Azure firewall monitoring only

Question

I'm looking to implement Azure firewall with FQDN restrictions but ideally I'd like to deploy it in some sort of "monitor only" mode that will let me view logs to determine which FQDNs should be allowlisted.

Is that possible?

Thank you

Answer 1

Hello Luke , Welcome to MS Q&A

Azure Firewall with FQDN restrictions in a "monitor-only" mode. However, Azure Firewall does support logging and monitoring capabilities that can help you analyze traffic and determine which FQDNs should be allowlisted.

You can enable diagnostic logging for Azure Firewall to capture detailed information about the traffic passing through it. This includes information about allowed and denied traffic, which can be useful for monitoring purposes. By analyzing these logs, you can identify the FQDNs that need to be allowlisted.

To set up logging:

1. Enable Diagnostic Settings: In the Azure portal, navigate to your Azure Firewall resource and select Diagnostic settings. Here, you can configure the logs to be sent to Azure Monitor logs, Event Hubs, or a Storage Account.
2. Analyze Logs: Use Azure Monitor or any other log analysis tool to review the logs and determine which FQDNs are being accessed. This will help you decide which FQDNs should be allowlisted.

Pls check below image

Kindly accept answer if it helps

Please let us know if any further questions

For more detailed guidance, you may want to refer to the Azure documentation on Azure Firewall logging and monitoring.

Thanks
Deepanshu