Networking

The Networking forum covers all aspects of Networking in Azure, including endpoints, load-balancing, network security, DNS, Traffic Manager, virtual networks, and external connectivity.

Virtual Network:

  • Service overview

  • Technical documentation

  • Pricing details

  • Traffic Manager:

  • Service overview

  • Technical documentation

  • Pricing details

  • Network Watcher:

  • Service overview

  • Technical documentation

  • Pricing details

  • If you have any feedback on any aspect of Azure relating to Networking, we’d love to hear it.

    • Hot ideas
    • Top ideas
    • New ideas
    • My feedback
    1. Diagnostic log for Azure Firewall includes rule collection name and priority for each entry

      The current log format for Azure Firewall as following, Rule Name and Priority Number is not supported by Azure Firewall diagnostic log yet.

      We would like to suggest to add this two columns on Azure Firewall Diagnostic log, I believe it will help to troubleshoot any network connectivity in an effective way for end users. Thank you!

      Application Rule.

      {
      "category": "AzureFirewallApplicationRule",
      "time": "2018-04-16T23:45:04.8295030Z",
      "resourceId": "/SUBSCRIPTIONS/{subscriptionId}/RESOURCEGROUPS/{resourceGroupName}/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/{resourceName}",
      "operationName": "AzureFirewallApplicationRuleLog",
      "properties": {

        "msg": "HTTPS request from 10.1.0.5:55640 to mydestination.com:443. Action: Allow. Rule Collection: collection1000. Rule: rule1002"
      

      }
      }

      Network Rule.

      {
      "category": "AzureFirewallNetworkRule",
      "time": "2018-06-14T23:44:11.0590400Z",
      "resourceId": "/SUBSCRIPTIONS/{subscriptionId}/RESOURCEGROUPS/{resourceGroupName}/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/{resourceName}",
      "operationName": "AzureFirewallNetworkRuleLog",
      "properties": {

        "msg":
      16 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Azure Firewall  ·  Flag idea as inappropriate…  ·  Admin →
    2. Please add start / stop cmdlets (ex. Stop-AzFirewall / Start-AzFirewall)

      Could you please provide cmdlets like Stop-AzApplicationGateway / Start-AzApplicationGateway.

      Following steps are really complexed. (Why Firewall doesn't keep VNet and Public IP information?)
      We need more simple step for stopping and restarting Firewall because its too expensive for PoC.
      If you can add cmdlets and portal UI, it really helpful for us.

      https://docs.microsoft.com/en-us/azure/firewall/firewall-faq#how-can-i-stop-and-start-azure-firewall

      43 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      triaged  ·  0 comments  ·  Azure Firewall  ·  Flag idea as inappropriate…  ·  Admin →
    3. Add Effective Routes blade to Azure Firewall

      We are currently evaluating the use of Azure Firewall as our core firewall between on-prem and an Azure Hub/Spoke architecture via ExpressRoute.

      We need to be able to see what the effective routes are that Azure Firewall is using when we route all of our spoke traffic to it, and our on-prem traffic destined for the spokes to it as well. Currently, Effective Routes are only visible on resources with an associated NIC.

      Given that Azure Firewall is a PaaS network appliance, this is a critical feature for making it useful in our use case.

      62 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      triaged  ·  2 comments  ·  Azure Firewall  ·  Flag idea as inappropriate…  ·  Admin →
    4. Azure Firewall - FQDN Based NAT!

      I strongly hope AzureFirewall has "FQDN-based-Nat" function!!!

      23 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      triaged  ·  0 comments  ·  Azure Firewall  ·  Flag idea as inappropriate…  ·  Admin →
    5. FQDN tags for Office365 on Azure Firewall

      Office365 has plenty of domains. In case we need Office365 traffic via Azure Firewall, we have to retrieve all URLs and then add application rule accordingly. This will lead waste a lot of times.

      Please consider to add FQDN tag for Office365 accordingly. Thank you!

      9 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Azure Firewall  ·  Flag idea as inappropriate…  ·  Admin →
    6. Azure firewall application rule does not support non-http80/http8080/https443 protocol, for example SMTP. Please add the new feature.

      In order to inspect access to smtp.office365.com through Azure firewall, and leverage target FQDN in application rule, please add SMTP protocol support since currently AFW does not support non-http80/http8080/https443 protocol.

      36 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      triaged  ·  3 comments  ·  Azure Firewall  ·  Flag idea as inappropriate…  ·  Admin →
    7. Disable SNI TLS extension check on Azure Firewall

      We are getting a lot of "Action: Deny. Reason: SNI TLS extension was missing" on Azure Firewall Log, which causes application failure if client application doesn't support SNI at the time of client hello. Can we add a feature to support Disable SNI check on Firewall manually?

      17 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      triaged  ·  2 comments  ·  Azure Firewall  ·  Flag idea as inappropriate…  ·  Admin →
    8. Azure Firewall with Just in Time Access

      With the latest just in time access support for Azure Firewall, DNAT rules are added when access is requested to the private IP. We have secure servers without public endpoints secured by JIT. As soon as a request is made to access port 3389, Azure Firewall NATs a port (13389) on its public endpoint mapped to our server. There is no notification of this happening at the time of the JIT request. It would be great to have a feature that would allow the DNAT setting to be disabled when requesting access through JIT.

      30 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      triaged  ·  0 comments  ·  Azure Firewall  ·  Flag idea as inappropriate…  ·  Admin →
    9. Azure Firewall geo based rules

      Support for geo based Rules in azure firewall.
      IE Any traffic from Country A will be blocked

      67 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      1 comment  ·  Azure Firewall  ·  Flag idea as inappropriate…  ·  Admin →
    10. Remove requirement for public IP on Azure Firewall.

      Our organization requires access to Azure cloud only via VPN for internal users. We would prefer to use the Azure firewall however currently a public IP is required. The requirement for a public IP should be eliminated as from a security perspective, this is unacceptable if the firewall is used for internal traffic only.

      58 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      1 comment  ·  Azure Firewall  ·  Flag idea as inappropriate…  ·  Admin →
    11. Azure firewall Threat Intel logs: option to always add fqdn to "Deny" log entries

      When TI blocks by IP instead of fqdn (which it seems to do most of the time, given the amount of blocks we notice), it would be very useful for troubleshooting if AzFW would also log the fqdn the client is accessing (from TLS Client Hello packet) in addition to only the blocked IP from SYN packets.

      We are experiencing quite a lot of false positives for Google and GitHub shared IP's on fresh Win 10 VMs with basic dev tools like Chrome/VScode, and this would help pinpoint what ligitimate fqdn the clients are trying to access.

      It's also quite…

      3 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Azure Firewall  ·  Flag idea as inappropriate…  ·  Admin →
    12. Azure Firewall: more granular threat intel rules and actions

      Currenly the only choices for TI are: Alert or Deny. It would be nice to have a choice actions based on threat category/severities/confidence.

      For example: block high confidence matches while only alerting on medium risks.

      Sites like abuseipdb.com often provide a "Confidence of abuse" level to indicate how likely it is that a given ip is abused. I assume TI internally uses a similar rating that could be used?

      3 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Azure Firewall  ·  Flag idea as inappropriate…  ·  Admin →
    13. Cheaper sku for Azure Firewall

      For small deployments, the currect AzFW pricing is quite high. It would be very useful if we could also get a cheaper tier with lower specs for these smaller and dev environments.

      3 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Azure Firewall  ·  Flag idea as inappropriate…  ·  Admin →
    14. Support to retrieve effective route of Azure Firewall

      I believe Azure Firewall doesn't support to retrieve effective route at this moment. While if we advertise a lot of routes from on-premise or if we have hub-spoke setup, it's hard for us to know how Azure Firewall forward the traffic. Can we add this feature? Thanks!

      21 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      triaged  ·  0 comments  ·  Azure Firewall  ·  Flag idea as inappropriate…  ·  Admin →
    15. Windows KMS servicetag is missing in Azure Firewall

      I have several Azure Firewall deployments with Windows servers. I'm looking for KMS servicetag. I cannot use fqdn destination address because KMS is not using http/https. Please could you add this service tag ?

      6 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Azure Firewall  ·  Flag idea as inappropriate…  ·  Admin →
    16. Make WAF accept application/octet-stream

      We do POST requests with content type application/octet-stream with binary content in it (user uploads archived binary data to server), it triggers 920420 rule with critical score (it blocks request immediately).
      - According to OWASP mod-security 3.0 source code it checks for tx.allowedrequestcontenttype variable that contains list of allowed content types - https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.0/master/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf#L991
      - By default tx.allowed
      requestcontenttype contains application/octet-stream so OWASP accepts POST requests with this content type - https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.0/master/rules/REQUEST-901-INITIALIZATION.conf#L163
      - Looks like mod-security in Azure WAF has custom tx.allowedrequestcontent_type configuration without this content type

      It would be nice to synchronize mod-security…

      3 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Azure Firewall  ·  Flag idea as inappropriate…  ·  Admin →
    17. Azure Firewall - Utilize Existing Subnet

      Azure Firewall should allow for deployment into an existing subnet, pending the requirements met for available IP address space.

      3 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Azure Firewall  ·  Flag idea as inappropriate…  ·  Admin →
    18. More public IPs on Azure Firewall

      At the moment you only have the possibility to have 1 public IP on Azure Firewall. When this IP is used for ex. access to AD FS WAP behind Azure Firewall, then you are not able to host other services on port 443/tcp behind Azure Firewall that needs to be accessible from the Internet.

      Please provide the option to add additional public IPs to Azure Firewall.

      112 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      7 comments  ·  Azure Firewall  ·  Flag idea as inappropriate…  ·  Admin →
    19. FQDN tag in Azure Firewall for AzureMonitor

      FQDN tag in Azure Firewall for AzureMonitor

      1 vote
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Azure Firewall  ·  Flag idea as inappropriate…  ·  Admin →
    20. Add Azure Firewall compatibility with Application Gateway

      I have an architecture with multiple subscriptions, virtual networks and connectivity to on-premises. In the hub subscription we use(d) Azure Firewall to filter network traffic between networks.

      It appears that Azure Firewall cannot be used in conjunction with Application Gateway, as (apparently?) the health probe traffic is not routed correctly and backend status is deemed as "unknown" even though everything is healthy. Microsoft Support confirmed that this is currently unsupported.

      This prevents us from using ready made PaaS solutions (App GW) in order to publish services running in Azure. At the same time, we consider network security a critical matter…

      83 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      3 comments  ·  Azure Firewall  ·  Flag idea as inappropriate…  ·  Admin →
    ← Previous 1 3
    • Don't see your idea?

    Feedback and Knowledge Base