application rules in Azure Firewall, so that I can control access to specific SQL server instances from my virtual networks."
1211
---
1312

1413
# Configure Azure Firewall application rules with SQL FQDNs
1514

16-
You can now configure Azure Firewall application rules with SQL FQDNs. This allows you to limit access from your virtual networks to only the specified SQL server instances.
15+
You can configure Azure Firewall application rules with SQL FQDNs. This configuration limits access from your virtual networks to only the specified SQL server instances.
1716

18-
With SQL FQDNs, you can filter traffic:
17+
By using SQL FQDNs, you can filter traffic:
1918

20-
- From your VNets to an Azure SQL Database or Azure Synapse Analytics. For example: Only allow access to *sql-server1.database.windows.NET*.
21-
- From on-premises to Azure SQL Managed Instances or SQL IaaS running in your VNets.
22-
- From spoke-to-spoke to Azure SQL Managed Instances or SQL IaaS running in your VNets.
19+
- From your virtual networks to an Azure SQL Database or Azure Synapse Analytics. For example: Only allow access to *sql-server1.database.windows.NET*.
20+
- From on-premises to Azure SQL Managed Instances or SQL IaaS running in your virtual networks.
21+
- From spoke-to-spoke to Azure SQL Managed Instances or SQL IaaS running in your virtual networks.
2322

24-
SQL FQDN filtering is supported in [proxy-mode](/azure/azure-sql/database/connectivity-architecture#connection-policy) only (port 1433). If you use SQL in the default redirect mode, you can filter access using the SQL service tag as part of [network rules](features-by-sku.md#key-basic-features).
23+
SQL FQDN filtering is supported in [proxy-mode](/azure/azure-sql/database/connectivity-architecture#connection-policy) only (port 1433). If you use SQL in the default redirect mode, you can filter access by using the SQL service tag as part of [network rules](features-by-sku.md#key-basic-features).
2524
If you use non-default ports for SQL IaaS traffic, you can configure those ports in the firewall application rules.
2625

27-
## Configure using Azure CLI
26+
## Configure by using Azure CLI
2827

2928
1. Deploy an [Azure Firewall using Azure CLI](deploy-cli.md).
30-
1. If you filter traffic to Azure SQL Database, Azure Synapse Analytics, or SQL Managed Instance, ensure the SQL connectivity mode is set to **Proxy**. To learn how to switch SQL connectivity mode, see [Azure SQL Connectivity Settings](/azure/azure-sql/database/connectivity-settings#change-the-connection-policy-via-the-azure-cli).
29+
1. If you filter traffic to Azure SQL Database, Azure Synapse Analytics, or SQL Managed Instance, set the SQL connectivity mode to **Proxy**. To learn how to switch SQL connectivity mode, see [Azure SQL Connectivity Settings](/azure/azure-sql/database/connectivity-settings#change-the-connection-policy-via-the-azure-cli).
3130

3231
> [!NOTE]
33-
> SQL *proxy* mode can result in more latency compared to *redirect*. If you want to continue using redirect mode, which is the default for clients connecting within Azure, you can filter access using the SQL [service tag](service-tags.md) in firewall [network rules](tutorial-firewall-deploy-portal.md#configure-a-network-rule).
32+
> SQL *proxy* mode can result in more latency compared to *redirect*. If you want to continue using redirect mode, which is the default for clients connecting within Azure, you can filter access by using the SQL [service tag](service-tags.md) in firewall [network rules](tutorial-firewall-deploy-portal.md#configure-a-network-rule).
3433
35-
1. Create a new rule collection with an application rule using SQL FQDN to allow access to a SQL server:
34+
1. Create a new rule collection with an application rule that uses SQL FQDN to allow access to a SQL server:
3635

3736
```azurecli
3837
az extension add -n azure-firewall
39-
40-
az network firewall application-rule create \
38+
39+
az network firewall application-rule create \
4140
--resource-group Test-FW-RG \
42-
--firewall-name Test-FW01 \
41+
--firewall-name Test-FW01 \
4342
--collection-name sqlRuleCollection \
4443
--priority 1000 \
4544
--action Allow \
@@ -49,50 +48,51 @@ If you use non-default ports for SQL IaaS traffic, you can configure those ports
4948
--target-fqdns sql-serv1.database.windows.net
5049
```
5150

52-
## Configure using Azure PowerShell
51+
## Configure by using Azure PowerShell
5352

5453
1. Deploy an [Azure Firewall using Azure PowerShell](deploy-ps.md).
55-
1. If you filter traffic to Azure SQL Database, Azure Synapse Analytics, or SQL Managed Instance, ensure the SQL connectivity mode is set to **Proxy**. To learn how to switch SQL connectivity mode, see [Azure SQL Connectivity Settings](/azure/azure-sql/database/connectivity-settings#change-the-connection-policy-via-the-azure-cli).
54+
1. If you filter traffic to Azure SQL Database, Azure Synapse Analytics, or SQL Managed Instance, set the SQL connectivity mode to **Proxy**. To learn how to switch SQL connectivity mode, see [Azure SQL Connectivity Settings](/azure/azure-sql/database/connectivity-settings#change-the-connection-policy-via-the-azure-cli).
5655

5756
> [!NOTE]
58-
> SQL *proxy* mode can result in more latency compared to *redirect*. If you want to continue using redirect mode, which is the default for clients connecting within Azure, you can filter access using the SQL [service tag](service-tags.md) in firewall [network rules](tutorial-firewall-deploy-portal.md#configure-a-network-rule).
57+
> SQL *proxy* mode can result in more latency compared to *redirect*. If you want to continue using redirect mode, which is the default for clients connecting within Azure, you can filter access by using the SQL [service tag](service-tags.md) in firewall [network rules](tutorial-firewall-deploy-portal.md#configure-a-network-rule).
5958
60-
1. Create a new rule collection with an application rule using SQL FQDN to allow access to a SQL server:
59+
1. Create a new rule collection with an application rule that uses SQL FQDN to allow access to a SQL server:
6160

6261
```azurepowershell
6362
$AzFw = Get-AzFirewall -Name "Test-FW01" -ResourceGroupName "Test-FW-RG"
64-
63+
6564
$sqlRule = @{
6665
Name = "sqlRule"
67-
Protocol = "mssql:1433"
66+
Protocol = "mssql:1433"
6867
TargetFqdn = "sql-serv1.database.windows.net"
6968
SourceAddress = "10.0.0.0/24"
7069
}
71-
70+
7271
$rule = New-AzFirewallApplicationRule @sqlRule
73-
72+
7473
$sqlRuleCollection = @{
75-
Name = "sqlRuleCollection"
76-
Priority = 1000
74+
Name = "sqlRuleCollection"
75+
Priority = 1000
7776
Rule = $rule
7877
ActionType = "Allow"
7978
}
80-
79+
8180
$ruleCollection = New-AzFirewallApplicationRuleCollection @sqlRuleCollection
82-
83-
$Azfw.ApplicationRuleCollections.Add($ruleCollection)
84-
Set-AzFirewall -AzureFirewall $AzFw
81+
82+
$Azfw.ApplicationRuleCollections.Add($ruleCollection)
83+
Set-AzFirewall -AzureFirewall $AzFw
8584
```
8685

87-
## Configure using the Azure portal
88-
1. Deploy an [Azure Firewall using Azure CLI](deploy-cli.md).
89-
1. If you filter traffic to Azure SQL Database, Azure Synapse Analytics, or SQL Managed Instance, ensure the SQL connectivity mode is set to **Proxy**. To learn how to switch SQL connectivity mode, see [Azure SQL Connectivity Settings](/azure/azure-sql/database/connectivity-settings#change-the-connection-policy-via-the-azure-cli).
86+
## Configure by using the Azure portal
87+
88+
1. Deploy an [Azure Firewall using the Azure portal](tutorial-firewall-deploy-portal.md).
89+
1. If you filter traffic to Azure SQL Database, Azure Synapse Analytics, or SQL Managed Instance, set the SQL connectivity mode to **Proxy**. To learn how to switch SQL connectivity mode, see [Azure SQL Connectivity Settings](/azure/azure-sql/database/connectivity-settings#change-the-connection-policy-via-the-azure-cli).
9090

9191
> [!NOTE]
92-
> SQL *proxy* mode can result in more latency compared to *redirect*. If you want to continue using redirect mode, which is the default for clients connecting within Azure, you can filter access using the SQL [service tag](service-tags.md) in firewall [network rules](tutorial-firewall-deploy-portal.md#configure-a-network-rule).
92+
> SQL *proxy* mode can result in more latency compared to *redirect*. If you want to continue using redirect mode, which is the default for clients connecting within Azure, you can filter access by using the SQL [service tag](service-tags.md) in firewall [network rules](tutorial-firewall-deploy-portal.md#configure-a-network-rule).
9393
94-
1. Add the application rule with the appropriate protocol, port, and SQL FQDN and then select **Save**.
95-
1. Access SQL from a virtual machine in a VNet that filters the traffic through the firewall.
94+
1. Add the application rule with the appropriate protocol, port, and SQL FQDN, and then select **Save**.
95+
1. Access SQL from a virtual machine in a virtual network that filters the traffic through the firewall.
9696
1. Validate that [Azure Firewall logs](./firewall-workbook.md) show the traffic is allowed.
9797

9898
## Next steps

0 commit comments

Comments
 (0)