Azure Firewall Application rule not working

Question

Hi,

I have Azure firewall with premium sku. I have created rule collection group GRP1 (priority 500) contains DNAT rule ( priority 400,410) and network rule ( priority 1000 to 65000). Now I have requirement to allow only 3 urls (not any other URLS) from sets of VM using application rule. Since I used 65000 priority, I can not create application rule in GRP1 and also application rule less preferred over network rules. I have created GRP2 with priority 450 and configured application rule for the traffic. So below are configuration

GRP1 (grp priority 500)- Network Rule priority 3600 - Deny traffic for set of VMs to internet port 80 and 443 since only 3 urls to be allowed

GRP2 ( grp priority 450) - Application rule priority 1000 - Allow 3 urls from sets of VMs IP as source

Since network rules gets preference over application rules, all internet traffic got blocked. and when I allow all traffic in network rule, VMs can access those 3 urls and other internet sites as well.

May I know how to resolve this issue. How to prefer application rule over network rules. How to allow certain sites and block other sites.

Answer 1

Dear sidhrane ,

Thank you for reaching out with your query regarding Azure Firewall configuration. I understand the issue you're facing, and I’ll guide you through resolving it.

The core of the problem lies in the way Azure Firewall prioritizes network rules over application rules. Since your network rule (priority 3600) is blocking all traffic to ports 80 and 443, the application rule in GRP2 is not being evaluated. To address this, you can achieve your goal by using application rules exclusively, as they are better suited for allowing specific URLs while blocking all other traffic.

Here’s how you can resolve the issue:

Remove the Network Rule: Delete the network rule (priority 3600) that blocks traffic to ports 80 and 443. This rule is causing all traffic to be blocked before the application rule is evaluated.

Configure Application Rules in GRP2: In GRP2 (priority 450), create an application rule to allow the 3 specific URLs. Then, add another application rule to explicitly block all other internet traffic. For example:

Application Rule 1 (Allow):

     Priority: 1000
     
           Source: Set of VMs IPs
           
                 Protocol: HTTP/HTTPS
                 
                       Target FQDNs: `example.com`, `example2.com`, `example3.com`
                       
                          **Application Rule 2 (Deny)**:
                          
                                Priority: 2000
                                
                                      Source: Set of VMs IPs
                                      
                                            Protocol: HTTP/HTTPS
                                            
                                                  Target FQDNs: `*` (wildcard to block all other traffic)
                                                  
                                                  **Ensure GRP2 Has Higher Priority**: Since GRP2 has a priority of 450 (higher than GRP1's priority of 500), its rules will be evaluated first. This ensures that the application rules are processed before any network rules in GRP1.
                                                  

By using application rules only, you can explicitly allow the 3 specific URLs and block all other traffic. This approach avoids the issue of network rules taking precedence over application rules. Additionally, the wildcard application rule (*) ensures that all traffic not explicitly allowed by the first rule is blocked.

If you must use network rules for some reason, you can leverage FQDN tags in network rules. However, this approach is less flexible and may not fully meet your requirements. For example, you could create a network rule to allow traffic to the 3 specific URLs using FQDN tags and another network rule to block all other traffic.

In summary, the recommended solution is to use application rules exclusively to allow the 3 URLs and block all other traffic. This ensures that your configuration works as intended without conflicts between network and application rules.

Please let me know if you need further assistance or clarification.

Best regards,

Alex

p.s. If you found the answer helpful, please click on Upvote and Accept Answer. This will help other community members.