Azure Firewall
Introduction
Azure Firewall is a cloud-native, scalable, and highly available security service that provides network traffic filtering and threat protection. It helps safeguard your resources by enforcing security rules, inspecting traffic, and preventing unauthorized access to ensure a secure and compliant network environment.
Getting Started
Compatibility
The Azure Firewall O11ySource supports Azure Firewall Services within standard lifecycle support.
Data Collection Method
vuSmartMaps collects Azure Firewall metrics through a data collector deployed within the vuSmartMaps platform, which uses azure_monitor to retrieve performance and health metrics.
Prerequisites
Dependent Configuration
To configure this O11ySource, create a 'credential' of type 'azure' under the 'Definition' tab.
Inputs for Configuring Data Source
- Resource Name: Enter the Resource Name of Firewall
- Resource ID: A unique identifier for the Azure resource.
- Credential: Client ID, Client Secret, Subscription ID and Tenant ID associated to the credential.
- Period (in seconds): Time interval for polling data from the Azure Event Hub. Period should be between 60 seconds – 3000 seconds.
Applications
Firewall Requirement
To collect data from this O11ySource, ensure the following ports are opened:
| Source IP | Destination IP | Destination Port | Protocol | Direction |
|---|---|---|---|---|
| vuSmartMaps Collection/Ingress node IP | Service URL | 443* | TCP | Outbound |
*Before providing the firewall requirements, please update the port based on the customer environment.
Configuring the Target
Health and performance metrics of Azure Firewall Services are collected through Azure Monitor service. Thus, Azure Monitor must be enabled in your Azure account. Azure Firewall Services should have available instances for which monitoring is enabled.
An IAM role or user with the following permissions to access Azure Firewall metrics through Azure Monitor:
- Grant the Azure AD application, for which you've obtained the Client ID and Client Secret, the "Reader" role or a custom role specifically assigned with the Microsoft.Insights/metrics/read permission.
Configuration Steps
Metrics Collected
| Name | Description | Data Type |
|---|---|---|
| name | Metric name of the Azure resource (e.g., firewall throughput, dropped packets, etc.). | String |
| timestamp | Precise timestamp of the agent with milliseconds | DateTime64 |
| target | The specific Azure Firewall instance or entity being measured. | String |
| resource_group | Resource group in Azure | String |
| namespace | The namespace for Azure Firewall metrics (e.g., Microsoft.Network/azurefirewalls). | String |
| resource_name | Name of the Azure resource (Azure Management API) | String |
| resource_region | The Azure region where the firewall instance is deployed. | String |
| subscription_id | Azure subscription identifier | String |
| unit | Unit of measurement for the metric (e.g., bytes, packets, requests per second). | String |
| minimum | Minimum value of the metric over the period | Float64 |
| maximum | Maximum value of the metric over the period | Float64 |
| total | Total value of the metric over the period | Float64 |
| average | Average value of the metric over the period | Float64 |
| count | Indicate the number of occurrences or events of a specific type within a given time frame. | UInt64 |
