Difference Between NSG and Firewall

Difference Between NSG and Firewall

Securing your Azure resources is critical. Both Azure Firewall and Network Security Groups (NSG) play vital roles in managing inbound and outbound traffic. This blog post will guide you through their functionalities, helping you choose the best fit for your needs.

• What is Azure Firewall?
• Azure Firewall Standard
• Azure Firewall Premium
• Azure Firewall Basic
• How does Firewall Azure work?
•  What is Azure Network Security Groups (NSG)?
•  How does Azure Network Security Groups work?
•  Difference between Azure Firewall and Azure Network Security Groups
•  Feature Comparison
•  FAQs
•  Conclusion

Azure Firewall

Managed Firewall Service: Azure Firewall is a cloud-based, intelligent firewall that secures your virtual network (VNet) traffic. It automatically detects workloads and protects them from threats.

1. Deep Packet Inspection (DPI): Azure Firewall inspects traffic at Layers 3,4 & 7 of the OSI model, providing granular control over network traffic.
2. Threat Intelligence: It leverages Microsoft’s threat intelligence to identify and block malicious traffic in real-time.
3. Features:
   • Advanced features like SNAT (Source Network Address Translation) and DNAT (Destination Network Address Translation) for managing public IP addresses.
   • Service Tags and FQDN Tags for simplified security rule creation.

Checkout the detailed Blog on Azure Firewall

Azure Firewall Standard

Azure Firewall Standard provides L3-L7 filtering and threat intelligence directly from Microsoft Web Security.
Threat-based filtering can alert and deny traffic to and from known IP addresses and domains, and is updated in real time to prevent attacks.

Azure Firewall Premium

Azure Firewall Premium has advanced features such as signature-based IDPS, which provides rapid detection of attacks by searching for specific patterns. These patterns can include byte segments on network connections or known malicious instructions used by malware. More than 58,000 signatures across 50+ categories are updated in real time to prevent new and emerging vulnerabilities. Valid groups include malware, phishing, coin mining, and Trojan horse attacks.

Azure Firewall Basic

Azure Firewall Basic is similar to Firewall Standard with the following important limitations:

Threat only supports Intel Alert Mode
Fixed scaling units backend instance for running programs on two virtual machines
Recommended to estimate competition of about 250Mbps

How does Firewall Azure Work?

Azure firewall offers enough features to provide optimized control over the in and out network traffic. It eliminates the need for Load Balancer configuration because of its high availability. Microsoft Azure ensures 99.99% availability of its resources due to its availability zone feature. It does not charge anything extra for scalability. You pay only for what you use.

Moreover, it also allows restriction on outbound traffic by specifying the FQDN service. You can create your own defined rules using Azure Firewall to filter networks based on source IP, destination IP, port, and protocol. These rules further show the status as Allow or Deny status. It also enables threat intelligence features that can identify malicious IP addresses and irrelevant traffic.

Read Microsoft Defender for Cloud [AZ-500]: Everything You Should Know

Azure Network Security Groups (NSG)

• Basic Firewall for Traffic Filtering: NSG is a stateful firewall that filters traffic entering or leaving your VNet based on pre-defined rules.
• Layer 3 & 4 Security: NSG operates at Layers 3 (network) and 4 (transport) of the OSI model, offering basic traffic filtering.
• Granular Control: You can define rules to allow or deny traffic based on source/destination IP addresses, ports, and protocols.

Check out: Azure Networking

How does Azure Network Security Groups work?

Azure Network Security Group (NSG) is a great solution offered by Microsoft to protect virtual networks. Using this, administrators can comfortably organize, filter, direct, and limit various network traffic flows. You can set different inbound and outbound rules to allow or deny a specific type of traffic to configure Azure Network Security Group. If you want to use Azure Network Security Groups, you need to create and configure individual rules.

You can define any rules required as per the situation, such as to define whether the traffic flowing through the network is safe and needs to be permitted or not.

Also Check: Top 10 Best Practices for Azure Security

Difference Between Azure Firewall and Network Security Group

Feature	Azure Firewall	Network Security Groups (NSG)
Service Type	Managed Firewall Service	Stateful Firewall
Security Level	Advanced (L3, L4, L7)	Basic (L3, L4)
Threat Intelligence	Yes	No
SNAT/DNAT	Yes	No
Application Security	Yes (L7 inspection)	No

Check out: AZ-500 Exam – Microsoft Azure Security Technologies Certification

Azure Firewall and NSG in Conjunction

Both Azure Firewall and NSG provide security, but combining them increases your defences. NSGs provide you granular control over your VNet, such as allowing RDP access to a certain subnet only from authorised internal machines. Azure Firewall serves as a centralised gateway, monitoring all incoming and outgoing traffic while providing enhanced threat prevention. Together, they provide multilayer security, including granular internal control and a strong exterior security barrier.

Azure Firewall vs. NSG: Your Choice Depends on Your Use Case

Azure Firewall vs. NSG: Your Choice Depends on Your Use Case

 Network security and control of traffic flow in and out of resources within Azure are imperative to manage organizations’ overall cloud security architecture. Azure Firewall and Network Security Groups (NSGs) are the Microsoft solutions for Azure network security. Azure Firewall is an intelligent firewall service that provides threat protection for workloads running in Azure. In contrast, an NSG filters network traffic among Azure resources in a Virtual Network (VNet). Together, they provide superior “defense-in-depth” network security.

This article defines and describes Azure Firewall and NSGs, describes the differences between them, and recommends deployment best practices for the two solutions.

Executive summary

The table below outlines the key concepts this article covers to help readers understand.

Term	Description
5-Tuple Hash	NSGs filter inbound and outbound traffic based on a hash of these five fields: Source IP, Source Port, Destination IP, Destination Port, and Protocol.
Application Security Group (ASG)	ASGs protect sets of VMs with common functions by grouping them and defining the required security rules. For example, it is possible to group all web servers into an ASG, specify the appropriate security rules, and use the ASG as a source or destination on NSGs. As a result, NSG’s security rules will apply to all ASG members.
Destination Network Address Translation (DNAT)	DNAT is an Azure firewall feature to translate traffic coming into the firewall’s public IP to the private IP addresses of the VNet. The traffic appears to internal resources as if it originated from Azure Firewall’s private IP address.
Fully Qualified Domain Names (FQDN) Tags	An FQDN tag represents a group of fully qualified domain names of Microsoft services. Microsoft manages the FQDNs encompassed by the FQDN tag and updates the tag as FQDNs change. You can use FQDN tags in application rules to allow outbound traffic into the network through Azure Firewall. Examples: Windows Update, Azure Backup, Azure Kubernetes Service (AKS), WindowsDiagnostics.
Intrusion Detection and Prevention System (IDPS)	IDPS provides the ability to monitor network traffic for malicious activities and log and block traffic.
Open Systems Interconnection (OSI) Model	The OSI model is the standard seven-layer model used to define the interaction of protocols that computers use to communicate in a network.
Rule Collection	This is a set of Azure Firewall rules that share the same order and priority.
Service Tags	A service tag represents a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, minimizing the complexity of frequent updates to network security rules. You can use service tags on Azure Firewall, NSGs, and UDRs. Examples: APiManagement, Storage, AzureCloud, Internet.
Source Network Address Translation (SNAT)	SNAT is an Azure Firewall feature to mask source IP addresses (e.g., virtual machine IP addresses) that are sending traffic. The traffic appears to destinations as if it originated from Azure Firewall’s public IP address. SNAT also allows multiple computers to access the Internet from a single public IP.
Threat intelligence	This feature provides the ability to alert and deny traffic from/to known malicious IPs and domains.
TLS inspection	TLS inspection allows decryption and encryption of data for inspection and processing.
URL filtering	This feature is an extension to Azure Firewall’s FQDN filtering that allows filtering of the entire URL.
Web categories	This feature provides the ability to block website categories such as gambling, social media, etc.

Azure Firewall

Azure Firewall is a scalable, intelligent firewall service in Azure that provides east-west and north-south traffic inspection, filtering, and monitoring. Azure Firewall inspects traffic on Layers 3 to 7 and can alert and deny traffic in real time from/to known malicious IP addresses and domains.

Azure Firewall topology and functionality (source)

Azure Firewall supports DNAT, application, and network rules. DNAT rules translate and filter inbound Internet traffic to Azure subnets. Application rules work with fully qualified domain names (FQDNs), and network rules filter traffic based on the Source Address, Protocol, Destination Port, and Destination Address fields. In addition, Azure Firewall supports TLS inspection, IDPS, URL filtering, and web categories. 

Destination Network Address Translation (DNAT)

DNAT rules help organizations translate and filter inbound Internet traffic to internal resources. The rules translate the firewall’s public IP address and port to a private IP address and port.

The screenshots below depict a DNAT rule named “MyWebSite” that allows TCP traffic to the firewall’s public IP address on port 80 from “Any” source to access the internal web server (10.12.67.24) on port 80. 

DNAT rule to allow inbound traffic to the internal web site

Application rules

Application rules allow or deny outbound access to specific FQDNs. Azure Firewall rejects all traffic until rules are manually configured to allow traffic. In other words, browsing www.microsoft.com is denied by default. Similarly, the firewall blocks access to Windows Update and Azure Cloud if not explicitly allowed. 

The figure below depicts two application rules to allow HTTP and HTTPS access to all microsoft.com websites. 

Application rule to allow outbound traffic to Microsoft web sites

Network rules

Network rules allow or deny access to specific IP addresses. Network rules can use FQDNs based on DNS resolution in Azure Firewall and firewall policies. These FQDNs are then translated to corresponding IP addresses based on the selected DNS server’s resolution.

The figure below depicts a network rule to allow DNS queries to Google’s DNS server 8.8.8.8 on UDP port 53.

Network rule to allow outbound traffic to Google’s DNS server

Rule processing logic

In Azure Firewall, there are three rule collection types: DNAT, network, and application. Rules in a rule collection must be of the same type. You can have zero or more rules in a rule collection and have multiple rule collection types within a single rule group.

Azure Firewall processes DNAT rules first, followed by network and application rules, regardless of rule collection group or priority and policy inheritance. 

Azure Firewall’s rule processing order

Within each rule type, rules are processed based on rule collection group priority and rule collection priority. Each rule collection group and rule collection must have a number between 100 and 65,000; the lower the number, the higher the priority. The highest priority rule collection groups are processed first, and the rule collections within a rule collection group with the highest priority are processed first.

Example Azure Firewall policy rules (source)

Azure Firewall will process the example rules above in the following order:

1. DNATRC1
2. DNATRC3
3. ChDNATRC3
4. NetworkRC1
5. NetworkRC2
6. ChNetRC1
7. ChNetRC2
8. AppRC2
9. ChAppRC1
10.  ChAppRC2

Azure Firewall’s rule processing logic is complex and considers other factors. For example, threat intelligence and IDPS rules take precedence if enabled and configured on the firewall. Please read Rule processing using Firewall Policy on Microsoft docs for more in-depth logic information and detailed explanations. 

Azure Firewall SKUs

Azure Firewall is offered in two SKUs: 

• Azure Firewall Standard supports DNAT, application and network filtering rules, FQDN and service tags, and threat intelligence. It scales up to 30 Gbps and integrates with availability zones to support a service level agreement (SLA) of 99.99%.
• Azure Firewall Premium includes all standard features and supports TLS inspection, IDPS, URL filtering, and web categories. Support for IDPS signatures and rulesets includes more than 58,000 signatures in over 50 categories, making Azure Firewall Premium suitable for highly sensitive and regulated environments such as the payment and healthcare industries.

Azure Firewall Premium features (Source)

Compared to Next-Generation Firewalls (NGFW) such as Cisco Firepower and Juniper SRX, Azure Firewall is easy to set up and manage, scales on-demand, and provides advanced threat protection. However, Azure Firewall lacks enterprise reporting, logging, and monitoring features compared to NGFWs.            

Network Security Groups

An NSG is a group of security rules that filter inbound and outbound traffic to and from Azure resources based on a 5-tuple hash. Allow or deny decisions are processed in priority order based on these fields: Source, Source Port, Destination, Destination Port, and Protocol. These decisions apply to the traffic flow in and out of VNet subnets and network interface cards (NICs).

Figure 8: Network Security Group deployment (Source)

Source, Destination, and Protocol Fields

A source can be Any, IP Addresses, My IP address, Service Tag, or Application security group. A destination can be Any, IP Addresses, Service Tag, or Application security group. The supported protocols are Any, TCP, UDP, and ICMP. 

NSG’s Source, Destination, and Protocols

Service tags and application security groups (ASGs) streamline source and destination addresses. Service tags are Microsoft-managed IP prefixes for common Azure services such as LogicApps, SQL, and ServiceBus. ASGs, on the other hand, are user-managed internal IP addresses for common functions such as web and SQL servers.

Rule processing logic

Security rules in NSGs are processed based on priority order. Each rule must have a number between 100 and 4,096; the lower the number, the higher the priority. To demonstrate, let’s look at the three security rules below. The first allows RDP traffic from a specific IP address (10.67.12.4), the second denies RDP from “Any” source, and the third allows all traffic from “Any” source on the internal virtual network. When the network receives an RDP request, the rules will be processed in the order of priority. If RDP traffic comes from 10.67.12.4, it will be allowed, since that’s the highest priority rule. RDP traffic will be rejected if it comes from all other sources, per the RDP_Deny rule.

Note that RDP traffic processing will stop once a match is found. As a result, no RDP traffic request will be processed beyond the second security rule (since it specifies “Any/Any” and will match anything).

NSG rules are processed in priority order

Default security rules

An NSG includes default security rules to allow specific inbound and outbound traffic into the network. For example, inbound traffic to all subnets in a virtual network may be allowed as well as Internet outbound traffic. A default “DenyAllInbound” rule is placed at the end of the inbound rules with a priority of 65,000. 

The default security rules can’t be changed or removed, but they can be overridden by creating rules with higher priority. 

The table below lists all default NSG inbound and outbound rules.

Direction	Security Rule	Priority	Description
Inbound	AllowVnetInBound	65000	Allows inbound traffic from the Vnet.
	AllowAzureLoadBalancerInBound	65001	Allows traffic from Azure Load Balancer Health Probe. Traffic is always generated from IP address 168.63.129.16
	DenyAllInbound	65500	Denies traffic from any other system outside the Vnet.
Outbound	AllowVnetOutBound	65000	Allows outbound traffic to the Vnet.
	AllowInternetOutBound	65001	Allows outbound traffic to the Internet.
	DenyAllOutBound	65500	Denies traffic to any other system outside the Vnet.

NSG default security rules

State

NSGs are stateful, implying that if an inbound request passes, the outbound request will also pass. For example, if you specify an outbound security rule to any address on port 80, it’s not necessary to specify an inbound security rule for the response to the outbound traffic. You only need to set an inbound security rule if communication is initiated externally. The opposite is also true: Defining an outbound security rule is superfluous if inbound traffic is allowed over a port.

Comparison Tables

NSGs are basic firewall services that filter traffic at Layers 3 and 4 of the OSI model. Azure Firewall, in comparison, is a managed firewall service that filters and analyzes traffic at Layers 3, 4, and 7 of the OSI model. The tables below lay out many areas of comparison for the two solutions.

Area of Comparison	Azure Firewall	NSG
Use Case	Protection at the network and application level across different subscriptions and virtual networks.	A packet filtering firewall to limit traffic to resources within virtual networks in each subscription.
Deployment	Azure Firewall must be deployed in a dedicated subnet named “AzureFirewallSubnet” in a VNet. In addition, a /26 address space is required to ensure scalability.	NSGs are created outside VNets but must be associated with subnets and/or NICs to take effect on the network.
Pricing	Standard SKU: $1.25 per deployment hour Premium SKU: $1.75 per deployment hour Data processing: $0.016 per GB processed	Free
OSI Layers	3 (Network) 4 (Transport) 7 (Application)	3 (Network) 4 (Transport)
State	Stateful
Protocol-based filtering
Rule processing logic	Complex	Simple

Azure Firewall and NSG comparison

Supported Features	Azure Firewall	NSG
Azure Monitor logging
ASGs
Forced tunneling
FQDN tags
IDPS
Inbound DNAT
Outbound SNAT
Service tags
Threat intelligence
TLS inspection
URL filtering
Web categories

Comparison of Azure Firewall and NSG features

Deployment Scenarios

Organizations can use Azure Firewall, NSGs, or both, depending on the types and sizes of workloads they run in Azure, required functionality, and cost implications to secure and control inbound and outbound traffic flow among Azure resources. 

For example, securing traffic flow in a three-tier architecture requires three NSGs associated with the web, business, and data subnets, as shown in the figure below. 

NSGs secure traffic flow in a three-tier architecture (source)

In the example above, you would allow inbound HTTP traffic from the Internet to the web tier, inbound traffic from the web tier to the business tier on specific ports, and inbound TCP 1433 traffic from the business to the data tier. Inbound RDP is only allowed on the management subnet. All VMs in the diagram accept RDP TCP 3389 from the jump box. 

Suppose the deployment above was for a large company that requires TLS inspection, IDPS, and DNAT. In that case, Azure Firewall would complement the solution and provide the needed features, augmenting the deployment with additional security. The figure below depicts this deployment example.