Examkin

Question

Difficulty: HardConfigure Azure Firewall

An administrator is configuring security for an internal web server named `Server1` (private IP address 10.1.1.410.1.1.4) using an Azure Firewall. The administrator creates a Destination Network Address Translation (DNAT) rule that translates incoming HTTP traffic from the firewall's public IP address (40.120.50.1040.120.50.10) on port 8080 to `Server1` on port 8080. The administrator must block traffic from a specific external IP address (198.51.100.25198.51.100.25) to `Server1` while continuing to allow HTTP traffic from all other internet sources. Which configuration should the administrator add to the Azure Firewall?

  1. A
    A Network rule with Action: Deny, Source: 198.51.100.25198.51.100.25, Destination: 40.120.50.1040.120.50.10, Destination Port: 8080
  2. B
    A User-Defined Route (UDR) associated with the AzureFirewallSubnet with a route for 198.51.100.25/32198.51.100.25/32 and a Next Hop Type of None
  3. A Network rule with Action: Deny, Source: 198.51.100.25198.51.100.25, Destination: 10.1.1.410.1.1.4, Destination Port: 8080Answer
  4. D
    An Application rule with Action: Deny, Source: 198.51.100.25198.51.100.25, Target FQDN: 40.120.50.1040.120.50.10, Protocol: HTTP:80

Answer

A Network rule with Action: Deny, Source: 198.51.100.25198.51.100.25, Destination: 10.1.1.410.1.1.4, Destination Port: 8080
The correct configuration is to add a Deny Network rule targeting the server's private IP address (10.1.1.410.1.1.4). When inbound traffic matches a DNAT rule on Azure Firewall, the destination IP address is translated to the private IP address of the backend server. The firewall then evaluates Network rules against the translated packet. To block traffic from a specific source, the Deny Network rule must specify the post-translation destination IP (10.1.1.410.1.1.4).

Step-by-Step Solution

1
Analyze the rule processing order of Azure Firewall for incoming traffic.
Azure Firewall processes DNAT rules first, before evaluating Network and Application rules.
Understanding the sequence ensures that we account for destination IP translation prior to subsequent filter evaluations.
2
Determine the state of the packet when it is evaluated by Network rules.
The packet's destination IP address is translated from the public IP (40.120.50.1040.120.50.10) to the server's private IP (10.1.1.410.1.1.4).
Since DNAT occurs first, any following Network rules will see the translated private IP address as the destination.
3
Configure the Network rule to override the implicit allow rule created by the DNAT match.
Add a Network rule with Action: Deny, targeting the source IP 198.51.100.25198.51.100.25 and the post-translation destination IP 10.1.1.410.1.1.4.
An explicit Deny Network rule matches the post-translation destination and successfully drops the traffic before it reaches the backend.

Key Concept

Azure Firewall processes DNAT rules first, and subsequent Network rules are evaluated against the translated (private) destination IP address rather than the original public IP address.
Rate this question

Topics

Configure Azure Firewall

More questions from this topic