This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Hi Folks,
Can anyone here please share some thoughts and comments of when to use Azure WAF or Azure Firewall?
I have already existing Azure ExpressRoute so my Azure VMs can ping my OnPremise servers, and vice versa.
My purpose here is to be able to securely publish Azure Web Application & API that is accessing the database on my OnPremise SQL server.
Thanks in advance.
An Azure network security service that is used to protect Azure Virtual Network resources.
An Azure service that provides protection for web apps.
An Azure service that provides central network security policy and route management for globally distributed, software-defined perimeters.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(92.8, 5%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVD%3C/text%3E%3C/svg%3E)
For your question:
This is definitely a good approach to secure your app service if it is exposed to public internet.
Public Internet Users –connects via the internet--> Application gateway (WAF) –secure and protect --> App Service –gets the data from--> Local OnPremise SQL Database.
Hope this answers!
This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Comments have been turned off. Learn more
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(268.8, 96%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EC%3C/text%3E%3C/svg%3E)
What would be the difference between WAF and firewall IDPS? Would IDPS be enough?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(57.599999999999994, 79%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELB%3C/text%3E%3C/svg%3E)
I think you can have a look at this link:
https://learn.microsoft.com/en-us/azure/architecture/example-scenario/gateway/firewall-application-gateway
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(204.8, 27%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ES%3C/text%3E%3C/svg%3E)
Hi @EnterpriseArchitect i recommend you to follow the Hub and spoke network architecture, where Hub VNet will host all your security solutions such as Azure WAF, and Azure Firewall
Your publish application hosted on Azure App Service will be protected from internet traffic using Azure WAF.
https://learn.microsoft.com/en-us/azure/architecture/example-scenario/apps/fully-managed-secure-apps
Hub and Spoke reference architecture
Azure Firewall is deployed in the Hub VNet to control traffic between the gateway's subnet and the resources in the spoke virtual networks