In the Azure Resource Manager (ARM) console, click
Rulestacks
for the Cloud NGFW resource you want to configure. The rulestack
associated with the Cloud NGFW service appears, along with the resource
group.
Modify the rulestack to add firewall rules. These rules allow some
traffic while blocking specific traffic. By default, Cloud NGFW blocks
all traffic. Search for the local rulestack you created previously using
the global search option provided by the Azure portal.
Select the previously created local rulestack associated with your
Cloud NGFW subscription, then select
Rules
.
In the
Local Rules
section, click
Add
. In the
Add
Rule
window, modify the rules. For example, add a rule that
allows traffic; complete the mandatory fields and use the default
settings for remaining fields.
Enable logging for the rule. In the Add Rule window, select
Logging
.
Click
Validate
, then
Add
to add the rule to the
rulestack.
Add a
FQDN list
that specifies a URL, then specify an action to
take. For example, you can apply an action to the FQDN rule to drop
traffic attempting to access the URL www.facebook.com.
Verify that the URL you entered appears in the FQDN list.
Return to the
Rules
setting page and add a rule that matches the
newly created FQDN list. Set the action to
Drop
traffic.
Both rules appear in the Local Rules page.
As part of the Cloud NGFW service, security profiles are enabled with
best practice configurations by default. Traffic is secured with the
best security profiles when you start and deploy the service. Select
Profiles
to view these security profiles.
After modifying rules, deploy them onto the local rulestack associated
with the Cloud NGFW service. Click
Deployment
. The deployment
status appears as
Candidate
; this means that the configuration
was built but not yet deployed. Click
Deploy Configuration
to
deploy the configuration onto the Cloud NGFW service.
You must
complete this step to deploy the rulestack
.
After clicking
Deploy Configuration
, a message displays the
firewalls associated with the rulestack. Click
Deploy
to
configure this rulestack on all the associated firewalls using the
rulestack.
After successfully deploying the configuration, the screen displays
the deployment status as Running (the Cloud NGFW and local rulestack
are successfully deployed).
Source/destination NAT rule on the Cloud NGFW
Configure a destination NAT rule with frontend configuration on the Cloud
NGFW to direct inbound traffic towards an application on the vWAN.
Access the
Networking & NAT
settings screen for the Cloud
NGFW resource. In this screen, determine if the network type is
Virtual WAN Hub
and the status of the
Source NAT
field
(enabled or disabled); if Source NAT was enabled, it appears in this
screen.
Click
Edit
to add the Destination NAT rule.
Add
a Destination NAT rule for the frontend configuration. The
frontend IP address represents the public IP address associated with the
Cloud NGFW. Use the drop-down menu to select the address.
Add frontend setting information to the rule, and click
Add
.
Once the destination NAT rule is added, click Save to deploy the
configuration to the Cloud NGFW resource.
After successfully saving the configuration, the Destination Network
Address Translation (DNAT) field displays the updates; the address
http://frontendIP:8080 is redirected to the noted application on the
specified port through the Cloud NGFW; inbound traffic is now
flowing through the Cloud NGFW.
Configure Logging
Before configuring logging on the Cloud NGFW, create the
Log Analytics
workspace on Azure.
In the Azure portal search for the
Azure Log Analytics workspace
.
Click
Log Analytics Workspaces
to add it as a service.
Click
Create
to establish a new
Log
Analytics
workspace.
In the Create Log Analytics workspace provide
Instance
details.
Select the
Name
of the workspace from the drop-down menu, and specify
the
Region
.
Configure log settings in the Cloud NGFW resource. Select
Log
Settings
. Click
Edit
.
In the
Log Settings
field, select the Log Analytics workspace
previously created, then click
Save
.
Add application vNETs as Virtual Networks Connections to the Virtual WAN
Add an application vNET as Virtual Network Connections to the Virtual WAN
hub.
In your vWAN resource, select
Virtual Network Connections
.
Click
Add connection
.
Select the vNET you want to configure as the
Virtual Network
, then
click
Create
.
Select another vNET for the second Virtual Network, then click
Create
.
After successfully connecting the virtual networks to the vHub, verify that
the status is
Connected
.
Configure vWAN Hub Routing Intent and Routing Policies
Routing policies within the virtual WAN hub are used to route traffic through
the Cloud NGFW service. To route internet bound traffic and private traffic
(spoke to spoke) you need to configure the next hop as the vWAN Cloud
NGFW.
vWAN routing intent, routing policies and SaaS
functionality is currently being developed by Microsoft for the Azure
Portal. The target availability date for every region where Cloud NGFW is
available is Tuesday, May 9, 2023.
In your vWAN resource, select
Routing Intent and Routing
Policies
.
Select the Internet traffic and the Next Hop Resource from the
drop-down menus, then click
Save
.
After configuring routing policies, verify the routing table was
updated to route traffic through Cloud NGFW. Click
Route Tables
and select
Default
in the
Route Tables
section.
You can
Edit
the route table to provide details related to the
routes associated with the Default Routing table. Traffic going out
to the internet or to other vNETs is routed through the Cloud
NGFW.
Select another vNET for the second Virtual Network, then click
Create
.
After successfully connecting the virtual networks to the virtual WAN
hub, verify that the status is
After successfully deploying the configuration, the screen displays the deployment status as Running (the Cloud NGFW and local rulestack are successfully deployed).
Once the destination NAT rule is added, click Save to deploy the configuration to the Cloud NGFW resource.After successfully saving the configuration, the Destination Network Address Translation (DNAT) field displays the updates; the address http://frontendIP:8080 is redirected to the noted application on the specified port through the Cloud NGFW; inbound traffic is now flowing through the Cloud NGFW.
You canEditthe route table to provide details related to the routes associated with the Default Routing table. Traffic going out to the internet or to other vNETs is routed through the Cloud NGFW.