L7. Azure Firewall Premium
Course outlineLesson 7 of 18
Azure Firewall Premium adds IDPS, TLS inspection, and web category filtering to the Standard SKU. Know the exact feature differences, when each mode of IDPS applies, and the Key Vault dependency for TLS inspection.
Standard vs Premium: Feature Comparison
| Feature | Standard | Premium |
|---|---|---|
| FQDN filtering | Yes | Yes |
| Threat intelligence | Alert/Deny | Alert/Deny |
| IDPS (Intrusion Detection & Prevention) | No | Yes |
| TLS Inspection | No | Yes |
| Web Categories | No | Yes |
| URL Filtering | No | Yes |
IDPS: Alert vs Deny Mode
IDPS in Premium SKU inspects traffic against Microsoft's signature database. Two operational modes:
- Alert mode: Logs matching traffic, does not block it. Use during initial deployment to understand baseline.
- Alert and Deny mode: Logs and blocks matching traffic. Use in production.
TLS Inspection
Premium Firewall can decrypt, inspect, and re-encrypt TLS traffic. Requirements:
- An intermediate CA certificate stored in Azure Key Vault
- A managed identity granted access to the Key Vault certificate
- The Firewall Policy configured to reference that Key Vault certificate
Forced Tunneling
To route all internet-bound firewall traffic through an on-premises NVA, configure forced tunneling. Requirements:
- Create a AzureFirewallManagementSubnet subnet: this keeps management traffic out of the forced tunnel
- A route table pointing 0.0.0.0/0 to the on-premises NVA
- ✓Premium adds IDPS, TLS inspection, web categories, and URL filtering: Standard has none of these
- ✓IDPS: Alert mode logs only; Alert and Deny mode blocks. IDPS applies to East-West traffic too
- ✓TLS inspection requires an intermediate CA cert in Key Vault plus a managed identity on the firewall
- ✓Forced tunneling requires AzureFirewallManagementSubnet: without it, management connectivity breaks
- ✓Web categories let you block/allow by content type (Social Media, Gambling) in Premium SKU
1. What is the difference between IDPS 'Alert' mode and 'Alert and Deny' mode in Azure Firewall Premium?
2. Azure Firewall Premium's TLS inspection feature requires which prerequisite?
3. Which Azure Firewall Premium feature allows you to block access to categories of websites (e.g., social media, gambling) without maintaining explicit URL lists?
Recommended: Pluralsight
This free course covers the theory. Pluralsight adds structured video courses, hands-on Azure labs, and timed practice exams to make it stick before exam day.