Layered Network Security Model
Defense in depth means multiple layers. Each layer catches what the previous one misses. The architect's job is deciding which layers are worth the cost.
Not Every Layer Is Always Needed
- Internal-only workloads (no public endpoint): Skip DDoS & WAF; NSG + Firewall may suffice
- Simple web app (App Service + managed DB): WAF on Front Door/App Gateway + NSG; no Firewall needed
- Regulated enterprise: All layers, plus NVA for IDS/IPS if compliance demands specific vendor
NSG vs Azure Firewall vs NVA — Decision Framework
| Criterion | NSG | Azure Firewall | NVA (3rd party) |
|---|---|---|---|
| Layer | L3/L4 (IP + port) | L3-L7 (FQDN, TLS inspection) | L3-L7 (vendor-specific) |
| Scope | Per subnet / NIC | Centralized in hub | Centralized in hub |
| Cost | Free | ~$900-1,500/mo (Standard) | $2,000-10,000+/mo |
| FQDN filtering | No | Yes | Yes |
| TLS inspection | No | Yes (Premium) | Yes |
| IDS/IPS | No | Yes (Premium) | Yes (specialized) |
| Logging | Flow logs (raw) | Structured logs + Workbooks | Vendor-specific SIEM |
| Management | Per-subnet rules | Centralized policy | Vendor console |
| Best for | Micro-segmentation within VNet | Centralized egress/E-W control | Compliance requiring specific vendor (Palo Alto, Fortinet) |
AZ-305 Exam Tip
If the scenario mentions "FQDN-based filtering" or "TLS inspection" — the answer involves Azure Firewall Premium or NVA, not NSGs. If it mentions "compliance requires Palo Alto/Fortinet" — that's NVA territory. NSG alone is only sufficient for simple port-based rules.
Azure Firewall Tiers
| Feature | Basic | Standard | Premium |
|---|---|---|---|
| Cost | ~$300/mo | ~$900/mo | ~$1,500/mo |
| Throughput | 250 Mbps | 30 Gbps | 100 Gbps |
| FQDN filtering | ✅ | ✅ | ✅ |
| Threat intelligence | Alert only | Alert & deny | Alert & deny |
| TLS inspection | ❌ | ❌ | ✅ |
| IDPS | ❌ | ❌ | ✅ |
| URL filtering | ❌ | ❌ | ✅ (full URL path) |
| Web categories | ❌ | FQDN-based | Full URL-based |
| Best for | SMB, dev/test | Production enterprise | Regulated (finance, healthcare) |
UDR Design Patterns
User-Defined Routes override Azure's default routing. They're how you force traffic through a firewall — the backbone of hub-spoke security.
Common UDR Patterns
- Default route override (
0.0.0.0/0 → Firewall NIC) — forces all internet-bound traffic through firewall - Spoke-to-spoke via hub — prevents direct VNet peering bypass; all east-west traffic inspected
- Forced tunnelling to on-prem — route internet traffic through on-prem proxy (compliance requirement)
- Service bypass — specific routes for Azure PaaS that shouldn't go through firewall (e.g., AzureCloud service tag)
Asymmetric Routing Pitfall
If traffic goes out through the firewall but the return takes a different path, the firewall drops it (stateful inspection fails). Always ensure return traffic follows the same path. Common mistake: adding UDR on app subnet but not on the GatewaySubnet.
Application Security Groups
ASGs let you group VMs by role (web, app, db) and write NSG rules using logical names instead of IP addresses. This scales far better than per-IP rules.
Without ASGs (IP-based)
Allow 10.1.1.4, 10.1.1.5, 10.1.1.6 → 10.1.2.4, 10.1.2.5 : Port 443
Allow 10.1.2.4, 10.1.2.5 → 10.1.3.4 : Port 1433With ASGs (role-based)
Allow ASG:web-servers → ASG:app-servers : Port 443
Allow ASG:app-servers → ASG:db-servers : Port 1433ASG Architecture Benefits
- Rules survive VM scale-out — new VMs auto-join the ASG
- No rule updates when IPs change
- Self-documenting security rules (readable by auditors)
- Works across subnets within the same VNet
NSG Flow Logs & Traffic Analytics
Flow logs capture every connection attempt at the NSG level. Traffic Analytics processes them into actionable insights.
Architecture for Compliance
- NSG Flow Logs v2 → Storage Account (retention for audit) → Log Analytics workspace
- Traffic Analytics processes flow data: top talkers, geo mapping, open ports, malicious IPs
- Integration: Export to Microsoft Sentinel for SIEM correlation
- Cost consideration: Flow logs generate significant storage — use lifecycle policies for tiering
Real-World: MedSecure — Regulated Healthcare Platform
Scenario: Healthcare SaaS handling PHI (Protected Health Information). Must comply with HIPAA. Requires: encrypted transit, no direct internet access from data tier, full traffic audit, IDS/IPS.
Network Security Architecture
- DDoS Protection Standard on VNet (HIPAA requires availability protection)
- Front Door + WAF for public API endpoints (OWASP rules, rate limiting, geo-filtering)
- Azure Firewall Premium in hub (TLS inspection for egress, IDPS for known threats, FQDN-allow-list for data tier)
- NSGs + ASGs on every subnet: web-asg → app-asg → data-asg (only needed ports)
- UDRs: 0.0.0.0/0 → Firewall on all spokes; data subnet has NO internet route at all
- NSG Flow Logs v2 → Storage (365-day retention) → Traffic Analytics → Sentinel
- Private Endpoints for all PaaS (SQL, Storage, Key Vault) — no public access
Cost: ~$3,200/mo for security infrastructure
DDoS ($2,944) + Firewall Premium ($1,500) + Flow Logs storage (~$200). The DDoS cost is shared across all VNets in the subscription. Worth it for HIPAA compliance and the $1.5M penalty avoidance.
Knowledge Check
1. A workload requires FQDN-based egress filtering (allow only *.microsoft.com and api.partner.com). NSGs can't do this. What's the most cost-effective solution?
2. Spoke-to-spoke traffic is bypassing the hub firewall even though UDRs are configured. What's the most likely cause?
3. You have 50 web servers that scale dynamically. Writing NSG rules with IP addresses is unmanageable. What's the best approach?
4. Traffic exits through Azure Firewall but return traffic comes directly back to the VM (bypassing firewall). The connection fails. Why?
Key Takeaways
- NSGs are free micro-segmentation (L3/L4); Azure Firewall adds centralized L7 control; NVAs for specific compliance vendors
- UDRs force traffic through firewalls — always ensure symmetric routing to avoid drops
- ASGs scale network rules with dynamic workloads — use them instead of IP-based rules
- Flow Logs + Traffic Analytics = network visibility for compliance audits