Outbound HTTPS from spokes must be opened, inspected for malware, a…

Question

Outbound HTTPS from spokes must be opened, inspected for malware, and evaluated with an intrusion-detection signature set. Which Azure Firewall choice meets that requirement?

Accepted Answer

Select Azure Firewall Premium for TLS inspection and IDPS rather than Standard (threat intel and FQDN) or Application Gateway WAF alone. — TLS inspection plus IDPS is Premium territory. Standard stops at threat intel and FQDN; WAF guards HTTP(S) to a web app—not every spoke’s outbound HTTPS.

Answer

Select Azure Firewall Standard only, because Standard includes TLS inspection and IDPS.

Answer

Select Application Gateway WAF only, because WAF inspects all spoke outbound HTTPS to any FQDN.

Answer

Select Azure Firewall Basic and enable IDPS signatures without upgrading the SKU.

Outbound HTTPS from spokes must be opened, inspected for malware, and evaluated with an intrusion-detection signature set. Which Azure Firewall choice meets that requirement?

Short Explanation

Full Explanation