Azure Firewall for outbound inspection

Cost check: the clock starts when the firewall is created in step 2. Keep this lesson open and finish it in one go.

1Prepare the hub

Add the management subnet Basic needs, two public IPs and a Basic firewall policy:

az network vnet subnet create --resource-group rg-saat-hub --vnet-name vnet-hub --name AzureFirewallManagementSubnet --address-prefixes 10.40.1.64/26 -o none
az network public-ip create --resource-group rg-saat-hub --name pip-fw --sku Standard --tags course=saatvedha-azure lesson=48 -o none
az network public-ip create --resource-group rg-saat-hub --name pip-fw-mgmt --sku Standard --tags course=saatvedha-azure lesson=48 -o none
az network firewall policy create --resource-group rg-saat-hub --name fwp-saat --sku Basic --tags course=saatvedha-azure lesson=48 -o none
az network firewall policy rule-collection-group create --resource-group rg-saat-hub --policy-name fwp-saat --name rcg-saat --priority 200 -o none

The firewall commands live in the azure-firewall CLI extension. If the CLI asks to install it, answer yes.

2Create the firewall

This takes 5 to 10 minutes:

az network firewall create --resource-group rg-saat-hub --name fw-saat --sku AZFW_VNet --tier Basic --vnet-name vnet-hub --conf-name fw-ipconfig --public-ip pip-fw --m-conf-name fw-mgmt --m-public-ip pip-fw-mgmt --firewall-policy fwp-saat --tags course=saatvedha-azure lesson=48 -o none
$fwIp = az network firewall show --resource-group rg-saat-hub --name fw-saat --query "ipConfigurations[0].privateIPAddress" -o tsv
$fwIp

You should see this:

10.40.1.4

3Send the spokes through the firewall

Point the Lesson 47 routes at the firewall, and add a default route so internet traffic goes there too:

az network route-table route update --resource-group rg-saat-hub --route-table-name rt-spoke1 --name to-spoke2 --next-hop-ip-address $fwIp -o none
az network route-table route update --resource-group rg-saat-hub --route-table-name rt-spoke2 --name to-spoke1 --next-hop-ip-address $fwIp -o none
az network route-table route create --resource-group rg-saat-hub --route-table-name rt-spoke1 --name default-to-fw --address-prefix 0.0.0.0/0 --next-hop-type VirtualAppliance --next-hop-ip-address $fwIp -o none
az network route-table route create --resource-group rg-saat-hub --route-table-name rt-spoke2 --name default-to-fw --address-prefix 0.0.0.0/0 --next-hop-type VirtualAppliance --next-hop-ip-address $fwIp -o none

4Allow a few websites

Create an application rule collection that allows HTTPS to Microsoft Learn and the Ubuntu servers from both spokes:

az network firewall policy rule-collection-group collection add-filter-collection --resource-group rg-saat-hub --policy-name fwp-saat --rcg-name rcg-saat --name allow-web --collection-priority 300 --action Allow --rule-type ApplicationRule --rule-name web-https --source-addresses 10.41.0.0/16 10.42.0.0/16 --protocols Https=443 --target-fqdns learn.microsoft.com *.ubuntu.com -o none

5Send firewall logs to law-saat

Save the log categories in a file, then create the diagnostic setting:

'[{"category":"AZFWApplicationRule","enabled":true},{"category":"AZFWNetworkRule","enabled":true}]' | Set-Content C:\azure-lab\fwlogs.json
$fwId = az network firewall show --resource-group rg-saat-hub --name fw-saat --query id -o tsv
$lawId = az monitor log-analytics workspace show --resource-group rg-saat-core --workspace-name law-saat --query id -o tsv
az monitor diagnostic-settings create --name fw-to-law --resource $fwId --workspace $lawId --export-to-resource-specific true --logs '@C:\azure-lab\fwlogs.json' -o none

6Create two test VMs and try the internet

About 5 minutes for the VMs, then test an allowed site and a site with no rule:

az group create --name rg-saat-l48 --location centralindia --tags course=saatvedha-azure lesson=48 -o none
$s1Sub = az network vnet subnet show --resource-group rg-saat-hub --vnet-name vnet-spoke1 --name snet-app --query id -o tsv
$s2Sub = az network vnet subnet show --resource-group rg-saat-hub --vnet-name vnet-spoke2 --name snet-app --query id -o tsv
az vm create --resource-group rg-saat-l48 --name vm-s1 --image Canonical:ubuntu-24_04-lts:server:latest --size Standard_B1s --subnet $s1Sub --private-ip-address 10.41.1.4 --public-ip-address '""' --nsg '""' --admin-username azureuser --generate-ssh-keys --tags course=saatvedha-azure lesson=48 -o none
az vm create --resource-group rg-saat-l48 --name vm-s2 --image Canonical:ubuntu-24_04-lts:server:latest --size Standard_B1s --subnet $s2Sub --private-ip-address 10.42.1.4 --public-ip-address '""' --nsg '""' --admin-username azureuser --generate-ssh-keys --tags course=saatvedha-azure lesson=48 -o none
az vm run-command invoke --resource-group rg-saat-l48 --name vm-s1 --command-id RunShellScript --scripts 'curl -sI https://learn.microsoft.com/en-us/ | head -1; curl -s http://www.bing.com' --query "value[0].message" -o tsv

You should see something like this:

Enable succeeded:
[stdout]
HTTP/2 200
Action: Deny. Reason: No rule matched. Proceeding with default action.
[stderr]

vm-s1 has no public IP and sits in a private subnet, yet it reached Microsoft Learn through the firewall. Bing got a clear deny message from the firewall itself, because no rule allows it.

✅ Checkpoint: fw-saat runs at 10.40.1.4, spoke routes point to it, an allowed site works and an unknown site is denied.