AzureFW Deny rule is not output during connection troubleshooting

Tsukuda Yusaku 0

After verifying the connectivity troubleshooting below, We were able to confirm that no errors were output due to Deny in the AzureFW application rules. Access to https://www.example.com from VM2 is recognized as denied by AzureFW. ・Network Internet | AzureFW | | VM1 VM2 ・Application rules |SourceType|Sorece|Protocol|DestinationType|Target|Action| | -------- | -------- | -------- | -------- | -------- | -------- | |IPAddress|VM1_IPAddress|Http,Https,Mssql|FQDN|www.example.com|Allow| |IPAddress|VM2_IPAddress|Http,Https,Mssql|FQDN|www.example.com|Deny|

・Connection Troubleshooting |SourceType|Source |Destination|Protocol|DestinationPort|Result| | -------- | -------- | -------- | -------- | -------- | -------- | |VM|VM1|https://www.example.com|TCP|443|Allow| |VM|VM2|https://www.example.com|TCP|443|Allow|

I checked if I could access https://www.example.com from the system console. We were able to confirm that the results were as expected. ・Confirmation using the system console |VM|Command |ApplicationRules|Result| | -------- | -------- | -------- | -------- | |VM1|curl https://www.example.com |above rules|Allow| |VM2|curl https://www.example.com|above rules|Deny|

Based on the above results, can't AzureFW Deny be detected by connection troubleshooting?

Silvia Wibowo 3,011 Reputation points Microsoft Employee

2024-01-24T04:38:01.8666667+00:00
Hi @Tsukuda Yusaku , I understand that you use VM Connection Troubleshoot to test connectivity to a certain URL that should be blocked by Azure Firewall (FQDN rule).

Please note that VM Connection Troubleshoot can detect the following types of issues that can impact connectivity:

High VM CPU utilization

High VM memory utilization

Virtual machine (guest) firewall rules blocking traffic

DNS resolution failures

Misconfigured or missing routes

Network security group (NSG) rules that are blocking traffic

Inability to open a socket at the specified source port

Missing address resolution protocol entries for Azure ExpressRoute circuits

Servers not listening on designated destination ports

Azure Firewall is not in that list.

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.