azure-firewall

Automate Azure Firewall deployment and policy configuration across Availability Zones.

Updated Apr 27, 2026

Search Tags:#monitoring #azure #policy #firewall #network-security #dnat

Ready to run

npx skills add https://github.com/tomz/agent-skills --skill azure-firewall-tomz

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: azure-firewall
Source: https://github.com/tomz/agent-skills/tree/main/azure-firewall
Command: npx skills add https://github.com/tomz/agent-skills --skill azure-firewall-tomz

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Azure Firewall is a cloud-native, managed security service that protects Azure resources by providing centralized control over network traffic via firewall policies, DNAT, DNS proxy, and hub-spoke topologies.

Core Features & Use Cases

Centralized policy management with Basic, Standard, and Premium SKUs.
Supports DNAT, network and application rules, DNS proxy, forced tunneling, IDPS, TLS inspection, and monitoring.
Use Case: Protects a multi-VNet environment and enforces secure egress from spoke networks to the internet.

Quick Start

Configure a Standard firewall policy for your hub VNet and verify rule hits via diagnostics.

Frequently Asked Questions about azure-firewall

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I configure Azure Firewall policies for a hub-spoke topology?▼

To configure Azure Firewall policies for a hub-spoke topology, deploy the firewall in the hub VNet and apply centralized policies to secure egress traffic from spoke networks. You can enforce policy inheritance and manage rules across multiple Availability Zones.

What is the difference between Basic, Standard, and Premium Azure Firewall SKUs?▼

Azure Firewall SKUs differ in features: Basic provides standard traffic filtering, Standard adds DNAT and network rules, while Premium includes advanced capabilities like TLS inspection and IDPS. Choose a SKU based on your required security level and scale.

How does DNAT work with Azure Firewall to route incoming traffic?▼

DNAT in Azure Firewall translates destination IP addresses to route incoming traffic to internal resources. You configure DNAT rules alongside network and application rules to securely expose services while maintaining centralized traffic control.

Can I use Azure Firewall to monitor network traffic and diagnose rule hits?▼

Yes, Azure Firewall supports monitoring and diagnostics to track rule hits and network traffic. You can verify rule hits via diagnostic logs and integrate with monitoring tools to ensure production-grade security and traffic analysis.

What is forced tunneling in Azure Firewall and when should I use it?▼

Forced tunneling in Azure Firewall routes all outbound traffic through a designated next hop rather than directly to the internet. Use it when you need to inspect or log all egress traffic through an external firewall or security appliance.

How do I plan SNAT capacity for Azure Firewall deployment?▼

To plan SNAT capacity for Azure Firewall deployment, calculate the expected concurrent outbound connections and choose the appropriate SKU. Proper SNAT capacity planning ensures scalable deployment without exhausting available ports during peak traffic.