Azure Firewall Premium Features

Azure Firewall Premium is an enhanced version of Azure Firewall Standard, introduced in 2021, that adds advanced security capabilities for inspecting and controlling network traffic. While Standard Firewall provides stateful filtering and basic threat intelligence, Premium goes deeper with TLS inspection (SSL/TLS decryption), Intrusion Detection and Prevention System (IDPS), web categories, and URL filtering. These features are designed to protect against application-layer attacks, malware, and data exfiltration, especially in regulated industries like finance and healthcare.

Standard Firewall operates at Layers 3-4 (network and transport) with some Layer 7 capabilities via application rules. However, it cannot inspect encrypted traffic. With over 90% of internet traffic now encrypted, malicious actors use TLS to hide payloads. Premium solves this by acting as a man-in-the-middle (MITM) proxy that decrypts outbound traffic, inspects it, then re-encrypts it before forwarding. It also provides signature-based and anomaly-based IDPS to detect exploits, and web category filtering to enforce acceptable use policies.

TLS inspection in Azure Firewall Premium uses a per-firewall certificate authority (CA) that you generate or upload. When a client inside the virtual network makes an outbound TLS connection (e.g., to https://example.com), the firewall intercepts the ClientHello. It then establishes a TLS session with the remote server, presenting its own certificate signed by the internal CA. The client sees this certificate and, if the client trusts the internal CA (deployed via Group Policy or MDM), the connection proceeds. The firewall decrypts the traffic, inspects the application payload, applies IDPS signatures, and then re-encrypts it using a separate session with the client. This is transparent to the client but introduces latency (~1-5 ms per connection).

Key constraints:

Azure Firewall Premium includes an IDPS engine that inspects traffic after TLS decryption. It uses two categories:

IDPS operates in two modes:

You configure IDPS rules in the Firewall Policy under the IDPS blade. You can set individual rule severities (low, medium, high) to alert or deny. The default is alert only for all signatures.

Web categories allow you to allow or deny access to entire categories of websites (e.g., Social Networking, Adult Content, News). Azure Firewall Premium uses Microsoft’s curated web category database, which categorizes over 2 million URLs. Categories are maintained by Microsoft and updated regularly.

URL filtering works at the FQDN level within application rules. You can specify FQDNs (e.g., *.contoso.com) and allow or deny. With Premium, you can also combine web categories with FQDNs for granular control.

Important: Web categories only apply to HTTP/HTTPS traffic (ports 80/443). For non-web traffic (e.g., SSH, FTP), you must use network rules.

To deploy Premium Firewall, you must select the Premium tier when creating the firewall (or upgrade an existing Standard firewall via PowerShell/CLI). The upgrade is non-disruptive but incurs additional cost (~2x Standard).

Key configuration steps: 1. Create or select a Firewall Policy (Premium tier). 2. Upload a root CA certificate to the firewall for TLS inspection. 3. Configure IDPS settings (mode, signatures). 4. Define web categories in application rules. 5. Deploy the policy to the firewall.

Verification commands:

Premium Firewall supports up to 100 Gbps throughput (with Premium tier). TLS inspection adds latency and CPU overhead; Microsoft recommends sizing the firewall accordingly. In production, monitor CPU usage; if it exceeds 80%, consider scaling out (multiple firewalls in different availability zones).

A bank with 10,000 employees uses Azure Firewall Premium to inspect all outbound HTTPS traffic. They deploy a root CA via Active Directory Group Policy. The security team configures IDPS to deny high-severity signatures (e.g., SQL injection attempts) and alert on medium. They also block web categories 'PersonalStorage' (e.g., Dropbox, Google Drive) to prevent data leakage. Performance: they use a Premium firewall with 20 Gbps throughput, monitoring CPU at 40% during peak hours. Common issue: employees accessing personal email (e.g., Gmail) get blocked because it falls under 'Webmail' category. The bank creates an exception for executives using a separate rule with higher priority.

A hospital uses Azure Firewall Premium to meet HIPAA requirements for encrypted traffic inspection. They enable TLS inspection but exclude healthcare SaaS applications (e.g., Epic, Cerner) to avoid certificate pinning issues. They configure IDPS to alert on all signatures but deny only those related to malware and ransomware. They use web categories to block 'AdultContent' and 'Illegal' categories. They integrate logs with Azure Sentinel for SIEM. A problem arises when a third-party vendor's application uses certificate pinning; the hospital must add the vendor's FQDN to the TLS inspection exclusion list.

An e-commerce company uses Azure Firewall Premium to protect its web servers from OWASP Top 10 attacks. They deploy the firewall in a hub VNet with forced tunneling. They enable IDPS with deny mode for critical signatures (e.g., SQL injection, XSS) and alert mode for others. They use web categories to block 'Spam' and 'Malware' sites. They also implement URL filtering to allow only specific shopping cart endpoints. A misconfiguration occurs when they accidentally block all HTTPS traffic by setting a deny rule for the 'All' web category; they quickly correct by adding an allow rule for 'Ecommerce' category.