Azure network security configurations rely on a defense-in-depth model operating across multiple layers (L3/L4 transport filtering, L7 application inspection, and platform-level perimeter defense).

Below is an overview of the primary Azure network security constructs, how they differ, and standard deployment patterns.

1. Network Access Control Controls

Network Security Groups (NSGs)

• Scope:L3/L4 stateful packet inspection. Attached to Subnets or Network Interfaces (NICs).
• Rule Syntax:Evaluates 5-tuple hash (Source IP, Source Port, Destination IP, Destination Port, Protocol) based on rule Priority (100–4096). Lower numbers take precedence.
• Service Tags: Simplifies rule management by representing groups of IP address prefixes (e.g., VirtualNetwork, AzureCloud, Storage).
• Application Security Groups (ASGs): Allows grouping virtual machines into logical application tiers (e.g., Web-Tier, DB-Tier) to write rules based on workload identity rather than explicit static IPs.

Azure Firewall

• Scope:Fully managed, cloud-native L4/L7 stateful firewall deployed in a dedicated AzureFirewallSubnet.
• Rule Engine:
  • DNAT Rules: Inbound port forwarding/translation.
  • Network Rules: L3/L4 filtering based on IP addresses, ports, and protocols.
  • Application Rules: Fully Qualified Domain Name (FQDN) filtering (e.g., allow *.github.com via HTTP/HTTPS).
• SKU Tiers:
  • Basic:SMB workloads (< 250 Mbps).
  • Standard:L3–L7 filtering, threat intelligence-based filtering, DNS Proxy.
  • Premium:Signature-based Intrusion Detection & Prevention System (IDPS), TLS Inspection, and URL filtering.

2. Web & Perimeter Protection

Service	OSI Layer	Scope / Placement	Primary Use Case
Azure Web Application Firewall (WAF)	Layer 7	Integrated with Application Gateway or Azure Front Door	Protects HTTP/HTTPS apps from common web exploits (OWASP Top 10, SQLi, XSS) and rate limiting.
Azure DDoS Protection	Layer 3/4	Applied to Virtual Networks / Public IPs	Mitigates volumetric and protocol DDoS attacks with automated traffic profiling and adaptive tuning.
Azure Bastion	Layer 7	Dedicated AzureBastionSubnet	Provides agentless, secure RDP/SSH access to VMs directly via browser over TLS, keeping VMs free of public IP addresses.

3. Secure PaaS & Private Connectivity

To prevent Azure PaaS services (e.g., Storage Accounts, SQL Databases) from exposing public IP addresses:

• Private Endpoints (Azure Private Link): Assigns a private IP address from your Virtual Network to an individual Azure PaaS instance. Eliminates public internet access and prevents data exfiltration risks.
• Service Endpoints: Secures direct connection to PaaS endpoints by extending your VNet private address space over the Azure backbone, while keeping the public IP destination of the PaaS service.

4. Routing & Traffic Inspection Enforcers

By default, system routes in Azure allow VNet-to-VNet and outbound Internet communications directly. To force traffic through a centralized inspection point (like Azure Firewall or a Network Virtual Appliance):

1. User Defined Routes (UDRs): Custom route tables attached to subnets.
2. Next Hop Overrides: Route 0.0.0.0/0 (Internet) or internal VNet CIDRs to the private IP address of the Azure Firewall as the VirtualAppliance next hop.

Recommended Architecture Pattern: Hub-and-Spoke Topology

                  ┌─────────────────────────────────────────┐
                  │              Public Internet            │
                  └────────────────────┬────────────────────┘
                                       │
                               ┌───────▼───────┐
                               │  Azure WAF /  │ (Public Edge Inbound)
                               │  Front Door   │
                               └───────┬───────┘
                                       │
    ┌──────────────────────────────────▼──────────────────────────────────┐
    │ HUB VNet                                                            │
    │                                                                     │
    │  ┌───────────────────────────────────────────────────────────────┐  │
    │  │ AzureFirewallSubnet                                           │  │
    │  │ ┌───────────────────────────────────────────────────────────┐ │  │
    │  │ │                      Azure Firewall                       │ │  │
    │  │ └───────────────────────────────────────────────────────────┘ │  │
    │  └───────────────────────────────▲───────────────────────────────┘  │
    └──────────────────────────────────┼──────────────────────────────────┘
                                       │ (VNet Peering + UDR)
            ┌──────────────────────────┴──────────────────────────┐
            │                                                     │
    ┌───────▼─────────────────────────────┐       ┌───────────────▼─────────────────────┐
    │ SPOKE 1: Web App VNet               │       │ SPOKE 2: Backend VNet               │
    │                                     │       │                                     │
    │ ┌─────────────────────────────────┐ │       │ ┌─────────────────────────────────┐ │
    │ │ Subnet: Web Tier                │ │       │ │ Subnet: Database Tier           │ │
    │ │  • NSG: Allow inbound 443 from  │ │       │ │  • NSG: Allow 1433 from Web     │ │
    │ │    Firewall Subnet              │ │       │ │    subnet only                  │ │
    │ │  • UDR: Default route to FW     │ │       │ │  • Private Endpoint (SQL DB)    │ │
    │ └─────────────────────────────────┘ │       │ └─────────────────────────────────┘ │
    └─────────────────────────────────────┘       └─────────────────────────────────────┘

1. Centralized Inspection: All spoke traffic routes through the central Hub VNet where the Azure Firewall resides.
2. Micro-Segmentation: Spoke subnets use localized NSGs to limit lateral movement between subnets (e.g., blocking direct access to the database layer from non-web tiers).
3. Private Access: Backend resources communicate externally or with PaaS using Private Endpoints.