Do we need to enable Azure firewall threat intelligence protection even if the communication is private via express route circuit

Question

We have hybrid connectivity model setup in our environment where on-premises network is connected to Azure via Express route circuit with private peering enabled.
on the Azure firewall policy we have explicitly denied outbound internet connectivity also there is no Internet connectivity enabled neither inbound or outbound.
All the communication from on-premises to azure and vice versa is private.
we need suggestion with the above setup
Question - do if we still need to have azure firewall threat intelligence mode ON ?
or there is no need of it.

Answer 1

@Mahesh Badgujar ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well

The answer to your question depends on your set up.

Consider 2 scenarios,

1 . All Internet traffic is dropped at Azure Firewall and only OnPrem private traffic is routed via ExR

• In this case, Azure Firewall threat intelligence-based filtering is not required
• Since every traffic is destined to OnPrem endPoints/servers/applications only, there is no need to enable this.
• i.e., when the destination is a private IP hosted in your OnPrem locally, no need to check for known malicious IP addresses, FQDNs, and URLs.

2 . Internet traffic is not dropped, but routed to OnPrem via ExR

• Assume all internet traffic is going via ExR to an OnPrem Firewall or NAT Device.
• In this case, if your OnPrem Firewall or NAT Device lacks the capability to check for malicious IP addresses, FQDNs, and URLs - then you can leverage Azure Firewall threat intelligence feature.
• i.e., when the flow is
  Azure VM ---> Azure Firewall ---> ExR ---> OnPrem firewall/NAT Device ---> Internet
  You can you can alert or deny traffic at the second hop(Azure Firewall) itself.

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

---

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.