1. Azure Firewall Architecture Recap

  • Azure Firewall — Managed, stateful L3–L7 firewall in hub VNet. Supports FQDN filtering, threat intelligence, TLS inspection (Premium), and IDPS.
  • NVA (3rd-party) — Use when you need vendor-specific features (Palo Alto, Fortinet). Higher ops burden; requires HA design (NVA + ILB).
  • NSG-only — Sufficient for simple workloads with L4 filtering only. No application-layer inspection, no centralized logging.

Decision: Use Azure Firewall for most enterprise hubs; NVA only when regulatory/vendor lock-in requires it; NSG-only for isolated dev/test spokes.

2. WAF Placement: App Gateway vs Front Door

Criteria
WAF on App Gateway
WAF on Front Door
Scope
Single region, VNet-attached
Global edge (anycast)
Best for
Internal + external apps in one region
Multi-region public web apps
TLS Termination
At regional gateway
At edge POP worldwide
Bot Protection
Basic (managed rules)
Advanced bot manager
Private backends
Yes (VNet integration)
Via Private Link origins
DDoS synergy
Pair with DDoS Protection plan
Built-in L7 + Azure DDoS at edge

Rule of thumb: Front Door WAF for internet-facing multi-region; App Gateway WAF for single-region or internal apps needing L7 inspection inside VNet.

3. DDoS Protection Tiers

Feature
IP Protection ($199/mo per IP)
Network Protection ($2,944/mo per VNet)
Billing unit
Per protected public IP
Flat per VNet (up to 100 IPs included)
Break-even
≤ 14 public IPs
≥ 15 public IPs per VNet
Cost guarantee
No
Yes — cost protection credit during attack
Rapid Response (DRR)
No
Yes — Microsoft DDoS experts on call
Telemetry & alerts
Basic metrics
Full adaptive tuning + diagnostic logs
WAF discount
No
Yes — free App GW WAF data processing

Cost architecture: Small SaaS (1–5 IPs) → IP Protection. Enterprise with many public endpoints → Network Protection for cost cap + DRR.

4. Firewall Manager — Centralized Multi-Hub Policy

Central policy plane — defines rule collections & IDPS profiles
↓ deploys policy
Azure Firewall Premium + local route tables
↓ deploys policy
Azure Firewall Premium + local route tables
↓ deploys policy
Integrated firewall in Virtual WAN hub
  • Hierarchical policies: Base policy (global deny rules) → child policies per region/BU for local overrides.
  • vWAN integration: Convert Virtual WAN hub to "secured virtual hub" — Firewall Manager auto-provisions firewall.
  • Third-party SECaaS: Route internet traffic through Zscaler/iBoss via Firewall Manager partner integration.

5. NSG Flow Logs v2 → Traffic Analytics → Sentinel

  • NSG flow logs v2 — Per-flow metadata (src/dst IP, port, protocol, bytes, packets, action). Stored in Storage Account as JSON.
  • Traffic Analytics — Ingests flow logs into Log Analytics; geo-map, top talkers, anomaly detection.
  • Sentinel pipeline: Traffic Analytics → Log Analytics → Sentinel data connector → correlate with sign-in/threat intel.
  • Retention: Storage Account raw logs (hot 30d, cool 90d, archive 365d). Log Analytics 90d default.

Design tip: Enable flow logs at subnet NSG level (not NIC) to avoid duplication. Use VNet flow logs (preview) for simplified coverage.

🌍 Real-World Scenario

Multi-Region SaaS: DDoS Tier + WAF Placement

A B2B SaaS platform serves customers from East US and West Europe. Each region has 3 public IPs (App Gateway, API Management, SFTP). Total = 6 IPs across 2 VNets. At $199/IP, DDoS IP Protection costs $1,194/mo. Network Protection would cost $5,888/mo (2 VNets). Decision: IP Protection — well under the 15-IP break-even.

For WAF: Front Door WAF protects all public web traffic at the edge with geo-filtering and bot rules. Behind it, App Gateway (no WAF) handles regional SSL offload and path routing into AKS. NSG flow logs v2 feed Traffic Analytics; Sentinel correlates blocked WAF requests with NSG deny events to detect lateral movement attempts post-initial probe.

📝 Exam Tip

When a scenario mentions "cost protection during DDoS attack" or "DDoS Rapid Response team," the answer is DDoS Network Protection — IP Protection lacks both. If the question says "centralized firewall policy across multiple hubs and vWAN," the answer is Azure Firewall Manager. For WAF: Front Door = global/multi-region; App Gateway = single-region/internal.

🧪 Knowledge Check

Q1: A company has 4 public IPs across one VNet. Which DDoS tier is most cost-effective?

Q2: Which service provides centralized firewall policy deployment across hub VNets and vWAN?

Q3: A global web app needs WAF with bot protection and edge TLS termination across 5 regions. Best placement?

Q4: NSG flow logs v2 are stored in a Storage Account. What service processes them for geo-visualization and anomaly detection?