Understanding the Differences Between Azure Firewall and the VM-Series

Microsoft recently announced the Azure Firewall (in public preview) as an optional set of extra cost security features that would be deployed in conjunction with Azure Network Security Groups. Key features include:

• A stateful firewall as a service that provides outbound control over traffic based on port, protocol and/or by manually whitelisting the fully qualified domain name, or FQDN (i.e., www.github.com).
• Built-in high availability with unrestricted cloud scalability; fully integrated with Azure Monitor for logging and analytics.
• Price based on each Azure Firewall instance deployed plus bandwidth consumed.

More info can be found here: https://azure.microsoft.com/en-us/services/azure-firewall/

Whereas Network Security Groups are required to enable an Azure VNet, both the VM-Series and Azure Firewall are optional, and as such, customers and partners should understand how they can improve their security posture.

Key VM-Series Differentiators

The VM-Series differs from Azure Firewall by providing customers with a broader, more complete set of security functionality that, when combined with security automation, can help ensure workloads and data on Azure are protected from threats. Specific VM-Series differentiators include:

• Can be deployed to protect traffic flows in all directions, not just outbound – including inbound, outbound, and east-west.
• Bi-directional control over applications (web-based and otherwise) not ports, resulting in a threat footprint reduction for improved security and compliance.
• For allowed traffic, policies can prevent data exfiltration and threats, including vulnerability exploits, known and unknown malware.
• Granular control over web-based developer resources with PAN-DB URL Filtering – blacklist known malicious categories; whitelist specific developer resource URLs and/or categories.
• Automation features such as dynamic address groups, external dynamic lists, and HTTP log forwarding to dynamically drive policy updates and ensure that developer environments are protected at the speed of the cloud.
• Consistent security policies and enforcement across private cloud and public cloud environments.

A more specific comparison can be found in the table below.