Azure Firewall and NSG configuration?

Question

Hi People,

I've got 40+ VMs in Azure Resource group located in different regions.
I wanted to allow only 10 VMs to access the internet and the rest is just Corporate Intranet only (via Express Route to my OnPremise network).

Should I deploy one Azure Firewall or this can be set by NSG but repetitively?
If I have VNET that I have peered with the other VNET with Azure Firewall, do I still need to edit or modify the NSG or no longer need?

Thank you in advance,

Answer 1

@EnterpriseArchitect

If you restrict traffic at the VM itself you can minimize the costs and utilization for traffic going to Azure FW and then getting dropped. However, if its easier for you to do it at the firewall for ease of management, you can do so. Therefore, it depends upon the use case and the requirement but traffic can be managed at both the firewall and the NSGs using IP/ports.

Please let me know if you have any more questions and I will be happy to help :) Thank you!

Remember:

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.

Want a reminder to come back and check responses? Here is how to subscribe to a notification.

Answer 2

@EnterpriseArchitect

If I understand you correctly, you want to allow some VMs to access internet and rest only to the on-premise network via Express Route. Please correct me otherwise.
This can be achieved using NSGs and you do not necessarily need a Firewall to do the same. You can use the same NSGs if you would like, as long as the VMs are in the same region/subscription. If they are in different regions, you can still be able to use an Azure Resource Manager template to export the existing configuration and security rules of an NSG. More details are given in this document.

You can implement a firewall if you are looking for more features/security than just restricting or allowing traffic based on IP/ports. Here is a great blog that explains the difference between NSGs and Firewall and when each can be used and also using both at the same time.

In regards to this question, If I have VNET that I have peered with the other VNET with Azure Firewall, do I still need to edit or modify the NSG or no longer need? Can you explain this in more detail so I can understand and assist you better? Thank you!