The Azure Security Center dashboard recommends that you deploy a VM-Series
firewall to secure a workload that is exposed to the internet. You can only
deploy the firewall in a new resource group or an existing resource group
that’s empty. This is because Azure currently restricts you from deploying a
multi-NIC appliance in an existing resource group. Therefore, after you
deploy the VVM-Series firewall you must manually configure it to be in the
path of traffic of the workload that you need to secure.
When you deploy the firewall from the Azure Security Center, the firewall is
launched with three network interfaces—management, external facing (untrust)
and internal facing (trust)—and a user-defined route (UDR) that sends all
outbound traffic from the trust subnet to the trust interface on the
firewall so that internet-bound traffic is always inspected by the firewall.
The default configuration includes two example Security policy rules:
- outbound-default rule allows all traffic from the trust
zone to the untrust zone on the application default port.
- inbound-default rule allows all web-browsing traffic
from the untrust zone to the trust zone, after inspecting traffic
with the default antivirus, antispyware, and Vulnerability
Protection Security Profiles.
The firewall also forwards all files that are intercepted with the
inbound or outbound rule to the WildFire public cloud for analysis. Both
rules include a URL Filtering profile that blocks all traffic to the URL
categories copyright-infringement, dynamic DNS, extremism, malware,
phishing, and unknown. In addition to these Security Profiles, both Security
policy rules are enabled to log at session end and to forward threat and
WildFire Submissions logs as security alerts to the Azure Security Center
dashboard.
To make practical use of this integration and
Deploy a VM-Series Firewall Based on an Azure Security Center Recommendation within the same resource
group as the workloads you want to secure, you can stage a workload with a
public IP address that is exposed to the internet. When the Azure Security
Center detects the security risk, it triggers a recommendation to deploy a
next-generation firewall, and you can then deploy the VM-Series firewall in
a new resource group into which you can add your workloads later. You must
then delete the workload that you staged to trigger the recommendation.
