Edit

Tutorial: Secure your hub virtual network using Azure Firewall Manager

  • Article

When you connect your on-premises network to an Azure virtual network to create a hybrid network, the ability to control access to your Azure network resources is an important part of an overall security plan.

Using Azure Firewall Manager, you can create a hub virtual network to secure your hybrid network traffic destined to private IP addresses, Azure PaaS, and the Internet. You can use Azure Firewall Manager to control network access in a hybrid network using policies that define allowed and denied network traffic.

Firewall Manager also supports a secured virtual hub architecture. For a comparison of the secured virtual hub and hub virtual network architecture types, see What are the Azure Firewall Manager architecture options?

For this tutorial, you create three virtual networks:

  • VNet-Hub - the firewall is in this virtual network.
  • VNet-Spoke - the spoke virtual network represents the workload located on Azure.
  • VNet-Onprem - The on-premises virtual network represents an on-premises network. In an actual deployment, it can be connected using either a VPN or ExpressRoute connection. For simplicity, this tutorial uses a VPN gateway connection, and an Azure-located virtual network is used to represent an on-premises network.

Hybrid network

In this tutorial, you learn how to:

  • Create a firewall policy
  • Create the virtual networks
  • Configure and deploy the firewall
  • Create and connect the VPN gateways
  • Peer the hub and spoke virtual networks
  • Create the routes
  • Create the virtual machines
  • Test the firewall

Prerequisites

A hybrid network uses the hub-and-spoke architecture model to route traffic between Azure VNets and on-premises networks. The hub-and-spoke architecture has the following requirements:

  • Set AllowGatewayTransit when peering VNet-Hub to VNet-Spoke. In a hub-and-spoke network architecture, a gateway transit allows the spoke virtual networks to share the VPN gateway in the hub, instead of deploying VPN gateways in every spoke virtual network.

    Additionally, routes to the gateway-connected virtual networks or on-premises networks are automatically propagated to the routing tables for the peered virtual networks using the gateway transit. For more information, see Configure VPN gateway transit for virtual network peering.

  • Set UseRemoteGateways when you peer VNet-Spoke to VNet-Hub. If UseRemoteGateways is set and AllowGatewayTransit on remote peering is also set, the spoke virtual network uses gateways of the remote virtual network for transit.

  • To route the spoke subnet traffic through the hub firewall, you need a User Defined route (UDR) that points to the firewall with the Virtual network gateway route propagation setting disabled. This option prevents route distribution to the spoke subnets. This prevents learned routes from conflicting with your UDR.

  • Configure a UDR on the hub gateway subnet that points to the firewall IP address as the next hop to the spoke networks. No UDR is required on the Azure Firewall subnet, as it learns routes from BGP.

See the Create Routes section in this tutorial to see how these routes are created.

Note

Azure Firewall must have direct Internet connectivity. If your AzureFirewallSubnet learns a default route to your on-premises network via BGP, you must override this with a 0.0.0.0/0 UDR with the NextHopType value set as Internet to maintain direct Internet connectivity.

Azure Firewall can be configured to support forced tunneling. For more information, see Azure Firewall forced tunneling.

Note

Traffic between directly peered VNets is routed directly even if a UDR points to Azure Firewall as the default gateway. To send subnet to subnet traffic to the firewall in this scenario, a UDR must contain the target subnet network prefix explicitly on both subnets.

If you don't have an Azure subscription, create a free account before you begin.

Create a Firewall Policy

  1. Sign in to the Azure portal.

  2. In the Azure portal search bar, type Firewall Manager and press Enter.

  3. On the Azure Firewall Manager page, under Security, select Azure firewall policies.

    Screenshot showing Firewall Manager main page.

  4. Select Create Azure Firewall Policy.

  5. Select your subscription, and for Resource group, select Create new and create a resource group named FW-Hybrid-Test.

  6. For the policy name, type Pol-Net01.

  7. For Region, select East US.

  8. Select Next : DNS Settings.

  9. Select Next : TLS inspection

  10. Select Next:Rules.

  11. Select Add a rule collection.

  12. For Name, type RCNet01.

  13. For Rule collection type, select Network.

  14. For Priority, type 100.

  15. For Action, select Allow.

  16. Under Rules, for Name, type AllowWeb.

  17. For Source, type 192.168.1.0/24.

  18. For Protocol, select TCP.

  19. For Destination Ports, type 80.

  20. For Destination Type, select IP Address.

  21. For Destination, type 10.6.0.0/16.

  22. On the next rule row, enter the following information:

    Name: type AllowRDP
    Source: type 192.168.1.0/24.
    Protocol, select TCP
    Destination Ports, type 3389
    Destination Type, select IP Address
    For Destination, type 10.6.0.0/16

  23. Select Add.

  24. Select Review + Create.

  25. Review the details and then select Create.

Create the firewall hub virtual network

Note

The size of the AzureFirewallSubnet subnet is /26. For more information about the subnet size, see Azure Firewall FAQ.

  1. From the Azure portal home page, select Create a resource.

  2. Search for Virtual network and then select Virtual network.

  3. Select Create.

  4. For Subscription, select your subscription.

  5. For Resource group, select FW-Hybrid-Test.

  6. For Name, type VNet-hub.

  7. For Region, select East US.

  8. Select Next.

  9. On the Security, select Next.

  10. For IPv4 address space, type 10.5.0.0/16.

  11. Under Subnets, select default.

  12. For Subnet template, select Azure Firewall.

  13. For Starting address, type 10.5.0.0/26.

  14. Accept the other default settings, and then select Save.

  15. Select Review + create.

  16. Select Create.

Add another subnet named GatewaySubnet with an address space of 10.5.1.0/27. This subnet is used for the VPN gateway.

Create the spoke virtual network

  1. From the Azure portal home page, select Create a resource.
  2. Search for Virtual network and then select Virtual network.
  3. Select Create.
  4. For Subscription, select your subscription.
  5. For Resource group, select FW-Hybrid-Test.
  6. For Name, type VNet-Spoke.
  7. For Region, select East US.
  8. Select Next.
  9. On the Security page, select Next.
  10. Select Next : IP Addresses.
  11. For IPv4 address space, type 10.6.0.0/16.
  12. Under Subnets, select default.
  13. Change the Name to SN-Workload.
  14. For Starting address, type 10.6.0.0/24.
  15. Accept the other default settings, and then select Save.
  16. Select Review + create.
  17. Select Create.

Create the on-premises virtual network

  1. From the Azure portal home page, select Create a resource.

  2. Search for Virtual network and then select Virtual network.

  3. Select Create.

  4. For Subscription, select your subscription.

  5. For Resource group, select FW-Hybrid-Test.

  6. For Virtual network name, type VNet-OnPrem.

  7. For Region, select East US.

  8. Select Next.

  9. On the Security page, select Next.

  10. For IPv4 address space, type 192.168.0.0/16.

  11. Under Subnets, select default.

  12. Change the Name to SN-Corp.

  13. For Starting address, type 192.168.1.0/24.

  14. Accept the other default settings, and then select Save.

  15. Select Add a subnet.

  16. For Subnet template, select Virtual Network Gateway.

  17. For Starting address type 192.168.2.0/27.

  18. Select Add.

  19. Select Review + create.

  20. Select Create.

Configure and deploy the firewall

When security policies are associated with a hub, it's referred to as a hub virtual network.

Convert the VNet-Hub virtual network into a hub virtual network and secure it with Azure Firewall.

  1. In the Azure portal search bar, type Firewall Manager and press Enter.

  2. In the right pane, select Overview.

  3. On the Azure Firewall Manager page, under Add security to virtual networks, select View hub virtual networks.

  4. Under Virtual Networks, select the check box for VNet-hub.

  5. Select Manage Security, and then select Deploy a Firewall with Firewall Policy.

  6. On the Convert virtual networks page, under Azure Firewall tier, select Premium. Under Firewall Policy, select the check box for Pol-Net01.

  7. Select Next : Review + confirm

  8. Review the details and then select Confirm.

    This takes a few minutes to deploy.

  9. After deployment completes, go to the FW-Hybrid-Test resource group, and select the firewall.

  10. Note the Firewall private IP address on the Overview page. You use it later when you create the default route.

Create and connect the VPN gateways

The hub and on-premises virtual networks are connected via VPN gateways.

Create a VPN gateway for the hub virtual network

Now create the VPN gateway for the hub virtual network. Network-to-network configurations require a RouteBased VpnType. Creating a VPN gateway can often take 45 minutes or more, depending on the selected VPN gateway SKU.

  1. From the Azure portal home page, select Create a resource.
  2. In the search text box, type virtual network gateway and press Enter.
  3. Select Virtual network gateway, and select Create.
  4. For Name, type GW-hub.
  5. For Region, select (US) East US.
  6. For Gateway type, select VPN.
  7. For VPN type, select Route-based.
  8. For SKU, select VpnGw2.
  9. For Generation, select Generation2.
  10. For Virtual network, select VNet-hub.
  11. For Public IP address, select Create new, and type VNet-hub-GW-pip for the name.
  12. For Enable active-active mode, select Disabled.
  13. Accept the remaining defaults and then select Review + create.
  14. Review the configuration, then select Create.

Create a VPN gateway for the on-premises virtual network

Now create the VPN gateway for the on-premises virtual network. Network-to-network configurations require a RouteBased VpnType. Creating a VPN gateway can often take 45 minutes or more, depending on the selected VPN gateway SKU.

  1. From the Azure portal home page, select Create a resource.
  2. In the search text box, type virtual network gateway and press Enter.
  3. Select Virtual network gateway, and select Create.
  4. For Name, type GW-Onprem.
  5. For Region, select (US) East US.
  6. For Gateway type, select VPN.
  7. For VPN type, select Route-based.
  8. For SKU, select VpnGw2.
  9. For Generation, select Generation2.
  10. For Virtual network, select VNet-Onprem.
  11. For Public IP address, select Create new, and type VNet-Onprem-GW-pip for the name.
  12. For Enable active-active mode, select Disabled.
  13. Accept the remaining defaults and then select Review + create.
  14. Review the configuration, then select Create.

Create the VPN connections

Now you can create the VPN connections between the hub and on-premises gateways.

In this step, you create the connection from the hub virtual network to the on-premises virtual network. A shared key is referenced in the examples. You can use your own values for the shared key. The important thing is that the shared key must match for both connections. It takes some time to create the connection.

  1. Open the FW-Hybrid-Test resource group and select the GW-hub gateway.
  2. Select Connections in the left column.
  3. Select Add.
  4. For the connection name, type Hub-to-Onprem.
  5. Select VNet-to-VNet for Connection type.
  6. Select Next : Settings.
  7. For the First virtual network gateway, select GW-hub.
  8. For the Second virtual network gateway, select GW-Onprem.
  9. For Shared key (PSK), type AzureA1b2C3.
  10. Select Review + create.
  11. Select Create.

Create the on-premises to hub virtual network connection. This step is similar to the previous one, except you create the connection from VNet-Onprem to VNet-hub. Make sure the shared keys match. The connection will be established after a few minutes.

  1. Open the FW-Hybrid-Test resource group and select the GW-Onprem gateway.
  2. Select Connections in the left column.
  3. Select Add.
  4. For the connection name, type Onprem-to-Hub.
  5. Select VNet-to-VNet for Connection type.
  6. For the Second virtual network gateway, select GW-hub.
  7. For Shared key (PSK), type AzureA1b2C3.
  8. Select OK.

Verify the connection

After about five minutes or so, the status of both connections should be Connected.

Screenshot showing the vpn gateway connections.

Peer the hub and spoke virtual networks

Now peer the hub and spoke virtual networks.

  1. Open the FW-Hybrid-Test resource group and select the VNet-hub virtual network.

  2. In the left column, select Peerings.

  3. Select Add.

  4. Under This virtual network:

    Setting name Value
    Peering link name HubtoSpoke
    Allow traffic to remote virtual network selected
    Allow traffic forwarded from the remote virtual network (allow gateway transit) selected
    Use remote Virtual network gateway or route server not selected

  5. Under Remote virtual network:

    Setting name Value
    Peering link name SpoketoHub
    Virtual network deployment model Resource Manager
    Subscription <your subscription>
    Virtual network VNet-Spoke
    Allow traffic to current virtual network selected
    Allow traffic forwarded from current virtual network (allow gateway transit) selected
    Use current virtual network gateway or route server selected

  6. Select Add.

    Screenshot showing Vnet peering.

Create the routes

Next, create a couple routes:

  • A route from the hub gateway subnet to the spoke subnet through the firewall IP address
  • A default route from the spoke subnet through the firewall IP address
  1. From the Azure portal home page, select Create a resource.
  2. In the search text box, type route table and press Enter.
  3. Select Route table.
  4. Select Create.
  5. Select the FW-Hybrid-Test for the resource group.
  6. For Region, select East US.
  7. For the name, type UDR-Hub-Spoke.
  8. Select Review + Create.
  9. Select Create.
  10. After the route table is created, select it to open the route table page.
  11. Select Routes in the left column.
  12. Select Add.
  13. For the route name, type ToSpoke.
  14. For Destination type, select IP addresses.
  15. For Destination IP addresses/CIDR ranges, type 10.6.0.0/16.
  16. For next hop type, select Virtual appliance.
  17. For next hop address, type the firewall's private IP address that you noted earlier.
  18. Select Add.

Now associate the route to the subnet.

  1. On the UDR-Hub-Spoke - Routes page, select Subnets.
  2. Select Associate.
  3. Under Virtual network, select VNet-hub.
  4. Under Subnet, select GatewaySubnet.
  5. Select OK.

Now create the default route from the spoke subnet.

  1. From the Azure portal home page, select Create a resource.
  2. In the search text box, type route table and press Enter.
  3. Select Route table.
  4. Select Create.
  5. Select the FW-Hybrid-Test for the resource group.
  6. For Region, select East US.
  7. For the name, type UDR-DG.
  8. For Propagate gateway routes, select No.
  9. Select Review + create.
  10. Select Create.
  11. After the route table is created, select it to open the route table page.
  12. Select Routes in the left column.
  13. Select Add.
  14. For the route name, type ToHub.
  15. For Destination type, select IP addresses
  16. For Destination IP addresses/CIDR ranges, type 0.0.0.0/0.
  17. For next hop type, select Virtual appliance.
  18. For next hop address, type the firewall's private IP address that you noted earlier.
  19. Select Add.

Now associate the route to the subnet.

  1. On the UDR-DG - Routes page, select Subnets.
  2. Select Associate.
  3. Under Virtual network, select VNet-spoke.
  4. Under Subnet, select SN-Workload.
  5. Select OK.

Create virtual machines

Now create the spoke workload and on-premises virtual machines, and place them in the appropriate subnets.

Create the workload virtual machine

Create a virtual machine in the spoke virtual network, running IIS, with no public IP address.

  1. From the Azure portal home page, select Create a resource.

  2. Under Popular Marketplace products, select Windows Server 2019 Datacenter.

  3. Enter these values for the virtual machine:

    • Resource group - Select FW-Hybrid-Test
    • Virtual machine name: VM-Spoke-01
    • Region - (US) East US
    • User name: type a user name
    • Password: type a password

  4. For Public inbound ports, select Allow selected ports, and then select HTTP (80), and RDP (3389)

  5. Select Next:Disks.

  6. Accept the defaults and select Next: Networking.

  7. Select VNet-Spoke for the virtual network and the subnet is SN-Workload.

  8. Select Next:Management.

  9. Select Next : Monitoring.

  10. For Boot diagnostics, Select Disable.

  11. Select Review + Create, review the settings on the summary page, and then select Create.

Install IIS

  1. From the Azure portal, open the Cloud Shell and make sure that it's set to PowerShell.

  2. Run the following command to install IIS on the virtual machine and change the location if necessary:

    Set-AzVMExtension `
        -ResourceGroupName FW-Hybrid-Test `
        -ExtensionName IIS `
        -VMName VM-Spoke-01 `
        -Publisher Microsoft.Compute `
        -ExtensionType CustomScriptExtension `
        -TypeHandlerVersion 1.4 `
        -SettingString '{"commandToExecute":"powershell Add-WindowsFeature Web-Server; powershell      Add-Content -Path \"C:\\inetpub\\wwwroot\\Default.htm\" -Value $($env:computername)"}' `
        -Location EastUS

Create the on-premises virtual machine

This is a virtual machine that you use to connect using Remote Desktop to the public IP address. From there, you then connect to the on-premises server through the firewall.

  1. From the Azure portal home page, select Create a resource.

  2. Under Popular, select Windows Server 2019 Datacenter.

  3. Enter these values for the virtual machine:

    • Resource group - Select existing, and then select FW-Hybrid-Test
    • Virtual machine name - VM-Onprem
    • Region - (US) East US
    • User name: type a user name
    • Password: type your password

  4. For Public inbound ports, select Allow selected ports, and then select RDP (3389)

  5. Select Next:Disks.

  6. Accept the defaults and select Next:Networking.

  7. Select VNet-Onprem for virtual network and verify the subnet is SN-Corp.

  8. Select Next:Management.

  9. Select Next : Monitoring.

  10. For Boot diagnostics, select Disable.

  11. Select Review + Create, review the settings on the summary page, and then select Create.

Test the firewall

  1. First, note the private IP address for VM-Spoke-01 virtual machine on the VM-Spoke-01 Overview page.

  2. From the Azure portal, connect to the VM-Onprem virtual machine.

  1. Open a web browser on VM-Onprem, and browse to http://<VM-spoke-01 private IP>.

    You should see the VM-spoke-01 web page: Screenshot showing vm-spoke-01 web page.

  2. From the VM-Onprem virtual machine, open a remote desktop to VM-spoke-01 at the private IP address.

    Your connection should succeed, and you should be able to sign in.

So now you've verified that the firewall rules are working:

  • You can browse web server on the spoke virtual network.
  • You can connect to the server on the spoke virtual network using RDP.

Next, change the firewall network rule collection action to Deny to verify that the firewall rules work as expected.

  1. Open the FW-Hybrid-Test resource group and select the Pol-Net01 firewall policy.
  2. Under Settings, select Rule Collections.
  3. Select the RCNet01 rule collection.
  4. For Rule collection action, select Deny.
  5. Select Save.

Close any existing remote desktops and browsers on VM-Onprem before testing the changed rules. After the rule collection update is complete, run the tests again. They should all fail to connect this time.

Clean up resources

You can keep your firewall resources for further investigation, or if no longer needed, delete the FW-Hybrid-Test resource group to delete all firewall-related resources.

Next steps

Tutorial: Secure your virtual WAN using Azure Firewall Manager