Layered Network Security in Azure with NSGs and Azure Firewall

Teams arriving in Azure from on-premises networking often make one of two mistakes: assuming the platform secures the network for them, or recreating a single perimeter firewall and leaving everything behind it flat. Azure gives you two complementary enforcement layers — Network Security Groups at the subnet and NIC level, and Azure Firewall as a centralized inspection point — and a well-designed environment uses both, in the same spirit as the on-premises segmentation covered elsewhere on this site: default-deny between zones, explicit rules for real traffic.

What each layer does

• NSGs are stateful L3/L4 filters attached to subnets or NICs: source, destination, port, protocol, allow or deny. They are free, evaluated in priority order, and support service tags (Storage, AzureActiveDirectory, Internet) and Application Security Groups so rules reference workload groups instead of IP lists.
• Azure Firewall is a managed, centralized firewall with capabilities NSGs lack: FQDN-based filtering for outbound traffic, network and application rule collections managed as policy, threat-intelligence-based blocking, SNAT/DNAT, and full logging of allowed and denied flows. The Premium SKU adds TLS inspection and IDPS.
• The division of labor: NSGs enforce coarse east-west boundaries cheaply at every subnet; the firewall inspects and controls north-south traffic and the east-west flows that matter most — plus all outbound Internet access.

Hub-spoke design

• Place Azure Firewall in a hub VNet; workloads live in spoke VNets peered to the hub. Spokes do not peer with each other — inter-spoke traffic transits the firewall.
• Traffic does not route through the firewall by magic: attach User Defined Routes to spoke subnets sending 0.0.0.0/0 (and spoke-to-spoke prefixes) to the firewall's private IP. A missing UDR is the most common reason "the firewall isn't seeing traffic."
• Within each spoke, apply NSGs per subnet implementing the local tier model — web subnet reaches app subnet on application ports, app reaches data, nothing reaches management interfaces except from designated sources.
• Manage firewall rules through Azure Firewall Policy (not classic rules) so a base policy applies organization-wide with per-environment child policies layered on top.

Rules that matter most

• Control outbound Internet access with application rules: allow the FQDNs your workloads genuinely need (update endpoints, package repositories, your SaaS dependencies) and deny the rest. Egress control is what turns a compromised VM's C2 channel or data exfiltration into a blocked, logged event.
• Enable threat intelligence in alert-and-deny mode — it blocks connections to known-malicious IPs and domains with zero rule-writing effort.
• Eliminate public IPs on workload VMs entirely: inbound reaches workloads through the firewall (DNAT) or Application Gateway/WAF, admin access goes through Azure Bastion, and outbound goes through the firewall. A VM with its own public IP bypasses the entire design.
• Use NSG flow logs (or the newer VNet flow logs) and Azure Firewall diagnostic logs into Log Analytics — this telemetry is the cloud equivalent of the inter-VLAN deny logging that makes on-premises segmentation auditable.

Common pitfalls

• NSG-only designs with no egress control: east-west looks tidy while every VM can reach any Internet destination on 443.
• Forgetting platform dependencies: AzureKMS activation, DNS, and identity endpoints must be allowed or VMs break in confusing ways — use the documented service tags and FQDN tags rather than broad allows.
• Cost surprises: Azure Firewall is billed per hour plus data processed. For small environments, start with the Basic SKU or an NVA alternative, but keep the same architecture so upgrading is a SKU change, not a redesign.
• Rule sprawl without ownership — the any-any cleanup discipline from the firewall audit item applies identically here from day one.

The result mirrors good on-premises design translated to cloud primitives: workloads isolated by NSG boundaries, all inter-zone and Internet traffic transiting an inspected, logged control point, and no path into or out of the environment that bypasses policy.