Can I temporarily enable Azure Firewall on a demo environment for testing, and then remove it to stop incurring firewall costs once I apply the configuration to production?

Question

1. Can I temporarily enable Azure Firewall on a demo environment for testing, and then remove it to stop incurring firewall costs once I apply the configuration to production?
2. Does Azure Firewall incur costs for just being applied to a subnet or VNet, or is the cost strictly based on the amount of traffic processed?"
3. If I remove the firewall rules from my demo instance after testing and apply them to the production environment, will I be able to eliminate the associated firewall costs for the demo?"
4. "Are there any hidden costs or considerations that I should be aware of when enabling and disabling firewalls on different environments?
5. What are the cost differences between using Network Security Groups (NSGs) and Azure Firewall for securing different environments? Should I consider using NSGs for demo instances instead of a full Azure Firewall?

Answer 1

Hi chitra manju

Greetings!

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

1. Yes, you can enable Azure Firewall but the term "enable firewall" is incorrect; instead, you can create or delete a firewall.
2. Charges apply for the Azure Firewall instance itself. This means that costs will be incurred as long as the firewall is deployed, regardless of whether any traffic is processed.
3. No, azure firewall costed for number policies or number of rules, but data processing will be cost on hourly basis.
4. If your firewall processes traffic between different Azure regions or between Azure and on-premises, data transfer costs will apply.
5. Network Security Groups (NSGs): NSGs are free to use and provide basic network-layer security by allowing or denying inbound and outbound traffic to Azure resources based on rules. They are a good choice for simpler scenarios or demo environments where advanced features are not required.
6. Azure Firewall: Azure Firewall offers advanced features such as application filtering, threat intelligence, and logging, but it incurs costs for provisioning and data processing. It is more suitable for production environments requiring enhanced security and monitoring.

Refer: https://azure.microsoft.com/en-us/pricing/details/firewall-manager/?msockid=2b90294442396fbb0ce73c5143ce6e35

NOTE: There is no cost for Azure Firewall Manager. You are only charged for the policies and deployments created through Azure Firewall Manager.

---

Hope this clarifies,

Thanks

Ganesh

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Answer 2

I will recommend you take a look at https://azure.microsoft.com/en-us/pricing/details/azure-firewall/

1. Yes You can, but you need to be careful if you do not want to incur charges.  A fixed hourly fee is charged for each Azure Firewall deployment, regardless of the amount of traffic processed. See costing here
2. Even if the firewall is deployed without any traffic, the fixed hourly deployment fee will still apply.
3. removing the firewall from a virtual network does not stop the fixed hourly deployment fee. You must delete the Azure Firewall resource entirely. 
4. Yes, Data transfer between regions.
5. NSGs are free of charge and provide basic network-level traffic filtering. Azure Firewall offers advanced features such as application-level filtering

You can mark it 'Accept Answer' and 'Upvote' if this helped you

Regards,

Abiola