azurefirewallazure-nsg

Azure Firewall Arquitecture

I have a project where i need to deploy an Azure firewall so there are some questions of better practice that i need to resolve before.

If enter image description here

I hope you could help me. Regards.

Solution

  • Is it correct that App Gateway or Api Magament Service be inside a NSG? would this cause any issue?

    You can use application gateway or Api management service to be inside Network security groups (NSGs) are supported. For the Application Gateway v1 SKU, you should allow incoming Internet traffic on TCP ports 65503-65534, and for the v2 SKU, you can allow incoming Internet traffic on TCP ports 65200-65535, with the source subnet set to Gateway Manager and the destination subnet set to Any.

    Azure certificates are used to secure these ports. These endpoints are not able to communicate with external parties, including the gateways' users.

    The NSG's default outbound policies permit Internet connectivity. I would suggest

    Behind the NSG could be API management services. When a user wants to restrict or allow some ports, NSG can raise an action after pulling that specific resources address from the public internet. if you're using large scale of hardware network virtual services firewall can be used.

    In another way in your scenario you can remove NSG and deploy application gateway behind the firewall through application gateway then you can distribute the traffic through API management services accordingly.

    App Gateway and Api management are exposed services. Those services need to be out of AZ FW scope? (asymmetric routing problem)

    Yes, App Gateway and Api management are exposed services. But these services also protected accordingly please check this Protect APIs with Azure Application Gateway and Azure API Management - and also see Azure Firewall