The ticket
pay-api on the spoke answers from the internet on 443. Azure Firewall policy is “deny internet inbound.” There is no WAF. The NIC NSG has AllowAnyCustomAnyInbound. The Firewall never saw the SYN — it hit a public IP on the VM. You bought three products and used none of them.
NSG: stateful 5-tuple (src/dst IP, port, protocol) on NIC and/or subnet. Default rules allow VNet and outbound Internet; inbound Internet is denied unless you punch it. Azure Firewall: hub appliance — network rules, application (FQDN) rules, DNAT, SNAT, threat intelligence. Lives in AzureFirewallSubnet. WAF: HTTP/S inspection (OWASP CRS and friends) on Application Gateway or Front Door. Force spoke egress with UDR 0.0.0.0/0 next hop 10.40.0.4. None of these is a substitute for the others.
Tenant techclick-lab.in · MG tc-root / tc-landing / tc-workloads · subs sub-hub sub-spoke-app · hub VNet 10.40.0.0/16 · spoke 10.41.0.0/16 · Azure Firewall 10.40.0.4 · VPN GW public 203.0.113.50 · on-prem FortiGate WAN 203.0.113.10. Not a live tenant.
Mental model
| NSG | Azure Firewall | WAF | |
|---|---|---|---|
| Layer | L3/L4 5-tuple | L3–L7 + FQDN + TI | HTTP/S |
| Where | NIC / subnet | Hub AzureFirewallSubnet | App Gateway / Front Door |
| State | Stateful | Stateful, SNAT outbound | Request/response inspect |
| This lab | nsg-spoke-app | 10.40.0.4 | In front of pay-api HTTP |
| Cannot | Read a URL path | Replace HTTP CRS | Filter SMB or SQL TDS |
UDR 0.0.0.0/0 on the spoke subnet → 10.40.0.4. Public IP on the VM bypasses the Firewall.
How to choose
| Need | Control | Not enough |
|---|---|---|
| East-west 5-tuple on the NIC | NSG (+ ASG) | WAF |
| Central egress / FQDN / SNAT / TI | Azure Firewall + UDR | NSG Internet deny alone |
| SQLi / XSS / HTTP header abuse | WAF | Firewall network rule |
Application + network
Runbook
Side A — path
Does pay-api have a public IP? If yes, the Firewall is sightseeing. Remove it. HTTP(S) lands on App Gateway/Front Door + WAF. Egress via UDR to
10.40.0.4.Side B — 5-tuple
NSG on the spoke subnet: allow only Gateway/Firewall/ASG sources. Effective security rules on the NIC — not the NSG JSON you wish you wrote.
Side C — prove
Firewall logs (application + network). NSG flow / effective rules. WAF matched rule. Three proofs if you claim three controls.
az network nic list-effective-nsg --resource-group rg-spoke --name nic-pay-api -o table # Direction Priority Source Dest Action # Inbound 65000 VirtualNetwork * Allow # Inbound 65500 Internet * Deny az network route-table route list -g rg-spoke --route-table-name rt-spoke -o table # Name AddressPrefix NextHopType NextHopIpAddress # default 0.0.0.0/0 VirtualAppliance 10.40.0.4 az network firewall show -g rg-hub -n fw-hub --query "ipConfigurations[0].privateIPAddress" -o tsv # 10.40.0.4
Four failures
1 · Public IP on the VM
UDR never sees inbound. You are not “behind the Firewall.”
2 · NSG any-any because Firewall exists
Spoke-to-spoke, NIC-level, and non-forced paths still hit the NSG. Keep it tight.
3 · WAF as a network firewall
It will not stop RDP or SQL. Different layer.
4 · UDR without a return story
On-prem 10.20.30.0/24 via VPN must not be accidentally sent to the Firewall’s Internet SNAT unless you designed that. More specific prefixes first.
How to prove it
1) Effective NSG matches the story. 2) UDR next hop is 10.40.0.4. 3) No stray public IP on pay-api. 4) HTTP has a WAF in front if you claimed L7.
Traps
| Said | Missing |
|---|---|
| Firewall will FQDN-filter this VM | UDR + no public IP + DNS the Firewall understands |
| NSG has FQDN | It does not — use Firewall app rules or FQDN tags where they exist |
| WAF replaces NSG | Non-HTTP still needs L3/L4 |
Knowledge check
Judgment items. One best answer. Reasons send you back to the matching section.
Azure security class series: Shared + Entra · Landing zone · NSG vs Firewall vs WAF · Conditional Access · Key Vault + MI · Private Link · Defender + Sentinel · Hub-spoke · Identity path · Interview
Sources
- Microsoft Learn — Network security groups.
- Microsoft Learn — What is Azure Firewall?.
- Microsoft Learn — What is Azure Web Application Firewall?.
Related: Azure session factory · Migration series.