Question

Your company uses Azure Firewall Premium managed by a single Azure Firewall Policy. Within that policy you have two rule collection groups: 'BaselineRules' (priority 200) containing a network rule collection that denies all traffic to 10.50.0.0/16, and 'AppRules' (priority 300) containing a network rule collection that allows TCP 443 from the workload subnet to 10.50.10.5. Users report that HTTPS connections to 10.50.10.5 are being dropped. You must allow this specific traffic while keeping the broad deny in place for the rest of the range. What should you do?

Accepted Answer

Change the priority of the 'AppRules' rule collection group to a lower number than 'BaselineRules' (for example 100).

Answer

Move the allow rule into an application rule collection instead of a network rule collection.

Answer

Increase the priority number of 'BaselineRules' to 400 so it is evaluated last.

Answer

Add a DNAT rule collection to 'AppRules' to translate the destination address.