Azure firewall behavior if instances misbehave

Hi @Tarek Metwally ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

1. When the two virtual machines that Azure Firewall starts with are not functioning properly, the services encounter some specific challenges, Firewall is a fully stateful as a service with built in high availability and high scalability but issues with the initial instances can impact its effectiveness.
2. Azure Firewall starts with two virtual machines to enhance reliability and scalability. If both virtual machines fail or encounter issues simultaneously, the functionality of the firewall can be severely affected, resulting in potential downtime for services relying on it.
3. To ensure high availability, Azure Firewall utilizes mechanisms that may include load balancing and failover capabilities. A proper configuration should allow the firewall to automatically redistribute traffic and initiate replacement of failing instances. However, should both initial instances fail, the firewall's ability to process and route network traffic could be compromised, leading to interruptions in network security services until the instances are restored
4. The recommended solution for maintain high availability is deploying Azure Firewall across multiple availability zones provides higher SLAs, ensuring continuous operation even if one zone experiences issues.

• For your reference: https://video2.skills-academy.com/en-us/azure/well-architected/service-guides/azure-firewall#recommendations

Kindly let us know if the above helps or you need further assistance on this issue.

Thanks,

Sai Prasanna.

Hello Sai,

Thanks for the prompt response and answering my question .

I know that Azure firewall has it's own load balancing mechanism , but for my extra availability demands is it possible and supported to build an external Azure or non-Azure load balancing solution in front of Azure Firewall ? for example Azure Load balancer (Internal , external or global) or Azure front door.

Thanks.

Tarek

Hi Sai,

Many thanks for your response and this is considered accepted answer from my side .

Hi @Tarek Metwally,

Thanks for the reply. I have converted my comment into an answer.

If the answer is helpful, please click "Accept Answer" and "Upvote it." This will help us and others in the community as well.

Your contribution is highly appreciated.

Kindly let us know if the above helps or you need further assistance on this issue.

Thanks.