Skip to content

Commit 594d4c5

Browse files
v-regandownerv-regandowner
authored
Merge pull request #314850 from svaldesgzz/aezfwdoc
Add Azure Firewall how-to for Extended Zones
2 parents 57dc623 + 1e5f4ca commit 594d4c5

2 files changed

Lines changed: 210 additions & 0 deletions

File tree

‎articles/extended-zones/TOC.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,8 @@
3939
href: create-azure-policy.md
4040
- name: Encrypt disks with customer-managed keys in an Azure Extended Zone
4141
href: key-vault-encrypt-azure-extended-zone-disk.md
42+
- name: Deploy Azure Firewall in an Extended Zone (Preview)
43+
href: deploy-azure-firewall.md
4244
- name: Arc-enabled PaaS workloads in Extended Zones
4345
items:
4446
- name: Create Arc-Enabled AKS Clusters in Extended Zones

‎articles/extended-zones/deploy-azure-firewall.md‎

Lines changed: 208 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,208 @@
1+
---
2+
title: Deploy Azure Firewall in Azure Extended Zones
3+
description: Learn how to deploy Azure Firewall in Azure Extended Zones using ARM templates, including routing configuration, firewall rules, and deployment validation.
4+
author: svaldesgzz
5+
ms.author: svaldes
6+
ms.service: azure-extended-zones
7+
ms.topic: how-to
8+
ms.date: 03/27/2026
9+
---
10+
11+
# Deploy Azure Firewall in Azure Extended Zones
12+
13+
In this article, you learn how to deploy **Azure Firewall** in **Azure Extended Zones** using ARM templates. It provides setup instructions, including ARM template snippets and deployment validation steps.
14+
15+
Azure Firewall in Azure Extended Zones behaves the same as Azure Firewall in global Azure regions — same SKUs (Standard and Premium), Firewall Policy and rule collections, autoscaling, and availability. The difference is in the setup and deployment. The firewall and its associated resources are created with an `extendedLocation` property, which places them in the extended zone.
16+
17+
> [!IMPORTANT]
18+
> Do **not** create the **AzureFirewallSubnet** manually. It is created automatically by the Azure Firewall service during deployment.
19+
20+
## Prerequisites
21+
22+
- An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/pricing/purchase-options/azure-account?cid=msft_learn).
23+
24+
- Access to an Extended Zone. For more information, see [Request access to an Azure Extended Zone](request-access.md).
25+
26+
## Architecture overview
27+
28+
A typical Azure Firewall deployment in an Extended Zone includes the following resources:
29+
30+
- A virtual network deployed with workload subnets.
31+
- A public IP address.
32+
- Azure Firewall associated with the public IP.
33+
- An optional Firewall Policy with rule collections.
34+
- A route table that forces traffic through the firewall via a default route.
35+
36+
All resources that belong to the Extended Zone are deployed using the parent Azure region as the `location` and the Extended Zone name as the `extendedLocation`. For example, the **Perth** extended zone uses **Australia East** as the parent region.
37+
38+
## ARM template deployment
39+
40+
Use the following ARM template snippets for your own deployments. All Azure Extended Zone resources should have the same pattern: `location` is set to the parent region and `extendedLocation` specifies the extended zone name. Make sure to replace the parameter values with your own, and keep them consistent across all resources.
41+
42+
```json
43+
{
44+
"location": "<parent-region>",
45+
"extendedLocation": { "type": "EdgeZone", "name": "<edge-zone-name>" }
46+
}
47+
```
48+
49+
### Create a virtual network
50+
51+
With the virtual network, create workload subnets only.
52+
> [!NOTE]
53+
> Do not include `AzureFirewallSubnet` in the subnets array. Azure Firewall creates and manages this subnet automatically.
54+
55+
```json
56+
{
57+
"type": "Microsoft.Network/virtualNetworks",
58+
"apiVersion": "2024-05-01",
59+
"name": "[parameters('vnetName')]",
60+
"location": "[parameters('location')]",
61+
"extendedLocation": {
62+
"type": "EdgeZone",
63+
"name": "[parameters('edgeZoneName')]"
64+
},
65+
"properties": {
66+
"addressSpace": {
67+
"addressPrefixes": [ "[parameters('vnetAddressPrefix')]" ]
68+
},
69+
"subnets": [
70+
{
71+
"name": "[parameters('workloadSubnetName')]",
72+
"properties": {
73+
"addressPrefix": "[parameters('workloadSubnetPrefix')]"
74+
}
75+
}
76+
]
77+
}
78+
}
79+
```
80+
81+
### Create a standard public IP
82+
83+
The IP should be Standard SKU with Static allocation method.
84+
85+
```json
86+
{
87+
"type": "Microsoft.Network/publicIPAddresses",
88+
"apiVersion": "2024-05-01",
89+
"name": "[parameters('publicIpName')]",
90+
"location": "[parameters('location')]",
91+
"extendedLocation": {
92+
"type": "EdgeZone",
93+
"name": "[parameters('edgeZoneName')]"
94+
},
95+
"sku": { "name": "Standard" },
96+
"properties": {
97+
"publicIPAllocationMethod": "Static"
98+
}
99+
}
100+
```
101+
102+
### Create Azure Firewall
103+
104+
Firewall SKU can be either Standard or Premium, depending on your needs. Make sure to associate the public IP created in the previous step, and to attach the Firewall Policy (if applicable) correctly in the ARM template.
105+
106+
We recommend using Firewall Policies to manage firewall rules in a more efficient way, but you can also use classic rules if you prefer. Make sure to attach the Firewall Policy to the firewall in the ARM template. For more information on Firewall Policies and rule collections, see [Azure Firewall Policy overview](/azure/firewall/policy-rule-sets).
107+
108+
```json
109+
{
110+
"type": "Microsoft.Network/azureFirewalls",
111+
"apiVersion": "2024-05-01",
112+
"name": "[parameters('firewallName')]",
113+
"location": "[parameters('location')]",
114+
"extendedLocation": {
115+
"type": "EdgeZone",
116+
"name": "[parameters('edgeZoneName')]"
117+
},
118+
"properties": {
119+
"sku": {
120+
"name": "AZFW_VNet",
121+
"tier": "[parameters('firewallSkuTier')]"
122+
},
123+
"firewallPolicy": {
124+
"id": "[resourceId('Microsoft.Network/firewallPolicies', parameters('firewallPolicyName'))]"
125+
},
126+
"ipConfigurations": [
127+
{
128+
"name": "ipconfig",
129+
"properties": {
130+
"publicIPAddress": {
131+
"id": "[resourceId('Microsoft.Network/publicIPAddresses', parameters('publicIpName'))]"
132+
},
133+
"subnet": {
134+
"id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), 'AzureFirewallSubnet')]"
135+
}
136+
}
137+
}
138+
]
139+
}
140+
}
141+
```
142+
143+
### Configure routing
144+
145+
For the routing, add the following default route **0.0.0.0/0**, **VirtualAppliance** and **firewallPrivateIP** to the properties. Associate the route table to workload subnets.
146+
147+
```json
148+
{
149+
"type": "Microsoft.Network/routeTables",
150+
"apiVersion": "2024-05-01",
151+
"name": "[parameters('routeTableName')]",
152+
"location": "[parameters('location')]",
153+
"extendedLocation": {
154+
"type": "EdgeZone",
155+
"name": "[parameters('edgeZoneName')]"
156+
},
157+
"properties": {
158+
"routes": [
159+
{
160+
"name": "default-to-firewall",
161+
"properties": {
162+
"addressPrefix": "0.0.0.0/0",
163+
"nextHopType": "VirtualAppliance",
164+
"nextHopIpAddress": "[parameters('firewallPrivateIp')]"
165+
}
166+
}
167+
]
168+
}
169+
}
170+
```
171+
172+
## Validate the deployment
173+
174+
After deploying all resources, verify the following:
175+
176+
1. Resource placement in the intended extended zone: Firewall, Public IP, and Virtual Network should all show the correct Extended Zone.
177+
178+
2. AzureFirewallSubnet creation: after deployment, it should be visible in the virtual network's subnet list. Do not attempt to create it manually, as this may cause deployment conflicts.
179+
180+
181+
3. Routing configuration: route table should be associated to workload subnets; 0.0.0.0/0 routes to firewall private IP.
182+
183+
184+
4. Firewall rules setup: Firewall Policy (or classic ruleset) should be attached to the firewall and contain the expected rule collections and allow/deny behavior.
185+
186+
5. Traffic flow: test that traffic from workload VMs is correctly processed by the firewall according to the configured rules. If enabled, review firewall logs/hits.
187+
188+
189+
## Clean up resources
190+
191+
When no longer needed, delete the resource group and all resources it contains:
192+
193+
1. In the search box at the top of the portal, enter ***myResourceGroup***. Select **myResourceGroup** from the search results.
194+
195+
1. Select **Delete resource group**.
196+
197+
1. In **Delete a resource group**, enter ***myResourceGroup***, and then select **Delete**.
198+
199+
1. Select **Delete** to confirm the deletion of the resource group and all its resources.
200+
201+
## Related content
202+
203+
- [Azure Firewall documentation](/azure/firewall/overview)
204+
- [Azure Firewall Policy overview](/azure/firewall/policy-rule-sets)
205+
- [Deploy a virtual machine in an Extended Zone](deploy-vm-portal.md)
206+
- [Deploy an AKS cluster in an Extended Zone](deploy-aks-cluster.md)
207+
- [Request access to an Azure Extended Zone](request-access.md)
208+
- [Frequently asked questions](faq.md)

0 commit comments

Comments
 (0)