Virtual Networks Should be Protected by Azure Firewall

Description:

With Azure Firewall, you can configure:

• Application rules that define fully qualified domain names (FQDNs) that can be accessed from a subnet.

• Network rules that define source address, protocol, destination port, and destination address.

Network traffic is subjected to the configured firewall rules when you route your network traffic to the firewall as the subnet default gateway.

For production deployments, a hub and spoke model is recommended, where the firewall is in its own VNet. The workload servers are in peered VNets in the same region with one or more subnets (see: 

https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/hub-spoke)

Solution/Reference: 

To deploy and configure the Azure Firewall using the Azure portal, please see the full instructions here:

https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal