Skip to content

Commit 8f3bdd8

Browse files
JillGrant615JillGrant615
authored
Merge pull request #311470 from AbdullahBell/firewall-how-to-freshness
Freshness update and formatting improvements for Azure Firewall how-to articles
2 parents 7741604 + 389222b commit 8f3bdd8

4 files changed

Lines changed: 136 additions & 84 deletions

File tree

‎articles/firewall/dns-settings.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ services: firewall
55
author: duau
66
ms.service: azure-firewall
77
ms.topic: how-to
8-
ms.date: 05/15/2025
8+
ms.date: 02/05/2026
99
ms.author: duau
1010
ms.custom:
1111
- devx-track-azurepowershell
@@ -112,7 +112,8 @@ To configure DNS proxy, you must configure your virtual network DNS servers sett
112112
##### Enable DNS proxy
113113

114114
1. Select your Azure Firewall instance.
115-
1. Under **Settings**, select **DNS settings**.
115+
1. Under **Settings**, select **DNS**.
116+
1. Select **Enabled** for **DNS settings**.
116117
1. By default, **DNS Proxy** is disabled. When this setting is enabled, the firewall listens on port 53 and forwards DNS requests to the configured DNS servers.
117118
1. Review the **DNS servers** configuration to make sure that the settings are appropriate for your environment.
118119
1. Select **Save**.

‎articles/firewall/protect-azure-kubernetes-service.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ author: duongau
55
ms.service: azure-firewall
66
services: firewall
77
ms.topic: how-to
8-
ms.date: 09/30/2024
8+
ms.date: 02/05/2026
99
ms.author: duau
1010
ms.custom:
1111
- devx-track-azurecli

‎articles/firewall/protect-azure-virtual-desktop.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ author: duongau
55
ms.service: azure-firewall
66
services: firewall
77
ms.topic: how-to
8-
ms.date: 01/31/2025
8+
ms.date: 02/05/2026
99
ms.author: duau
1010
# Customer intent: As an IT administrator, I want to configure Azure Firewall for Azure Virtual Desktop, so that I can securely manage outbound access and enhance the protection of my virtual desktop environment.
1111
---

‎articles/firewall/tutorial-firewall-deploy-portal.md‎

Lines changed: 131 additions & 80 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ services: firewall
55
author: duongau
66
ms.service: azure-firewall
77
ms.topic: how-to
8-
ms.date: 01/24/2025
8+
ms.date: 02/05/2026
99
ms.author: duau
1010
ms.custom: mvc
1111
#Customer intent: As an administrator new to this service, I want to control outbound network access from resources located in an Azure subnet.
@@ -75,23 +75,36 @@ This virtual network has two subnets.
7575
> [!NOTE]
7676
> The size of the AzureFirewallSubnet subnet is /26. For more information about the subnet size, see [Azure Firewall FAQ](firewall-faq.yml#why-does-azure-firewall-need-a--26-subnet-size).
7777
78-
1. On the Azure portal menu or from the **Home** page, search for **Virtual networks**.
79-
1. Select **Virtual networks** in the result pane.
78+
1. On the Azure portal menu or from the **Home** page, search for and select **Virtual networks**.
8079
1. Select **Create**.
81-
1. For **Subscription**, select your subscription.
82-
1. For **Resource group**, select **Test-FW-RG**.
83-
1. For **Virtual network name**, type **Test-FW-VN**.
84-
1. For **Region**, select **West US**.
80+
1. On the **Basics** tab, configure the following settings:
81+
82+
| Setting | Value |
83+
|---------|-------|
84+
| Subscription | Select your subscription |
85+
| Resource group | **Test-FW-RG** |
86+
| Virtual network name | **Test-FW-VN** |
87+
| Region | **West US** |
88+
8589
1. Select **Next**.
86-
1. On the **Security** tab, select **Enable Azure Firewall**.
87-
1. For **Azure Firewall name**, type **Test-FW01**.
88-
1. For **Azure Firewall public IP address**, select **Create a public IP address**.
89-
1. For **Name**, type **fw-pip** and select **OK**.
90+
1. On the **Security** tab, configure the following settings:
91+
92+
| Setting | Value |
93+
|---------|-------|
94+
| Enable Azure Firewall | Selected |
95+
| Azure Firewall name | **Test-FW01** |
96+
| Tier | **Standard** |
97+
| Policy | **None (Use classic firewall rules)** |
98+
| Azure Firewall public IP address | Select **Create a public IP address**, type **fw-pip** for the name, and select **OK** |
99+
90100
1. Select **Next**.
91-
1. For **Address space**, accept the default **10.0.0.0/16**.
92-
1. Under **Subnets**, select **default** and change the **Name** to **Workload-SN**.
93-
1. For **Starting address**, change it to **10.0.2.0/24**.
94-
1. Select **Save**.
101+
1. On the **IP addresses** tab, configure the following settings:
102+
103+
| Setting | Value |
104+
|---------|-------|
105+
| Address space | Accept the default **10.0.0.0/16** |
106+
| Subnets | Select **default**, change **Name** to **Workload-SN**, and set **Starting address** to **10.0.2.0/24**. Select **Save**. |
107+
95108
1. Select **Review + create**.
96109
1. Select **Create**.
97110

@@ -118,14 +131,17 @@ Now create the workload virtual machine, and place it in the **Workload-SN** sub
118131
|SSH public key source|Generate new key pair|
119132
|Key pair name|**Srv-Work_key**|
120133

121-
4. Under **Inbound port rules**, **Public inbound ports**, select **None**.
122-
6. Accept the other defaults and select **Next: Disks**.
123-
7. Accept the disk defaults and select **Next: Networking**.
124-
8. Make sure that **Test-FW-VN** is selected for the virtual network and the subnet is **Workload-SN**.
125-
9. For **Public IP**, select **None**.
126-
11. Accept the other defaults and select **Next: Management**.
134+
1. On the **Networking** tab, configure the following settings:
135+
136+
| Setting | Value |
137+
|---------|-------|
138+
| Virtual network | **Test-FW-VN** |
139+
| Subnet | **Workload-SN** |
140+
| Public IP | **None** |
141+
142+
1. Accept the other defaults and select **Next: Management**.
127143
1. Accept the defaults and select **Next: Monitoring**.
128-
1. For **Boot diagnostics**, select **Disable** to disable boot diagnostics. Accept the other defaults and select **Review + create**.
144+
1. For **Boot diagnostics**, select **Disable**. Accept the other defaults and select **Review + create**.
129145
1. Review the settings on the summary page, and then select **Create**.
130146
1. On the **Generate new key pair** dialog, select **Download private key and create resource**. Save the key file as **Srv-Work_key.pem**.
131147
1. After the deployment is complete, select **Go to resource** and note the **Srv-Work** private IP address that you'll need to use later.
@@ -142,54 +158,71 @@ Now create the workload virtual machine, and place it in the **Workload-SN** sub
142158

143159
When you create a route for outbound and inbound connectivity through the firewall, a default route to 0.0.0.0/0 with the virtual appliance private IP as a next hop is sufficient. This directs any outgoing and incoming connections through the firewall. As an example, if the firewall is fulfilling a TCP-handshake and responding to an incoming request, then the response is directed to the IP address who sent the traffic. This is by design.
144160

145-
As a result, there's no need create another user defined route to include the AzureFirewallSubnet IP range. This might result in dropped connections. The original default route is sufficient.
161+
As a result, there's no need to create another user defined route to include the AzureFirewallSubnet IP range. This might result in dropped connections. The original default route is sufficient.
146162

147163
For the **Workload-SN** subnet, configure the outbound default route to go through the firewall.
148164

149-
1. On the Azure portal, search for **Route tables**.
150-
1. Select **Route tables** in the results pane.
165+
1. On the Azure portal, search for and select **Route tables**.
151166
1. Select **Create**.
152-
1. For **Subscription**, select your subscription.
153-
1. For **Resource group**, select **Test-FW-RG**.
154-
1. For **Region**, select **West US**.
155-
1. For **Name**, type **Firewall-route**.
167+
1. On the **Basics** tab, configure the following settings:
168+
169+
| Setting | Value |
170+
|---------|-------|
171+
| Subscription | Select your subscription |
172+
| Resource group | **Test-FW-RG** |
173+
| Region | **West US** |
174+
| Name | **Firewall-route** |
175+
| Propagate gateway routes | Select your preference |
176+
156177
1. Select **Review + create**.
157178
1. Select **Create**.
158179

159180
After deployment completes, select **Go to resource**.
160181

161-
1. On the **Firewall-route** page, select **Subnets** and then select **Associate**.
182+
1. On the **Firewall-route** page, select **Settings** > **Subnets** and then select **Associate**.
162183
1. For **Virtual network**, select **Test-FW-VN**.
163184
1. For **Subnet**, select **Workload-SN**. Make sure that you select only the **Workload-SN** subnet for this route, otherwise your firewall won't work correctly.
185+
1. Select **OK**.
186+
1. Select **Routes** and then select **Add**.
187+
1. Configure the route with the following settings:
164188

165-
13. Select **OK**.
166-
14. Select **Routes** and then select **Add**.
167-
15. For **Route name**, type **fw-dg**.
168-
1. For **Destination type**, select **IP Addresses**.
169-
1. For **Destination IP addresses/CIDR ranges**, type **0.0.0.0/0**.
170-
1. For **Next hop type**, select **Virtual appliance**.
189+
| Setting | Value |
190+
|---------|-------|
191+
| Route name | **fw-dg** |
192+
| Destination type | **IP Addresses** |
193+
| Destination IP addresses/CIDR ranges | **0.0.0.0/0** |
194+
| Next hop type | **Virtual appliance**. Azure Firewall is actually a managed service, but virtual appliance works in this situation. |
195+
| Next hop address | The private IP address for the firewall that you noted previously |
171196

172-
Azure Firewall is actually a managed service, but virtual appliance works in this situation.
173-
18. For **Next hop address**, type the private IP address for the firewall that you noted previously.
174-
19. Select **Add**.
197+
1. Select **Add**.
175198

176199
## Configure an application rule
177200

178201
This is the application rule that allows outbound access to `www.google.com`.
179202

180-
1. Open the **Test-FW-RG**, and select the **Test-FW01** firewall.
181-
2. On the **Test-FW01** page, under **Settings**, select **Rules (classic)**.
182-
3. Select the **Application rule collection** tab.
183-
4. Select **Add application rule collection**.
184-
5. For **Name**, type **App-Coll01**.
185-
6. For **Priority**, type **200**.
186-
7. For **Action**, select **Allow**.
187-
8. Under **Rules**, **Target FQDNs**, for **Name**, type **Allow-Google**.
188-
9. For **Source type**, select **IP address**.
189-
10. For **Source**, type **10.0.2.0/24**.
190-
11. For **Protocol:port**, type **http, https**.
191-
12. For **Target FQDNS**, type **`www.google.com`**
192-
13. Select **Add**.
203+
1. Open the **Test-FW-RG** resource group and select the **Test-FW01** firewall.
204+
1. On the **Test-FW01** page, under **Settings**, select **Rules (classic)**.
205+
1. Select the **Application rule collection** tab.
206+
1. Select **Add application rule collection**.
207+
1. Configure the rule collection with the following settings:
208+
209+
| Setting | Value |
210+
|---------|-------|
211+
| Name | **App-Coll01** |
212+
| Priority | **200** |
213+
| Action | **Allow** |
214+
215+
1. Under **Rules**, **Target FQDNs**, configure the following settings:
216+
217+
| Setting | Value |
218+
|---------|-------|
219+
| Name | **Allow-Google** |
220+
| Source type | **IP address** |
221+
| Source | **10.0.2.0/24** |
222+
| Protocol:port | **http, https** |
223+
| Target FQDNs | **`www.google.com`** |
224+
225+
1. Select **Add**.
193226

194227
Azure Firewall includes a built-in rule collection for infrastructure FQDNs that are allowed by default. These FQDNs are specific for the platform and can't be used for other purposes. For more information, see [Infrastructure FQDNs](infrastructure-fqdns.md).
195228

@@ -198,20 +231,28 @@ Azure Firewall includes a built-in rule collection for infrastructure FQDNs that
198231
This is the network rule that allows outbound access to two IP addresses at port 53 (DNS).
199232

200233
1. Select the **Network rule collection** tab.
201-
2. Select **Add network rule collection**.
202-
3. For **Name**, type **Net-Coll01**.
203-
4. For **Priority**, type **200**.
204-
5. For **Action**, select **Allow**.
205-
6. Under **Rules**, **IP addresses**, for **Name**, type **Allow-DNS**.
206-
7. For **Protocol**, select **UDP**.
207-
9. For **Source type**, select **IP address**.
208-
1. For **Source**, type **10.0.2.0/24**.
209-
2. For **Destination type** select **IP address**.
210-
3. For **Destination address**, type **209.244.0.3,209.244.0.4**
211-
212-
These addresses are public DNS servers operated by Level3.
213-
1. For **Destination Ports**, type **53**.
214-
2. Select **Add**.
234+
1. Select **Add network rule collection**.
235+
1. Configure the rule collection with the following settings:
236+
237+
| Setting | Value |
238+
|---------|-------|
239+
| Name | **Net-Coll01** |
240+
| Priority | **200** |
241+
| Action | **Allow** |
242+
243+
1. Under **Rules**, **IP addresses**, configure the following settings:
244+
245+
| Setting | Value |
246+
|---------|-------|
247+
| Name | **Allow-DNS** |
248+
| Protocol | **UDP** |
249+
| Source type | **IP address** |
250+
| Source | **10.0.2.0/24** |
251+
| Destination type | **IP address** |
252+
| Destination address | **209.244.0.3,209.244.0.4** (public DNS servers operated by Level3) |
253+
| Destination Ports | **53** |
254+
255+
1. Select **Add**.
215256

216257
## Deploy Azure Bastion
217258

@@ -220,39 +261,49 @@ Now deploy Azure Bastion to provide secure access to the virtual machine.
220261
1. On the Azure portal menu, select **Create a resource**.
221262
1. In the search box, type **Bastion** and select it from the results.
222263
1. Select **Create**.
223-
1. On the **Create a Bastion** page, configure the following settings:
264+
1. On the **Basics** tab, configure the following settings:
224265

225266
| Setting | Value |
226267
|---------|-------|
227268
| Subscription | Select your subscription |
228269
| Resource group | **Test-FW-RG** |
229270
| Name | **Test-Bastion** |
230-
| Region | West US |
271+
| Region | **West US** |
231272
| Tier | **Developer** |
232273
| Virtual network | **Test-FW-VN** |
233-
| Subnet | Select **Manage subnet configuration** |
274+
| Subnet | Select **Edit subnet** |
275+
276+
1. In the **Edit subnet** page, configure the following settings:
277+
278+
| Setting | Value |
279+
|---------|-------|
280+
| Starting address | **10.0.4.0/26** |
281+
| Size | **/26** |
234282

235-
1. In the **Subnets** page, select **+ Subnet**.
236-
1. Configure the new subnet:
237-
- **Name**: **AzureBastionSubnet** (this name is required)
238-
- **Subnet address range**: **10.0.4.0/26**
239283
1. Select **Save** and close the subnets page.
240284
1. Select **Review + create**.
241285
1. After validation passes, select **Create**.
242286

243-
The Bastion deployment takes about 10 minutes to complete.
287+
> [!NOTE]
288+
> The Bastion deployment takes about 10 minutes to complete. The Developer tier is intended for test and evaluation purposes. For production deployments, review the Azure Bastion SKU options in [Azure Bastion SKU comparison](../bastion/bastion-sku-comparison.md).
244289
245290
### Change the primary and secondary DNS address for the **Srv-Work** network interface
246291

247292
For testing purposes, configure the server's primary and secondary DNS addresses. This isn't a general Azure Firewall requirement.
248293

249294
1. On the Azure portal menu, select **Resource groups** or search for and select *Resource groups* from any page. Select the **Test-FW-RG** resource group.
250-
2. Select the network interface for the **Srv-Work** virtual machine.
251-
3. Under **Settings**, select **DNS servers**.
252-
4. Under **DNS servers**, select **Custom**.
253-
5. Type **209.244.0.3** and press Enter in the **Add DNS server** text box, and **209.244.0.4** in the next text box.
254-
6. Select **Save**.
255-
7. Restart the **Srv-Work** virtual machine.
295+
1. Select the network interface for the **Srv-Work** virtual machine.
296+
1. Under **Settings**, select **DNS servers**.
297+
1. Under **DNS servers**, select **Custom**.
298+
1. Configure the following DNS servers:
299+
300+
| DNS server | Value |
301+
|------------|-------|
302+
| Primary | **209.244.0.3** |
303+
| Secondary | **209.244.0.4** |
304+
305+
1. Select **Save**.
306+
1. Restart the **Srv-Work** virtual machine.
256307

257308
## Test the firewall
258309

0 commit comments

Comments
 (0)