Azure Firewall Manager and Policies

When you manage Azure Firewall at scale — multiple firewalls, multiple regions, different teams — you need centralised policy management. Azure Firewall Manager and firewall policies solve this.

🎬 Video coming soon

Firewall Manager and Policies

Firewall Manager and Policies

~11:00

Firewall Policies

Firewall policies replaced the older “classic rules” model. A policy is a standalone Azure resource that contains all your firewall rules and settings, and can be associated with one or more firewalls.

Parent/child inheritance:

Parent Policy (Global)
├── Base rules: Deny known-bad IPs, Allow Azure management
├── Threat intel settings: Alert and Deny
├── DNS settings: Custom DNS servers
│
├── Child Policy (Production)
│     ├── Inherits all parent rules
│     ├── Additional rules: Allow prod workloads
│     └── Cannot delete or modify parent rules
│
└── Child Policy (Development)
      ├── Inherits all parent rules
      ├── Additional rules: Allow broader internet (less restrictive)
      └── Cannot delete or modify parent rules

Key inheritance rules:

• Child policies inherit all rules from the parent
• Child policies can add rules but cannot remove or override parent rules
• Parent rules are processed before child rules (lower priority numbers)
• A policy can have only one parent but a parent can have multiple children
• You can change a policy’s parent, but rules from the old parent are removed

Rule Collection Group Hierarchy

Within a policy, rules are organised in a three-level hierarchy:

Firewall Policy
└── Rule Collection Group (priority: 100-65000)
    └── Rule Collection (priority within group)
        └── Individual Rules

Rule collection groups contain multiple rule collections and are processed by priority. Within each group, rule collections are processed by their priority. Within each collection, individual rules are processed.

Rule type processing still applies: DNAT collections process first, then Network collections, then Application collections — regardless of rule collection group priority.

🔒 Aisha’s policy design:

Rule Collection Group	Priority	Contents
Platform (parent policy)	100	Deny known-bad IPs, Allow Azure management
Infrastructure	200	Allow DNS, NTP, Windows Update
Workload - Finance	300	Allow Finance app traffic patterns
Workload - HR	400	Allow HR app traffic patterns
Internet	500	Allow approved internet destinations

Secure Virtual Hubs

A secure virtual hub is a Virtual WAN hub with Azure Firewall (or a partner security provider) deployed in it, managed through Firewall Manager.

Hub VNet Firewall vs Secure Virtual Hub

Feature	Hub VNet with Firewall	Secure Virtual Hub (VWAN)
Hub location	Your own VNet that you create and manage	Virtual WAN managed hub infrastructure
Routing	Manual UDRs on every spoke subnet	Routing intent automates traffic through firewall
Management	Direct policy association with firewall	Firewall Manager associates policies per hub
Multi-region	Manual VNet peering between hubs	Automatic inter-hub connectivity via VWAN
Third-party NVA support	Deploy NVAs in the hub VNet manually	Partner security providers (Zscaler, iBoss, Check Point)
Best for	Small deployments (under 10 VNets), full routing control	Large-scale or multi-region with VWAN, automated routing

Routing intent (covered in Module 12) works with secure virtual hubs to automatically route:

• Internet traffic: All VNet-to-internet routes through the hub’s firewall
• Private traffic: All VNet-to-VNet and VNet-to-branch routes through the hub’s firewall

This eliminates manual UDR management — Firewall Manager and routing intent handle it automatically.

ℹ️ Hub VNet vs Secure Virtual Hub — When to Choose

Choose Hub VNet + Firewall when:

• You have a small number of VNets (under 10)
• You need full control over routing and VNet configuration
• You don’t use Virtual WAN
• You want to manage everything manually for maximum customisation

Choose Secure Virtual Hub when:

• You use Virtual WAN for multi-site, multi-region connectivity
• You want automated routing (routing intent)
• You need centralised policy management across multiple hubs
• You want to integrate third-party security providers
• You have 10+ VNets or multiple regions

Exam context: If the scenario mentions Virtual WAN, the answer likely involves a secure virtual hub. If it’s a custom hub-and-spoke without VWAN, it’s a hub VNet with firewall.

Key Takeaways

• Firewall policies are standalone resources with parent/child inheritance
• Child policies inherit and cannot override parent rules
• Rule collection groups organise rules with priority-based processing
• DNAT rules always process before Network, which process before Application
• Secure virtual hubs combine VWAN + Firewall Manager with routing intent

---

Test Your Knowledge

Question

Can a child firewall policy override rules from the parent?

Click or press Enter to reveal answer

Answer

No. Child policies inherit all parent rules and cannot remove or modify them. Child policies can only add additional rules. Parent rules are processed before child rules.

Click to flip back

Question

What is a secure virtual hub?

Click or press Enter to reveal answer

Answer

A Virtual WAN hub with Azure Firewall (or a partner security provider like Zscaler) deployed in it, managed through Azure Firewall Manager. Supports routing intent for automatic traffic routing through the firewall.

Click to flip back

Question

What is the rule hierarchy within a firewall policy?

Click or press Enter to reveal answer

Answer

Policy contains Rule Collection Groups (prioritised). Each group contains Rule Collections (prioritised). Each collection contains individual rules. DNAT collections always process before Network, which process before Application.

Click to flip back

---

Knowledge Check

Aisha wants a base set of deny rules that all firewalls must follow, with teams adding their own workload-specific rules. What should she configure?

ASeparate policies for each team with no inheritanceBA parent policy with base deny rules and child policies per teamCOne giant policy with all rules combinedDAVNM security admin rules instead of firewall policies

Check Answer

Knowledge Check

Elena uses Virtual WAN with multiple regional hubs and wants all traffic routed through Azure Firewall in each hub without manual UDRs. What should she deploy?

AHub VNets with Azure Firewall and UDR route tablesBSecure virtual hubs with routing intent enabledCNSGs on every spoke subnetDAzure Firewall in each spoke VNet

Check Answer

---

Next up: Web Application Firewall (WAF) — Protect web applications from OWASP attacks with WAF on Application Gateway and Front Door.