Azure Firewall vs NSG: Which One Should You Use?

Network Security Groups (NSGs) provide basic L3/L4 stateful filtering for individual subnets or NICs, while Azure Firewall is a managed, cloud-native L7 security service. Use NSGs for distributed micro-segmentation and Azure Firewall for centralized, high-scale traffic filtering using FQDNs across multiple virtual networks in a hub-and-spoke architecture.

What exactly is a Network Security Group (NSG)?

Think of a Network Security Group (NSG) as your first line of defense at the subnet or network interface level. In technical terms, NSGs operate at Layer 3 and Layer 4 of the OSI model. They use a '5-tuple' rule set—source, source port, destination, destination port, and protocol—to allow or deny traffic. Because they are stateful, if you allow an inbound request on port 80, the NSG automatically remembers that connection and allows the outbound response without needing a separate rule.

In a real-world scenario, you'll use NSGs for micro-segmentation. For example, if you have a three-tier app, you can create an NSG that only allows traffic from the Web tier to the App tier, blocking everything else. It's a distributed model, meaning each subnet has its own set of rules. While powerful, managing 50 different NSGs across a large environment can quickly become a configuration nightmare, which is where a more centralized approach becomes necessary.

How does Azure Firewall differ from an NSG?

While NSGs are great for basic 'keep out' rules, Azure Firewall is a heavy hitter. The biggest differentiator is that Azure Firewall operates up to Layer 7 (the Application layer). This means it doesn't just look at IP addresses and ports; it can actually see the Fully Qualified Domain Name (FQDN). Instead of trying to track the shifting IP addresses of a third-party API, you can simply create a rule that allows traffic to 'api.microsoft.com'.

Azure Firewall is a managed Platform-as-a-Service (PaaS) offering, which means Microsoft handles the scaling and maintenance. It provides a centralized point of control for your entire cloud estate. If you need to block a specific malicious URL across ten different virtual networks, you do it once in the Azure Firewall policy rather than updating ten separate NSGs. For the AZ-900 exam, remember: NSGs are for distributed, basic filtering; Azure Firewall is for centralized, advanced filtering.

When should you choose centralized management over distributed rules?

As your Azure environment grows, the 'distributed' nature of NSGs becomes a liability. If you have a dozen different teams deploying their own VNets, ensuring every single NSG follows corporate security policy is nearly impossible. This is where centralized management via Azure Firewall saves your sanity. By funneling all traffic through a single security appliance, you gain a 'single pane of glass' view of your network traffic.

Centralization allows you to implement global security policies that override local settings. You can mandate that all outbound traffic to the internet must pass through the firewall for inspection. This reduces the risk of a developer accidentally opening port 22 (SSH) to the entire internet on a random subnet. When you're studying for your certification, think of the trade-off: NSGs offer granular, low-cost control, while Azure Firewall offers scalable, high-visibility governance.

How do you implement a Hub-and-Spoke security architecture?

The Hub-and-Spoke model is the gold standard for enterprise Azure networking. In this setup, the 'Hub' VNet acts as the central connectivity point and houses your Azure Firewall. The 'Spokes' are your individual application VNets. To make this work, you use VNet Peering to connect the spokes to the hub. However, peering alone isn't enough; you must implement User Defined Routes (UDRs).

By creating a UDR on your spoke subnets, you tell Azure: 'Don't send this traffic directly to the internet; send it to the Azure Firewall's private IP address in the hub first.' This process, known as forced tunneling, ensures that no packet enters or leaves your environment without being inspected. This architecture prevents 'lateral movement,' meaning if a hacker compromises one spoke, the firewall can block them from jumping to another spoke, significantly limiting the blast radius of an attack.

Can you use both Azure Firewall and NSGs together?

Absolutely. In fact, we highly recommend a 'Defense in Depth' strategy. Using only one or the other leaves gaps in your security posture. The most effective architecture uses Azure Firewall for 'North-South' traffic (traffic entering or leaving the data center) and NSGs for 'East-West' traffic (traffic moving between subnets within a VNet).

Imagine the Azure Firewall as the security guard at the front gate of a gated community, checking IDs and preventing unauthorized cars from entering. The NSGs are like the locks on the individual house doors. Even if someone gets through the front gate, they still can't get into the houses without the right key. By layering these tools, you ensure that a single misconfiguration doesn't lead to a total system compromise. This layered approach is a frequent topic on the AZ-900 exam and a requirement for any production-grade environment.

How do you master these concepts for the AZ-900 exam?

Understanding the difference between L4 and L7 filtering is key, but the AZ-900 exam will test your ability to apply these concepts to business scenarios. You can't just memorize definitions; you need to recognize when a scenario calls for a centralized firewall versus a distributed NSG. The best way to bridge that gap is through high-volume, high-quality practice.

At Cert Sensei, we provide 1,000 expert-curated Microsoft Azure Fundamentals (AZ-900) practice questions designed to mimic the actual exam. We don't just tell you if you're wrong; we provide detailed expert reasoning for every answer so you understand the 'why' behind the architecture. Plus, our domain-level analytics show you exactly where you're struggling—whether it's network security or cloud governance—so you can stop wasting time on what you already know and focus on your weak points.

❓ Frequently Asked Questions