What is our primary use case?
We use it to protect the Azure space and to be the bridge between on-premise and the cloud.
When I have had a site-to-site VPN set up and configured, and would use it to allow ordinary traffic from the on-premise device to the cloud and from other third-party suppliers to the Azure platform.
We also use it to provide connectivity to various network security groups that have been created within Azure.
How has it helped my organization?
I would say that this solution is really good compared to other solutions that we have had before. We would have used the FortiGate firewall in the Azure space.
We find this process was quicker. It would get a faster turnaround time once we would generate and modify the firewall rules. Because of the visibility, we would have seen it. When compared to FortiGate, it would get a bit more visibility in terms of integration with the security center so that we would be able to review based on overall posture, see what needs to be fixed, or what changes need to be made.
The turnaround time turns off rules and any gaps that exist would increase the turnaround time for that as well. It would also help us to increase our response time and reduce our attack surface by 20% so far.
What is most valuable?
With the recent upgrade to the premium version, it facilitates IP Groups, URL filtering, TLS inspection, IDPs, and the Web Categories.
Before using the premium version, a lot of our customers had concerns with the URL filter, where you would not be able to allow or block a specific URL. The feature set without a premium version would only allow you to do it via IP address, which is tedious.
At times, many of these vendors would be using some kind of CDN solution. It would be the case where multiple IPs appear, changing behind the URL when it would be easier if you're using the URL feature. The URL maps onto the IP address and it would be the easiest way to do that.
I think that one of the best features is definitely the premium version, along with the IDPs in terms of the intrusion detection and prevention system.
Many other vendors, when you do not have the license for the IP at some point, then you would be left not being able to do any prevention. The fact that the premium version includes this is good.
The TLS inspection allows you to decrypt the outbound traffic and encrypt data. Otherwise, we would have been using our third-party vendors, and whatever solution is within Azure.
With the various business units, we will be reaching out to other solutions there are in the web category to reduce the attack surface to see if this is a category that is alone or not.
The fact that Azure also ties into a security center is another good feature. You can also get rid of that visibility because of the tight integration with these Azure products.
What needs improvement?
We had an instance where it wasn't processing the rules and we had to engage Microsoft to resolve that issue. Microsoft Support needs to improve its response time.
For larger enterprises, they need to adjust the scalability. This is the only issue that I'm have found that it attributed to the two weeks of downtime we had experienced.
They need to offer either a scaled-up or scaled-out version or versions for larger enterprise companies.
This would greatly improve the solution.
Buyer's Guide
Azure Firewall
May 2023
Learn what your peers think about Azure Firewall. Get advice and tips from experienced pros sharing their opinions. Updated: May 2023.
706,951 professionals have used our research since 2012.
For how long have I used the solution?
I have been using Azure Firewall for approximately two and a half years.
I have recently upgraded to the premium version.
What do I think about the stability of the solution?
Azure Firewall is pretty stable.
I believe that they listen to various sponsors, which is why they were able to release the premium version. It is a more established firewall that vendors now have.
I'm seeing where they have met up with the dynamics of the market, and I am expecting that they will be a leader sometime in the near future.
What do I think about the scalability of the solution?
They need to find a way to scale it out or scale it up a bit more. The scalability, it's okay, but it needs a lot more improvement. For a regular customer that's utilizing it, that's good, but for large enterprise companies, it is not as good.
The industry is telecoms. We have millions of customers. For that type of environment, they need better and more scalability.
We haven't totally assessed the premium version to see if the new features offer greater scalability.
We utilize it across the cloud estate. We plan to expand our subscriptions. Most definitely, we will increase our usage.
Recently, we transitioned to the premium version, which will be extended to the other subscription once it has been rolled out across 32 countries, and with more instances, it will be rolled out across various continents.
How are customer service and support?
The turnaround time in resolving the issue where it wasn't processing the rules is an area that needs improvement. It wasn't resolved in a timely manner.
Microsoft support took a bit of time to assist us in resolving that issue. It created a bit of downtime for us and it was longer than we expected.
I would say those would be the cons so far when utilizing it.
I would rate the Microsoft support a five out of ten because they did not respond in a timely manner and the impact it caused in terms of the downtime it created for us. We were down for a week or two during a high-impact period.
They were assisting us but it took a good amount of time to get it resolved when we needed to be putting out things daily. Two weeks is a long time for a fast-paced environment.
Which solution did I use previously and why did I switch?
Previously, we were using FortiGate Firewall. We switched because of the migrating of the Security Center and the ease of use. The cost was also considered.
How was the initial setup?
The initial setup was straightforward.
We had another tool which was FortiGate. We migrated from FortiGate to the Azure Firewall.
It was a straightforward migration.
The deployment took approximately three to four weeks.
The implementation strategy would include copying over rules, ensuring that all the services are able to run, and also ensuring that both firewalls were running in parallel. Until we are sure that the Azure Firewall can handle the workload, both firewall products will continue to operate.
After that, we were able to power down the virtual appliance that was on the FortiGate Firewall.
We had it running for quite some time, approximately a month and a half. Because there were no issues, we stopped using the FortiGate Firewall altogether, once that process was complete.
We have a server team, a cloud team, and a network team to administer and maintain this solution. It's approximately eight to ten people, some are network security engineers, a network security manager, and network engineers.
What was our ROI?
There have been some cost benefits as well. When using another vendor in comparison where you bring your own license, the cost would have gone down. It's more cost-effective to use the Azure Firewall along with the premium version than using a third-party as an option from the marketplace. I would say that as well, where it gives you better spend in terms of OPEX. It's better value for your money.
What's my experience with pricing, setup cost, and licensing?
The licensing module is good. Pricing is one of the reasons we switched to this solution.
For smaller businesses, they could probably put one or two features from premium into the regular standard versions. For example, that URL filtering is a pain point for many customers.
If they could find a way to scale down that URL and the IPs feature to include it in the standard version, then that would allow them to get more traction and more customers from the small to medium-sized business perspective.
Which other solutions did I evaluate?
We were using Check Point mostly. We had decided to move to FortiGate, and then we moved to Azure Firewall.
We did not go with Check Point because of the premium features such as the URL filtering, and the TLS inspection included with Check Point cost a lot more. This was the reason we chose the Azure Firewall.
What other advice do I have?
It's a solid solution. I would tell anybody to definitely give it a try, and consider it as one of the options when looking for a firewall to use in Azure space.
I would say if they can go for the premium version upfront, rather than starting with the standard version, then trying to transition to a premium version. It addresses a lot of the issues and concerns in this space today. They should start with the premium rather than upgrade. Once they can afford it, go straight to premium.
I would rate Azure Firewall an eight out of ten.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Microsoft Azure
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner