How to integrate Azure Firewall and NAT Gateway

Question

Hi, we've set up a hub/spoke in Azure using an Azure Firewall to both control traffic and to allow the spokes to communicate. We want to configure this so that Internet traffic from each of the spokes first hits the firewall just like it would for internal traffic, but then to go over a NAT gateway. This is so we could control Internet access using the firewall and benefit from the NAT gateway. We'd also like to be able to implement URL-based filtering for Internet traffic. Could we get some assistance on how we need to configure this? We're not using a VWAN, just traditional VNETs with a premium firewall.

Answer 1

@Richard Duane Wolford Jr

Thank you for reaching out.

I understand you wish to deploy NAT Gateway along with Azure Firewall so that the egress internet traffic is filtered by Azure Firewall and the sent over to the internet using NAT Gateway IP.

This architecture is described in this blog post here

NAT gateway can be easily deployed to an Azure Firewall subnet to automatically scale connections and filter traffic through the firewall before connecting to the internet.

When a NAT gateway resource is associated with an Azure Firewall subnet, all outbound Internet traffic automatically uses the public IP address of the NAT gateway. There’s no need to configure User Defined Routes. Response traffic to an outbound flow also passes through NAT gateway. There’s no double NAT with this architecture. Azure Firewall instances send the traffic to NAT gateway using their private IP address rather than Azure Firewall public IP address.

You can refer to this tutorial for step-by step guidance on how to deploy NAT gateway and Azure Firewall in a hub and spoke topology.

Please let me know if you have any additional questions. Thank you!