Allow traffic through Azure Firewall

Azure Firewall azfw-hub, at 10.0.1.4 in the hub, is in place, and both spokes route to it. It has no rules yet. Allow HTTPS from spoke1 (10.1.0.0/16) to spoke2 (10.2.0.0/16), and nothing else.

1. See the rules. There are none.

   az network firewall network-rule collection list -g rg-lab --firewall-name azfw-hub -o tableType it
   What's this?

   Works with Azure Firewall network rules: allow or deny by source IP, destination IP, port and protocol. Collections are checked by priority, lowest number first, and the first match decides.

   • -g the resource group the resources live in

2. Add an allow collection with one HTTPS rule.

   az network firewall network-rule create -g rg-lab --firewall-name azfw-hub --collection-name Allow-Spoke1-HTTPS --name https --priority 200 --action Allow --protocols TCP --source-addresses 10.1.0.0/16 --destination-addresses 10.2.0.0/16 --destination-ports 443Type it
   What's this?

   Works with Azure Firewall network rules: allow or deny by source IP, destination IP, port and protocol. Collections are checked by priority, lowest number first, and the first match decides.

   • -g the resource group the resources live in
   • --name the name of the thing to look at or change
   • --priority where the rule sits in the order. Lower numbers are checked first
   • --priority 200 --action Allow only when the collection is new
   • --protocols TCP TCP, UDP, ICMP or Any

3. Connect to vm-spoke1.

   ssh vm-spoke1Type it
   What's this?

   Opens a shell on vm-spoke1, so the next commands run on that VM. In this lab it's a shortcut. In real Azure you'd connect through something like Azure Bastion, or SSH to an address you can reach.

4. Test HTTPS to vm-spoke2. Type exit when done.

   nc -zv 10.2.1.4 443Type it
   What's this?

   netcat, a standard Linux tool. Tries to open a TCP connection and reports whether it worked.

   • -z only check whether the port answers. Send no data
   • -v print the result in words
   • 10.2.1.4 where to connect
   • 443 the port to try

5. Answer the question below.

   Two collections both match: a Deny at priority 200 and an Allow at 300. Which wins?

   Rule collection

   A group of Azure Firewall rules that share one priority and one action.

   Priority

   A number on each rule that sets the order Azure checks the rules in.

   Check