Why Network Security Matters

Even the best network architecture is incomplete without security controls. Azure provides multiple layers of defense — from filtering traffic inside VNets to securing outbound traffic and isolating PaaS services.

As a Solution Architect, you need to decide which security tool to use and where, based on workload sensitivity, compliance, and performance needs.

1. Network Security Groups (NSGs)

Definition:

• Act as virtual firewalls at the subnet or NIC level.

• Control inbound and outbound traffic using allow/deny rules.

Key Features:

• Rule-based filtering (source, destination, port, protocol).

• Default rules (allow VNet traffic, deny internet inbound).

• Lightweight, fast, free.

When to Use:

• Basic workload segmentation (Web/App/DB tiers).

• Restricting inbound internet traffic.

2. Azure Firewall

Definition:

• Fully managed, stateful firewall service for Azure VNets.

• Operates at Layer 3–7.

Key Features:

• Application & Network rules (FQDNs, IPs, protocols).

• Threat intelligence-based filtering (block known malicious IPs).

• Outbound traffic control (e.g., allow only specific sites).

• Centralized logging and monitoring.

• High availability built-in.

When to Use:

• Enterprise-scale environments.

• Centralized control in hub-and-spoke architecture.

• Advanced scenarios where NSGs are insufficient.

3. Private Endpoints

Definition:

• Provide a private IP address for Azure PaaS services (e.g., Storage, SQL, Key Vault).

• Access to services goes through VNet private IP instead of public internet.

Key Features:

• Eliminates public internet exposure.

• Works with RBAC/NSGs for layered security.

• Each service instance gets its own private endpoint.

When to Use:

• Secure access to sensitive services like Key Vault or Storage.

• Environments with strict compliance/regulatory requirements.

Design Considerations

• NSGs: Use for intra-VNet and subnet-level traffic filtering.

• Azure Firewall: Use for enterprise-scale centralized filtering, outbound traffic control, and hub-and-spoke models.

• Private Endpoints: Use for isolating Azure PaaS services from internet exposure.

Best Practice: Combine them →

• NSGs for workload-level segmentation.

• Firewall for centralized inspection & outbound control.

• Private Endpoints to secure PaaS services.

Example Enterprise Scenario

A healthcare provider requires:

• Block all inbound internet traffic to its SQL databases.

• Allow app servers to connect only to approved APIs.

• Ensure compliance by preventing accidental public exposure of Storage accounts.

Correct design:

• Apply NSGs on DB subnet to block internet traffic.

• Use Azure Firewall in hub VNet to filter outbound API calls.

• Enable Private Endpoints for Storage and SQL databases.

Confusion Buster

• NSGs vs Firewall:

  • NSGs = simple allow/deny at subnet/NIC.

  • Firewall = advanced, centralized, stateful inspection.

• Firewall vs WAF (Web Application Firewall):

  • Firewall = generic traffic filtering (IP, FQDN, protocol).

  • WAF = protects web apps (SQL injection, XSS).

• Private Endpoint vs Service Endpoint:

  • Service Endpoint = keeps traffic on Azure backbone, but service still has public IP.

  • Private Endpoint = service gets private IP, no public exposure.

Exam Tips

• “Which tool filters subnet-level traffic?” → NSG.

• “Which provides centralized, stateful inspection for VNets?” → Azure Firewall.

• “Which isolates PaaS services from the public internet?” → Private Endpoints.

• “Which solution for compliance to prevent public access to Storage?” → Private Endpoint.

What to Expect in the Exam

• Direct Q: “Which service provides Layer 3–7 firewalling in Azure?” → Azure Firewall.

• Scenario Q: “Company requires PaaS services accessed only via private IP.” → Private Endpoint.

• Scenario Q: “Company wants centralized security filtering across multiple VNets.” → Azure Firewall in hub.

• Trick Q: “NSGs and Azure Firewall provide the same functionality.” → False.