In this article, I will be showing the steps to take to protect the web application from malicious traffic and block unauthorized access.

We will start by creating an Azure Firewall subnet in our existing virtual network
In the search box at the top of the portal, enter Virtual networks.

1. Select Virtual networks in the search results.
2. Select app-vnet.
3. Select Subnets.
4. Select + Subnet.
5. Enter the following information and select Save.

Property Value
Name AzureFirewallSubnet
Address range 10.1.63.0/26
Note: Leave all other settings as default.

Next, we create an Azure Firewall

1. In the search box at the portal's top, enter Firewall. Select Firewall in the search results.

2. Select + Create.

3. Create a firewall by using the following values. For any property that is not specified, use the default value.
   Note: Azure Firewall can take a few minutes to deploy.

Property Value
Resource group YOUR RESOURCE GROUP
Name app-vnet-firewall
Firewall SKU Standard
Firewall management Use a Firewall Policy to manage this firewall
Firewall policy select Add new
Policy name fw-policy
Region East US
Policy Tier Standard
Choose a virtual network Use existing
Virtual network app-vnet (YOUR RESOURCE GROUP)
Public IP address Add new: fwpip

1. Select Review + Create and then select Create.

We update the Firewall Policy next.

1. In the search box at the portal's top, enter Firewall Policy. Select Firewall Policies in the search results.
2. Select fw-policy.
3. Select Application rules.
4. Select on ”+ Application rule collection”.
5. Use the values in the following table. For any property that is not specified, use the default value.

Property Value
Name app-vnet-fw-rule-collection
Rule collection type Application
Priority 200
Rule collection action Allow
Rule collection group DefaultApplicationRuleCollectionGroup

a. Under Rules use the values in the below

Property Value
Name AllowAzurePipelines
Source type IP address
Source 10.1.0.0/23
Protocol https
Destination type FQDN
Destination dev.azure.com, azure.microsoft.com
and select Add

Note: The AllowAzurePipelines rule allows the web application to access Azure Pipelines. The rule allows the web application to access the Azure DevOps service and the Azure website.

1. Create a network rule collection that contains a single IP Address rule by using the values in the following table. For any property that is not specified, use the default value.
2. Select Network rules.
3. Select on ”+ Network rule collection”.
4. Use the values in the following table. For any property that is not specified, use the default value.

Property Value
Name app-vnet-fw-nrc-dns
Rule collection type Network
Priority 200
Rule collection action Allow
Rule collection group DefaultNetworkRuleCollectionGroup

a. Under Rules use the values in the following table

Property Value
Rule AllowDns
Source 10.1.0.0/23
Protocol UDP
Destination ports 53
Destination addresses 1.1.1.1, 1.0.0.1
And select Add.

1. To verify that the Azure Firewall and Firewall Policy provisioning state shows Succeeded.
2. In the search box at the portal's top, enter Firewall. Select Firewall in the search results.
3. Select app-vnet-firewall.
4. Validate that the Provisioning state has Succeeded.
5. In the search box at the portal's top, enter Firewall policies. Select Firewall policies in the search results
6. Select fw-policy.
7. Validate that the Provisioning state is Succeeded