azure-firewall

To configure Azure Firewall policies for a hub-spoke topology, deploy the firewall in the hub VNet and apply centralized policies to secure egress traffic from spoke networks. You can enforce policy inheritance and manage rules across multiple Availability Zones.

Azure Firewall SKUs differ in features: Basic provides standard traffic filtering, Standard adds DNAT and network rules, while Premium includes advanced capabilities like TLS inspection and IDPS. Choose a SKU based on your required security level and scale.

DNAT in Azure Firewall translates destination IP addresses to route incoming traffic to internal resources. You configure DNAT rules alongside network and application rules to securely expose services while maintaining centralized traffic control.

Yes, Azure Firewall supports monitoring and diagnostics to track rule hits and network traffic. You can verify rule hits via diagnostic logs and integrate with monitoring tools to ensure production-grade security and traffic analysis.

Forced tunneling in Azure Firewall routes all outbound traffic through a designated next hop rather than directly to the internet. Use it when you need to inspect or log all egress traffic through an external firewall or security appliance.

To plan SNAT capacity for Azure Firewall deployment, calculate the expected concurrent outbound connections and choose the appropriate SKU. Proper SNAT capacity planning ensures scalable deployment without exhausting available ports during peak traffic.