Design infrastructure solutions · Topic 9 of 10
Network Performance and Security
AZ-305 network protection: NSGs, Azure Firewall tiers, WAF, DDoS Protection, Private Link versus service endpoints and performance tuning.
- 6 min
- NSGs filter L3 and L4, Azure Firewall is central and stateful, WAF protects HTTP apps. Use them together.
- Firewall Basic is for small environments, Standard adds FQDN filtering and threat intelligence deny, Premium adds TLS inspection and IDPS.
- DDoS IP Protection is per public IP and cheaper for a few IPs. Network Protection covers up to 100 IPs and adds rapid response and cost protection.
What it is
A network design must be fast enough and secure enough. For security, you layer controls: segmentation, filtering, web protection, DDoS protection and private access to services. For performance, you reduce latency and raise throughput with placement, caching and the right connectivity. Good designs use defence in depth, applying several layers rather than one.
How it works
Network security controls
| Control | Layer | Role |
|---|---|---|
| Network security groups (NSGs) | 3 and 4 | Allow or deny traffic to subnets and NICs by address, port and protocol, with service tags and application security groups (ASGs) to group VMs |
| Azure Firewall | 3 to 7 | Central, stateful, managed firewall for east west and egress traffic, with FQDN filtering and threat intelligence |
| Web Application Firewall (WAF) | 7 | Protects HTTP and HTTPS apps from SQL injection, cross site scripting and bots, on Application Gateway or Front Door |
| Azure DDoS Protection | 3 and 4 | Absorbs volumetric attacks |
| Private Link | — | Private access to PaaS or your own service |
| Azure Bastion | — | Browser based RDP and SSH with no public IP on VMs |
| Network Watcher | — | Diagnostics, flow logs, connection monitor |
Azure Firewall tiers
| Tier | Highlights |
|---|---|
| Basic | Small business, about 250 Mbps, threat intelligence in alert mode only, no network FQDN filtering or web categories |
| Standard | L3 to L7, FQDN and web category filtering, DNS proxy, threat intelligence with deny, autoscaling up to 30 Gbps |
| Premium | Adds TLS inspection, IDPS (signature based intrusion detection and prevention with tens of thousands of signatures, set to alert or alert and deny) and full URL filtering, up to 100 Gbps (lower with inspection on) |
Manage firewalls centrally with Firewall Manager and policies. Route traffic through the firewall with user defined routes. Use Premium when the requirement is inspecting encrypted traffic or IDPS. Use NSGs for simple allow and deny between subnets, since they are free. Use both: NSGs for segmentation and the firewall for central control. A WAF is not a substitute for Azure Firewall, and Microsoft recommends using them together.
WAF and DDoS
- WAF on Application Gateway (regional) or on Front Door (global edge). Front Door Standard has only custom rules, and Premium adds managed rule sets and bot protection. Start in detection mode, then move to prevention.
- DDoS infrastructure protection is automatic and free for all public IPs, with no tuning or telemetry.
- DDoS IP Protection is priced per public IP, with adaptive tuning and analytics. It is cheaper for fewer than roughly 15 public IPs.
- DDoS Network Protection is a plan covering many public IPs (up to 100 across subscriptions) and adds rapid response support, cost protection and the WAF discount. It suits large estates. Combine either with a WAF for application layer attacks.
Private access to services
| Option | Behaviour |
|---|---|
| Service endpoint | Extends your VNet identity to a PaaS service over the Microsoft backbone, but the service keeps its public IP. Free, no DNS change, scoped to the service type, and only from inside the VNet |
| Private endpoint | A private IP in your subnet mapped to one specific resource. Works from on premises over VPN or ExpressRoute. Needs a Private DNS zone, and has an hourly charge |
| Private Link service | Lets you publish your own service behind a Standard Load Balancer so consumers connect through private endpoints |
| Disable public network access | Pair with private endpoints to remove the public path |
Choose private endpoints for strong isolation and on premises access, and service endpoints for a cheap, simple restriction when private IPs are not required.
Optimising network performance
| Goal | Techniques |
|---|---|
| Lower latency | Place resources close to users, use Front Door (anycast edge) and CDN caching, proximity placement groups for tightly coupled VMs, and accelerated networking on VMs |
| Higher throughput | Larger VM sizes, accelerated networking, ExpressRoute with FastPath, and enough gateway SKU capacity |
| Efficient routing | Hub and spoke or Virtual WAN, global VNet peering, and avoiding hair pinning through a firewall for traffic that does not need it |
| Reduce outbound cost | Keep traffic in region, use Private Link, cache at the edge |
| Diagnose | Network Watcher (connection monitor, flow logs, packet capture) and ExpressRoute monitoring |
| Scale | Autoscale gateways and Application Gateway v2, and use NAT Gateway for SNAT capacity |
Choosing quickly
| Requirement | Answer |
|---|---|
| Inspect outbound HTTPS and block known attack signatures | Azure Firewall Premium |
| Block SQL injection against a web app | WAF on Application Gateway or Front Door |
| Cheap protection for a few public IPs against DDoS | DDoS IP Protection |
| Tenant wide DDoS protection with response support | DDoS Network Protection |
| Reach Azure SQL privately from on premises | A private endpoint with a Private DNS zone |
| Restrict a storage account to one subnet cheaply | A service endpoint |
A worked scenario
A bank hosts a public portal and an internal API. The portal sits behind Front Door Premium with WAF (prevention mode) and DDoS Network Protection on its networks. Spoke subnets use NSGs with ASGs, all egress and east west traffic goes through Azure Firewall Premium with TLS inspection and IDPS. Databases and storage use private endpoints with disabled public access and Private DNS zones. Accelerated networking and proximity placement groups keep the app and database latency low.
What to remember for the exam
- NSGs filter L3 and L4, Azure Firewall is central and stateful, WAF protects HTTP apps. Use them together.
- Firewall Basic is for small environments, Standard adds FQDN filtering and threat intelligence deny, Premium adds TLS inspection and IDPS.
- DDoS IP Protection is per public IP and cheaper for a few IPs. Network Protection covers up to 100 IPs and adds rapid response and cost protection.
- Private endpoints give private IPs for one resource and work from on premises. Service endpoints keep the public IP and are free.
- Accelerated networking, proximity placement groups and Front Door improve performance.
"Decrypt and inspect outbound HTTPS" means Azure Firewall Premium. "Block SQL injection" means WAF.
How the exam asks about this
- "Inspect encrypted traffic and use IDPS." Azure Firewall Premium.
- "Protect a public web application from common web attacks." WAF.
- "Connect to a storage account over a private IP from on premises." A private endpoint.
- "Restrict a PaaS service to a VNet at no cost." A service endpoint.
Common mistakes
Using a WAF instead of a firewall, or the reverse. They do different jobs.
Forgetting the Private DNS zone for a private endpoint.
Choosing Premium firewall for simple filtering. NSGs may suffice.
Starting WAF in prevention mode without testing.
Check yourself
Which Azure Firewall tier adds TLS inspection and IDPS?
Premium.
Which option gives a private IP for a single resource?
A private endpoint.
Which DDoS option is a plan covering many public IPs?
DDoS Network Protection.
Topic 9 of 10 in Design infrastructure solutions
Test yourself on Design infrastructure solutions
The full Microsoft AZ-305 question bank has 755 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.