How to integrate Azure Firewall and NAT Gateway

Richard Duane Wolford Jr 221 Reputation points
2024-08-15T13:50:59.65+00:00

Hi, we've set up a hub/spoke in Azure using an Azure Firewall to both control traffic and to allow the spokes to communicate. We want to configure this so that Internet traffic from each of the spokes first hits the firewall just like it would for internal traffic, but then to go over a NAT gateway. This is so we could control Internet access using the firewall and benefit from the NAT gateway. We'd also like to be able to implement URL-based filtering for Internet traffic. Could we get some assistance on how we need to configure this? We're not using a VWAN, just traditional VNETs with a premium firewall.

Azure Firewall
Azure Firewall
An Azure network security service that is used to protect Azure Virtual Network resources.
674 questions
Azure NAT Gateway
Azure NAT Gateway
NAT Gateway is a fully managed service that securely routes internet traffic from a private virtual network with enterprise-grade performance and low latency.
37 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. ChaitanyaNaykodi-MSFT 26,216 Reputation points Microsoft Employee
    2024-08-17T04:11:39.2333333+00:00

    @Richard Duane Wolford Jr

    Thank you for reaching out.

    I understand you wish to deploy NAT Gateway along with Azure Firewall so that the egress internet traffic is filtered by Azure Firewall and the sent over to the internet using NAT Gateway IP.

    This architecture is described in this blog post here

    User's image

    NAT gateway can be easily deployed to an Azure Firewall subnet to automatically scale connections and filter traffic through the firewall before connecting to the internet.

    When a NAT gateway resource is associated with an Azure Firewall subnet, all outbound Internet traffic automatically uses the public IP address of the NAT gateway. There’s no need to configure User Defined Routes. Response traffic to an outbound flow also passes through NAT gateway. There’s no double NAT with this architecture. Azure Firewall instances send the traffic to NAT gateway using their private IP address rather than Azure Firewall public IP address.

    You can refer to this tutorial for step-by step guidance on how to deploy NAT gateway and Azure Firewall in a hub and spoke topology.

    Please let me know if you have any additional questions. Thank you!

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.