Your company has an Azure virtual network named VNet-Core that contains a workload subnet named Subnet-Workload. You deploy an Azure Firewall. You plan to configure network rules that use fully qualified domain names (FQDNs) to filter outbound traffic from Subnet-Workload. You need to configure the firewall to act as a DNS proxy so that virtual machines in Subnet-Workload resolve DNS queries through the firewall. Which two configurations should you perform?
- Enable DNS Proxy in the settings of the Azure Firewall Policy.Answer
- Configure the DNS servers settings of VNet-Core to use the private IP address of the Azure Firewall.Answer
- CAdd a route to the route table of Subnet-Workload with a next hop type of Virtual Appliance pointing to the firewall's private IP for the destination 168.63.129.16/32.
- DConfigure a virtual network link with auto-registration enabled from VNet-Core to a Private DNS Zone.
Answer
Enable DNS Proxy in the settings of the Azure Firewall Policy, and configure the DNS servers settings of VNet-Core to use the private IP address of the Azure Firewall.
Enabling the DNS proxy setting in the Azure Firewall Policy and configuring the virtual network's DNS server settings to target the firewall's private IP ensures that the virtual machines direct their DNS queries through the firewall. This allows the firewall to map domain names to IP addresses for FQDN-based network rules.
Step-by-Step Solution
Key Concept
Azure Firewall DNS Proxy configuration requires enabling DNS proxy in the firewall policy and specifying the firewall's private IP as the custom DNS server on the virtual network.