Every hub firewall must share a baseline (deny Internet RDP, threat…

Question

Every hub firewall must share a baseline (deny Internet RDP, threat intel on) while each region adds its own FQDNs. What should the security engineer use?

Accepted Answer

Use Azure Firewall Manager with a parent Firewall Policy and child policies for regional additions instead of copy-pasting classic rules on each firewall. — One parent Firewall Policy for the shared baseline, child policies for regional FQDNs, steered by Firewall Manager. Stop Xeroxing classic rules onto every hub.

Answer

Copy classic Azure Firewall rule collections by hand onto every hub and avoid Firewall Policy entirely.

Answer

Replace firewall baselines with an Azure Policy initiative that only audits resource tags.

Answer

Attach a single NSG to all hub firewalls and disable Firewall Manager.

Every hub firewall must share a baseline (deny Internet RDP, threat intel on) while each region adds its own FQDNs. What should the security engineer use?

Short Explanation

Full Explanation