Hi everyone.
My name is Suren Jamiyanaa,
and I'm a program manager on the Azure Firewall team.
Today, I'm going to be talking about Azure Firewall Premium
and Azure Firewall Manager.
We have a bunch of new features and capabilities
since the GA launches of our product.
So let's dive right in.
Azure Firewall has come a long way.
We have added advanced capabilities and features
that allow greater protection on your virtual networks.
And re-requirements for highly regulated
and sensitive environments.
These next gen features include TLS Inspection,
which allows you to decrypt, inspect
and re-encrypt traffic passing through the Firewall,
Intrusion Detection Prevention System or IDPS,
which provides rapid detection of attacks
based on traffic patterns, such as byte sequences,
or malicious instruction.
URL Filtering, so I can filter traffic based on the full URL
and instead of only just the FQDN,
and Web Categories.
So I can filter outbound traffic going to the internet
based on categories, such as social media or download sites.
So not only can I now filter traffic going east west,
or spoke to spoke or spoke to branch,
but also south north traffic going to the internet.
With Azure Firewall Premium,
the IDPS capability can block various categories
like malware, phishing, coin mining, and more.
We have more than 58,000 signatures that are continuously
being updated on a daily basis.
As an impact of the Azure Firewall Premium capabilities,
we recently had the "Oh My God" Attack,
which allowed elevation of privileged users,
and it was discovered on September 14th.
With Firewall Premium, it had a signature the very next day,
allowing all of our premium users to be well protected
against this dangerous vulnerability.
Now onto our new capabilities in Azure Firewall Premium.
The first demo that I want to share with you
is our IDPS Signature Look-up,
which provides greater visibility into all of the IDPS
capabilities that are used by the Azure Firewall.
So first we have our IDPS Signature Look-up,
which allows you to view all signatures by ID
that were logged through the Firewall.
This feature is helpful because you can gain more visibility
into the IDPS signatures and decide what action to take.
I can look at attributes such as the mode,
severity, direction and description,
what protocols were used and when the signature
was last updated.
On top of that, I can configure the setting
on what action to take on specific signatures
by selecting the signatures and editing the rules.
Here, as an example, I want to set these signatures
to alert and deny.
Next, we added two new features to Web Categories.
A feature that allows you to block user traffic
to the internet based on categories.
These two features are Category Check
and miscategorization request.
As an example, if I want to know what category
www.microsoft.com is,
I can search this URL in the tool
and it will return computers and technology,
the category, we displayed both the FQDN and full URL,
knowing that standard Firewall categorizes
based traffic on the FQDN,
and Premium Firewall can categorize traffic
based on the full URL with TELUS inspection turned on.
If I want to request miscategorization
for this current category,
I can select report and select another category
that I think fits better.
With that, if you started with Azure Firewall Standard,
we have guidance on how to migrate
to Azure Firewall Premium.
Note that in order to use Azure Firewall Premium,
you need to have a premium policy set in place.
We provided a tool that you can migrate to Premium using
Azure Firewall PowerShell scripts.
In addition, if you want to upgrade
your Standard Firewall to Premium Firewall,
you can use our new STOP/START feature,
which preserves all Firewall components,
including the PIP, network details and policy association.
In our roadmap, we also have a single-click upgrade
where you can update to Premium with zero downtime.
Lastly, we have some key updates
that provide simplified management for enterprise customers.
This includes Terraform Support,
so now you can manage Standard and Premium policies
through using Terraform.
We have added a New Region Availability
for our Premium clouds or Premium Firewalls
in the government and national clouds.
And we added Certificate Auto-Generation,
and this is helpful to help tie the three resources
like Managed Identity, Key Vault,
and Self-signed Root CA certificates,
together in your Premium policy set up,
and help set you up for a TELUS inspection.
Now onto Azure Firewall Manager.
We recognize that managing multiple Firewalls
and keeping consistent security policies across them
can be challenging for large enterprises.
To help with this challenge, we have Azure Firewall Manager,
which serves as a central policy management
for multiple networks security resources,
such as DDoS, Azure Firewalls, and in the future,
web application Firewalls.
Azure Firewall Manager allows customers to build
a policy once and also deploy it into multiple Firewalls
that are spread across multiple regions.
Azure Firewall Manager provides integration
with third party Firewall Azure service providers,
including Zscaler and Check Point
to allow customers to have
the best of breed security service.
So we know that policy is central to Azure Firewall.
It has rule configuration and over time,
these rules can get accumulated
and errors may not be included, which degrades performance,
security and readability of roles.
We launched a new feature called Policy Analytics,
which allows you to manage Azure Firewall rules
in your policy over time.
Policy insights helps you highlight key information
about the Firewall policies,
such as limits, Duplicate rules,
and Wildcards in rules and more.
We also have policy recommendations to help
improve the rules in the policy,
including rules with no low or no hits,
helps you get rid of overly permissive rules
and potentially malicious sources.
Rule analytics provides visibility
into the traffic flows over time.
And the rule hit count for Application,
Network and DNAT rules will be brought to your attention.
In addition, we'll have single rule analysis,
where you can refine rule permissions
and inspect the flows hit per a specific role.
Policy Analytics helps improve your security posture.
So you can analyze your security policies put into place,
and policy recommendations will help provide,
improve your rules over time.
It can help increase your threat protection as well,
by analyzing the traffic flows.
We recognize that you need to increase
the threat protection and you can do that
by utilizing rule analytics that gives you
visibility into the traffic patterns.
We recently integrated with DDoS Protection Plans
and Azure Firewall Manager.
DDoS Protection Standard provides mitigation features
to defend against DDoS attacks
on all public IP addresses and virtual networks.
With this integration,
you can now manage both Azure Firewall and DDoS
in one single place.
This means that I can manage, create and view DDoS plans
on my virtual networks in Azure Firewall Manager.
This helps provide you the ability to monitor
your overall network security posture
and identify security gaps in your environment.
For example, I can select my virtual network
that has an Azure Firewall,
and add a DDoS plan to it by selecting manage security
and manage DDoS plans.
I can enable DDoS protection.
And select the plan that I want to choose
to protect that virtual network.
And lastly, I can also view all of my DDoS protection plans
in a single place,
and create it from the Firewall Manager experience.
We've heard feedback from our enterprise customers
to have a better native SIEM Integration
that feeds into Azure Sentinel.
As a result, we created a workbook that provides
better visualization of the data within Azure Sentinel.
You can see additional information
in your application rules, network rules,
statistics, DNS proxy, and IDPS.
And with this visibility you can have an extension
of your Log Analytics workspace into a nice UI graphic.
That can be helpful for managing your network security.
Thank you all so much for coming to our session.
I hope this information session was helpful
into learning more about our new updates
and features to Azure Firewall Premium,
and Azure Firewall Manager.