Azure 防火墙架构

Question

I have a project where i need to deploy an Azure firewall so there are some questions of better practice that i need to resolve before.

• Is it correct that App Gateway or Api Magament Service be inside a NSG? would this cause any issue?
• App Gateway and Api magment are exposed services. Those services need to be out of AZ FW scope? (asymmetric routing problem)

If

I hope you could help me. Regards.

Answer 1

Is it correct that App Gateway or Api Magament Service be inside a NSG? would this cause any issue?

You can use application gateway or Api management service to be inside Network security groups (NSGs) are supported. For the Application Gateway v1 SKU, you should allow incoming Internet traffic on TCP ports 65503-65534 , and for the v2 SKU, you can allow incoming Internet traffic on TCP ports 65200-65535, with the source subnet set to Gateway Manager and the destination subnet set to Any.

Azure certificates are used to secure these ports . These endpoints are not able to communicate with external parties, including the gateways' users.

The NSG's default outbound policies permit Internet connectivity. I would suggest

• Keep the outbound default rules in place don't remove
• Do not add any further outbound rules that prohibit any outbound connectivity.

Behind the NSG could be API management services. When a user wants to restrict or allow some ports, NSG can raise an action after pulling that specific resources address from the public internet. if you're using large scale of hardware network virtual services firewall can be used.

In another way in your scenario you can remove NSG and deploy application gateway behind the firewall through application gateway then you can distribute the traffic through API management services accordingly.

App Gateway and Api management are exposed services. Those services need to be out of AZ FW scope? (asymmetric routing problem)

Yes, App Gateway and Api management are exposed services. But these services also protected accordingly please check this Protect APIs with Azure Application Gateway and Azure API Management - and also see Azure Firewall