As introduced some time ago, Azure Firewall Manager (AFM) is the central configuration and management point for Azure Firewall.
Well, AFM has been updated and is now able to integrate with your virtual network.
The integration consists on ‘converting’ your Azure Virtual Network to a hub virtual network.
This is handy if your network architecture is based on virtual networks only – meaning you have no VPN, SDWAN or third party security service integration.
When to choose a hub virtual network vs a secured virtual hub is summarized in the below table:
|Hub virtual network||Secured virtual hub|
|Underlying resource||Virtual network||Virtual WAN hub|
|Hub-and-Spoke||Using virtual network peering||Automated using hub virtual network connection|
|On-premises connectivity||VPN Gateway up to 10 Gbps and 30 S2S connections; ExpressRoute||More scalable VPN Gateway up to 20 Gbps and 1000 S2S connections; ExpressRoute|
|Automated branch connectivity using SDWAN||Not supported||Supported|
|Hubs per region||Multiple VNet per region||Single hub per region|
|Azure Firewall – multiple public IP addresses||You provided it||
Not yet available; planned for GA
|Azure Firewall Availability Zones||Supported||Not yet available; planned for GA|
|Advanced internet security with 3rd party Security as a service partners||VPN connectivity enabled and managed by you||Automated using a Trusted Security Partner|
|Centralized route management to attract traffic to the hub||
Customer managed UDR
Planned for later: UDR default route automation
|Web Application Firewall on Application Gateway||Supported||
Planned for later
|Network Virtual Appliance||Supported||
Planned for later
To start using it, logon to your Azure portal (https://portal.azure.com/) and search for Firewall Manager
From there, just click on View hub virtual network from the Getting Started blade or directly reach the Hub virtual networks blade
From this blade you can create a new hub virtual network or convert an existing virtual network
When you create a new hub virtual network, you have to define the resource group., location and IP ranges (as for any virtual networks) but then you will define your Azure Firewall policies
If you want to convert an existing virtual network to a hub virtual network, you just have to select the VNet to be converted and then define the Azure Firewall policies