Azure Firewall Skill

This skill provides expert guidance for Azure Firewall. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.

How to Use This Skill

IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g., L35-L120), use read_file with the specified lines. For categories with file links (e.g., [security.md](security.md)), use read_file on the linked reference file

IMPORTANT for Agent: If metadata.generated_at is more than 3 months old, suggest the user pull the latest version from the repository. If mcp_microsoftdocs tools are not available, suggest the user install it: Installation Guide

This skill requires network access to fetch documentation content:

Preferred: Use mcp_microsoftdocs:microsoft_docs_fetch with query string from=learn-agent-skill. Returns Markdown.
Fallback: Use fetch_webpage with query string from=learn-agent-skill&accept=text/markdown. Returns Markdown.

Category Index

Category	Lines	Description
Troubleshooting	L37-L42	Diagnosing Azure Firewall issues using known limitations, packet captures, and Sentinel log analysis for malware detection and traffic investigation.
Best Practices	L43-L48	Guidance on Azure Firewall DNS proxy behavior/caching and techniques to tune rules, throughput, and configuration for better performance and lower latency.
Decision Making	L49-L56	Guidance on choosing the right Azure Firewall SKU by features and performance, plus step-by-step deployment of Azure Firewall Basic using the portal and policy.
Architecture & Design Patterns	L57-L67	Design patterns for Azure Firewall deployment: hub-spoke routing, forced tunneling, SLB integration, management NIC use, AVD/M365 protection, and DNAT for overlapping private networks.
Limits & Quotas	L68-L79	Configuring Azure Firewall scale limits: multiple public IPs, SNAT port scaling with NAT Gateway/V2, prescaling capacity ranges, and TCP session idle timeout settings.
Security	L80-L93	Configuring Azure Firewall security: TLS inspection and CA certs, threat intelligence, roles/access, DNAT and hybrid protection, AKS protection, and best-practice secure deployments.
Configuration	L94-L116	Configuring Azure Firewall behavior: rules, IP groups, DNS/DNAT/SNAT, HTTP headers, FTP/SQL/FQDN tags, zones, maintenance windows, and monitoring/logging via PowerShell, Bicep, ARM, Terraform.
Integrations & Coding Patterns	L117-L121	Configuring Azure Firewall to securely access Azure Storage via SFTP, including required rules, network paths, and integration patterns for SFTP traffic.
Deployment	L122-L131	Guides for deploying Azure Firewall (Standard/Premium, dual stack), automating via Bicep/ARM/Terraform, changing SKUs, and integrating with Azure DDoS Protection.

Troubleshooting

Topic	URL
Detect and investigate malware using Sentinel with Azure Firewall logs	https://learn.microsoft.com/en-us/azure/firewall/detect-malware-with-sentinel
Troubleshoot Azure Firewall using packet capture	https://learn.microsoft.com/en-us/azure/firewall/packet-capture

Best Practices

Topic	URL
Understand Azure Firewall DNS proxy behavior and caching	https://learn.microsoft.com/en-us/azure/firewall/dns-details
Optimize Azure Firewall performance and latency	https://learn.microsoft.com/en-us/azure/firewall/firewall-best-practices

Decision Making

Topic	URL
Select the appropriate Azure Firewall SKU	https://learn.microsoft.com/en-us/azure/firewall/choose-firewall-sku
Deploy Azure Firewall Basic with portal and policy	https://learn.microsoft.com/en-us/azure/firewall/deploy-firewall-basic-portal-policy
Choose the right Azure Firewall SKU by features	https://learn.microsoft.com/en-us/azure/firewall/features-by-sku
Choose Azure Firewall SKU based on performance benchmarks	https://learn.microsoft.com/en-us/azure/firewall/firewall-performance

Architecture & Design Patterns

Topic	URL
Design multi-hub and spoke routing with Azure Firewall	https://learn.microsoft.com/en-us/azure/firewall/firewall-multi-hub-spoke
Design Azure Firewall forced tunneling architectures	https://learn.microsoft.com/en-us/azure/firewall/forced-tunneling
Design Azure Firewall with Standard Load Balancer	https://learn.microsoft.com/en-us/azure/firewall/integrate-lb
Use Azure Firewall Management NIC for control traffic	https://learn.microsoft.com/en-us/azure/firewall/management-nic
Architect Azure Firewall protection for Azure Virtual Desktop	https://learn.microsoft.com/en-us/azure/firewall/protect-azure-virtual-desktop
Design Azure Firewall protection for Microsoft 365 traffic	https://learn.microsoft.com/en-us/azure/firewall/protect-office-365
Use private IP DNAT for overlapped Azure networks	https://learn.microsoft.com/en-us/azure/firewall/tutorial-private-ip-dnat

Limits & Quotas

Topic	URL
Deploy Azure Firewall with multiple public IPs	https://learn.microsoft.com/en-us/azure/firewall/deploy-multi-public-ip-powershell
Scale Azure Firewall SNAT ports with NAT Gateway	https://learn.microsoft.com/en-us/azure/firewall/integrate-with-nat-gateway
Integrate Azure Firewall with NAT Gateway V2 for SNAT scaling	https://learn.microsoft.com/en-us/azure/firewall/integrate-with-nat-gateway-v2
Configure Azure Firewall prescaling capacity ranges	https://learn.microsoft.com/en-us/azure/firewall/prescaling
Create Azure Firewall with multiple public IPs using Bicep	https://learn.microsoft.com/en-us/azure/firewall/quick-create-multiple-ip-bicep
Create Azure Firewall with multiple public IPs via ARM template	https://learn.microsoft.com/en-us/azure/firewall/quick-create-multiple-ip-template
Create Azure Firewall with multiple public IPs using Terraform	https://learn.microsoft.com/en-us/azure/firewall/quick-create-multiple-ip-terraform
Configure Azure Firewall TCP session idle timeouts	https://learn.microsoft.com/en-us/azure/firewall/tcp-session-behavior

Security

Topic	URL
Configure TLS inspection certificates for Firewall Premium	https://learn.microsoft.com/en-us/azure/firewall/premium-certificates
Configure Enterprise CA certificates for Firewall Premium TLS	https://learn.microsoft.com/en-us/azure/firewall/premium-deploy-certificates-enterprise-ca
Implement Azure Firewall Premium security features	https://learn.microsoft.com/en-us/azure/firewall/premium-features
Protect AKS clusters using Azure Firewall	https://learn.microsoft.com/en-us/azure/firewall/protect-azure-kubernetes-service
Azure Firewall roles, permissions, and required access	https://learn.microsoft.com/en-us/azure/firewall/roles-permissions
Apply security best practices to Azure Firewall deployments	https://learn.microsoft.com/en-us/azure/firewall/secure-firewall
Configure Azure Firewall threat intelligence filtering	https://learn.microsoft.com/en-us/azure/firewall/threat-intel
Deploy and configure Azure Firewall in portal	https://learn.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal
Configure Azure Firewall DNAT for inbound filtering	https://learn.microsoft.com/en-us/azure/firewall/tutorial-firewall-dnat
Configure Azure Firewall for hybrid network security	https://learn.microsoft.com/en-us/azure/firewall/tutorial-hybrid-portal

Configuration

Topic	URL
Configure HTTP header insertion in Azure Firewall	https://learn.microsoft.com/en-us/azure/firewall/configure-http-header-insertion
Create and manage Azure Firewall IP Groups	https://learn.microsoft.com/en-us/azure/firewall/create-ip-group
Set customer-controlled maintenance windows for Azure Firewall	https://learn.microsoft.com/en-us/azure/firewall/customer-controlled-maintenance
Configure Azure Firewall availability zones with Bicep	https://learn.microsoft.com/en-us/azure/firewall/deploy-bicep
Bulk manage Azure Firewall rules with PowerShell	https://learn.microsoft.com/en-us/azure/firewall/deploy-rules-powershell
Configure Azure Firewall availability zones via ARM template	https://learn.microsoft.com/en-us/azure/firewall/deploy-template
Configure Azure Firewall availability zones with Terraform	https://learn.microsoft.com/en-us/azure/firewall/deploy-terraform
Configure DNS servers and DNS proxy for Azure Firewall	https://learn.microsoft.com/en-us/azure/firewall/dns-settings
Use Azure Firewall Policy Draft and Deployment	https://learn.microsoft.com/en-us/azure/firewall/draft-deploy
Analyze Azure Firewall data using workbooks	https://learn.microsoft.com/en-us/azure/firewall/firewall-workbook
Use Azure Firewall FQDN tags in application rules	https://learn.microsoft.com/en-us/azure/firewall/fqdn-tags
Configure FTP modes and security on Azure Firewall	https://learn.microsoft.com/en-us/azure/firewall/ftp-support
Configure IP Groups for Azure Firewall rules	https://learn.microsoft.com/en-us/azure/firewall/ip-groups
Configure and analyze Azure Firewall monitoring logs	https://learn.microsoft.com/en-us/azure/firewall/monitor-firewall
Reference Azure Firewall monitoring logs and metrics	https://learn.microsoft.com/en-us/azure/firewall/monitor-firewall-reference
Track Azure Firewall rule changes with Resource Graph	https://learn.microsoft.com/en-us/azure/firewall/rule-set-change-tracking
Configure SNAT private IP ranges in Azure Firewall	https://learn.microsoft.com/en-us/azure/firewall/snat-private-range
Configure Azure Firewall application rules with SQL FQDNs	https://learn.microsoft.com/en-us/azure/firewall/sql-fqdn-filtering
Configure Azure Firewall DNAT policy for inbound traffic	https://learn.microsoft.com/en-us/azure/firewall/tutorial-firewall-dnat-policy

Integrations & Coding Patterns

Topic	URL
Access Azure Storage via SFTP through Azure Firewall	https://learn.microsoft.com/en-us/azure/firewall/firewall-sftp

Deployment

Topic	URL
Change Azure Firewall Standard and Premium SKUs	https://learn.microsoft.com/en-us/azure/firewall/change-sku
Deploy and upgrade Azure Firewall dual stack mode	https://learn.microsoft.com/en-us/azure/firewall/deploy-dual-stack-firewall
Deploy and configure Azure Firewall Premium environments	https://learn.microsoft.com/en-us/azure/firewall/premium-deploy
Deploy Azure Firewall and IP Groups using Bicep	https://learn.microsoft.com/en-us/azure/firewall/quick-create-ipgroup-bicep
Deploy Azure Firewall and IP Groups via ARM template	https://learn.microsoft.com/en-us/azure/firewall/quick-create-ipgroup-template
Deploy Azure Firewall and IP Groups using Terraform	https://learn.microsoft.com/en-us/azure/firewall/quick-create-ipgroup-terraform
Deploy Azure Firewall with Azure DDoS Protection	https://learn.microsoft.com/en-us/azure/firewall/tutorial-protect-firewall-ddos