Tag: AWS

A DMZ (Demilitarized Zone) in Azure is a network security boundary where incoming and outgoing internet traffic is inspected and controlled before reaching backend workloads. Unlike on-premises, Azure provides multiple virtualized patterns to achieve the same security principles.

1. DMZ with Azure Firewall (Recommended)

• Place an Azure Firewall in a Hub VNet (DMZ subnet).
• All inbound/outbound traffic flows through the firewall.
• Use DNAT for inbound internet traffic (public IP → private workload).
• Use SNAT for outbound traffic to hide internal IPs.
• Combine with Application Gateway (WAF) for L7 protection.

Use case: Centralized security, enterprise landing zones, compliance-heavy apps.

2. DMZ with Network Virtual Appliances (NVA)

• Deploy 3rd party firewalls (Fortinet, Palo Alto, CheckPoint, Cisco ASA) in a DMZ subnet.
• NVAs provide advanced features like IPS/IDS and SSL inspection.
• Route internet traffic → NVA → internal VNets.
• Requires high availability setup (at least 2 NVAs).

Use case: Enterprises with existing firewall vendor lock-in or advanced packet inspection needs.

3. DMZ using Application Gateway + WAF

• Use Azure Application Gateway (AGW) with WAF as the public-facing endpoint.
• Only web workloads (HTTP/HTTPS) are exposed.
• AGW forwards traffic to backend workloads in private VNets.
• Can be combined with Azure Firewall for layered security.

Use case: Web applications needing L7 security and SSL offloading.

4. DMZ with Bastion Host for Admin Access

• Use Azure Bastion instead of exposing RDP/SSH via public IPs.
• Admins log in securely through the Azure Portal over SSL.
• No inbound ports (22/3389) exposed to the internet.

Use case: Secure administration of VMs without VPN.

5. DMZ in Hub-and-Spoke Architecture

• Hub VNet = DMZ containing Azure Firewall, Bastion, VPN/ExpressRoute Gateway.
• Spoke VNets = Workloads such as apps, databases, and services.
• Internet and on-prem traffic always flows through the Hub (DMZ).

Use case: Enterprise-scale setups with centralized governance.

6. DMZ with Azure Front Door + WAF

• Use Azure Front Door (AFD) as the global edge entry point.
• Provides DDoS protection, WAF, SSL offloading, and global load balancing.
• AFD forwards traffic → App Gateway/Azure Firewall → backend workloads.

Use case: Global apps needing low latency, DDoS protection, and CDN caching.

🔒 Best Practices for Azure DMZ

• Enable Azure DDoS Protection on the VNet hosting the DMZ.
• Use NSGs (Network Security Groups) for subnet-level filtering.
• Apply User Defined Routes (UDRs) to force traffic through Firewall/NVA.
• Keep the DMZ in its own subnet, separate from workloads.
• Log all DMZ traffic to Azure Monitor / Sentinel for auditing.

✅ Summary

• Modern cloud-native apps: Azure Firewall + Application Gateway (WAF).
• Web-only apps: Application Gateway WAF or Front Door WAF.
• Legacy lift-and-shift: NVAs replicate on-prem firewall policies.
• Enterprise landing zones: Hub-and-Spoke with DMZ hub.