Azure Network Security Groups vs Azure Firewall
Interview Preparation Hub for Cloud Security Roles
Introduction
Azure provides multiple layers of security to protect workloads in the cloud. Two key components are Network Security Groups (NSGs) and Azure Firewall. While both control traffic flow, they operate at different layers and serve different purposes. Understanding their differences is crucial for cloud architects, engineers, and interview preparation.
Comparison Table
| Feature | Azure NSG | Azure Firewall |
|---|---|---|
| OSI Layers | Layer 3 & 4 (IP, port, protocol) | Layer 3–7 (network + application) |
| Scope | Applied to subnets or NICs | Protects entire VNets and cross-VNet traffic |
| Rules | Simple ACLs (allow/deny) | Network rules, application rules, NAT rules |
| Threat Intelligence | Not available | Integrated with Microsoft Threat Intelligence feeds |
| Management | Per NSG, decentralized | Centralized via Firewall Policy |
| Cost | Low (included) | Higher (pay-as-you-go) |
| Best Use Case | Subnet/VM-level filtering | Enterprise-grade perimeter security |
Deployment Considerations
- NSGs: Best for internal traffic filtering, micro-segmentation, and basic security.
- Azure Firewall: Best for centralized policies, compliance, and application-level filtering.
- Best Practice: Use NSGs for subnet/VM-level filtering and Azure Firewall for perimeter security.
Python Example (Azure SDK)
from azure.mgmt.network import NetworkManagementClient
from azure.identity import DefaultAzureCredential
credential = DefaultAzureCredential()
network_client = NetworkManagementClient(credential, "your-subscription-id")
# Example: Create NSG
nsg_params = {
"location": "eastus",
"security_rules": [{
"name": "AllowSSH",
"protocol": "Tcp",
"source_port_range": "*",
"destination_port_range": "22",
"source_address_prefix": "*",
"destination_address_prefix": "*",
"access": "Allow",
"priority": 100,
"direction": "Inbound"
}]
}
network_client.network_security_groups.begin_create_or_update(
"resource-group", "myNSG", nsg_params
)
Common Mistakes
- Relying only on NSGs → vulnerable to application-layer attacks.
- Using Azure Firewall without NSGs → lack of micro-segmentation.
- Not monitoring logs → silent failures.
- Ignoring cost implications of Azure Firewall.
Interview Notes
- Be ready to explain difference between NSGs and Azure Firewall.
- Discuss OSI layers and scope of each.
- Explain best practices for combining NSGs and Firewall.
- Know compliance and enterprise use cases for Azure Firewall.
Summary
Azure NSGs and Azure Firewall complement each other in securing cloud workloads. NSGs provide lightweight, subnet-level filtering, while Azure Firewall offers enterprise-grade, centralized security with advanced features. Together, they form a defense-in-depth strategy that is essential for modern cloud architectures and interview preparation.