Azure DDoS Protection and Firewall

A Distributed Denial of Service (DDoS) attack floods a target — a server, application, or network — with so much traffic that legitimate users cannot access it. Attackers use botnets of thousands of compromised devices to generate volumetric traffic exceeding the target's capacity. DDoS attacks range from simple volumetric floods (UDP amplification) to application-layer attacks (HTTP floods targeting a specific endpoint).

Azure provides two tiers of DDoS protection. DDoS Network Protection (Basic) — previously called DDoS Basic — is built into the Azure platform and automatically protects all Azure public IP addresses at no extra cost. It mitigates common network-layer attacks. DDoS IP Protection and DDoS Network Protection (Standard) add always-on traffic monitoring, adaptive tuning specific to your workload, rapid response teams, and cost protection (credits for Azure resources consumed during an attack).

DDoS Network Protection is applied at the Virtual Network level and covers all public IPs attached to resources in that VNet. Once enabled, it continuously monitors traffic baselines for each protected IP and automatically activates mitigation pipelines when attack patterns are detected — without requiring any configuration from you. SLA guarantees 99.99% availability during a mitigated attack.

With DDoS Network Protection enabled, Azure surfaces DDoS-specific metrics in Azure Monitor, including Under DDoS attack or not, Inbound packets dropped DDoS, and Inbound bytes forwarded to service (legitimate traffic). You can set metric alerts to notify your security team when an attack begins and monitor mitigation effectiveness in real time through the Azure portal dashboards.

Azure Firewall is a managed, cloud-native network security service that provides centralised network traffic inspection and control for your Azure VNets. Unlike Network Security Groups (NSGs), which are simple stateful packet filters at the subnet/NIC level, Azure Firewall is a fully stateful firewall-as-a-service with built-in high availability, unlimited scale, and advanced features including FQDN filtering (allow/deny by domain name) and threat intelligence feeds.

Azure Firewall is available in three SKUs. Standard supports L3-L7 filtering, FQDN-based rules, network and application rules, and threat intelligence. Premium adds TLS inspection (decrypt, inspect, and re-encrypt HTTPS traffic), IDPS (intrusion detection and prevention), and URL filtering for full next-generation firewall capabilities. Basic is a lower-cost option for SMB scenarios with simpler filtering requirements.

The recommended pattern is to deploy Azure Firewall in a dedicated hub VNet and route all traffic from spoke VNets through it using User Defined Routes (UDRs). This hub-and-spoke topology creates a single chokepoint for all east-west (VNet to VNet) and north-south (internet-bound) traffic, making it easy to enforce a consistent security policy and log all network flows through one service.

Azure Firewall processes three types of rules in priority order. NAT rules translate inbound public IPs to private VNet IPs (Destination Network Address Translation). Network rules are layer 3-4 filters based on source IP, destination IP, port, and protocol — allowing or denying raw TCP/UDP traffic. Application rules filter outbound traffic by HTTP/HTTPS URL patterns and FQDNs, enabling granular control of which internet destinations resources can reach.

Azure Firewall integrates with Microsoft Threat Intelligence feeds to automatically alert on or deny traffic to and from known malicious IP addresses and domains. The feed is updated continuously from Microsoft's global threat detection network. In Alert and Deny mode, the firewall blocks any packet to or from a known malicious IP before your custom rules are evaluated, providing automatic protection against known bad actors without manual rule updates.

NSGs and Azure Firewall complement each other and are both needed in a defence-in-depth strategy. NSGs are lightweight, stateful packet filters applied to subnets and NICs — ideal for micro-segmentation within a VNet, allowing only necessary ports between tiers. Azure Firewall provides centralised, application-layer inspection, FQDN filtering, logging, and threat intelligence across all VNets — a capability far beyond what NSG rules can express.

Azure Firewall Policy is an ARM resource that contains all rule collections (NAT, network, application) and settings for one or more firewalls. Azure Firewall Manager provides a central management interface to deploy and govern Firewall Policies across multiple Azure Firewall instances and Virtual WANs at scale. This allows enterprises to define a base corporate policy and inherit it into regional firewall deployments with local overrides.

Test your understanding of Microsoft Azure Fundamentals (AZ-900) concepts from this lesson.

In this lesson you learned: DDoS Network Protection monitors all VNet public IPs and automatically mitigates volumetric attacks, Azure Firewall is a managed stateful firewall with FQDN filtering and threat intelligence integration, and the hub-and-spoke topology centralises all network traffic through a single Azure Firewall instance. Next up we explore how Azure pricing works.