The hub Azure Firewall must allow a spoke VM to login.microsoftonline.com over HTTPS, allow TCP 1433 to a known SQL IP, and publish an internal RDP host to one operator IP. How should those be mapped to firewall rule kinds?
Select an answer to reveal the explanation.
Short Explanation
FQDN HTTPS → application rule, known IP:port → network rule, publish an internal host → DNAT. Don’t pretend three NSG lines on the firewall subnet are the same toolbox.
Full Explanation
Azure Firewall application rules evaluate FQDN-based HTTP(S)/SQL proxy destinations such as login.microsoftonline.com. Network rules match 5-tuple traffic such as TCP 1433 to a known SQL IP. DNAT publishes an internal service (for example RDP) to a controlled public mapping. NSG rules on the firewall subnet are not a substitute for these firewall rule kinds. Using only DNAT or only application rules cannot correctly express all three scenarios.