{"id":1311,"date":"2019-05-14T00:00:00","date_gmt":"2019-05-14T00:00:00","guid":{"rendered":"https:\/\/azure.microsoft.com\/blog\/azure-firewall-and-network-virtual-appliances"},"modified":"2025-06-23T23:51:06","modified_gmt":"2025-06-24T06:51:06","slug":"azure-firewall-and-network-virtual-appliances","status":"publish","type":"post","link":"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-firewall-and-network-virtual-appliances\/","title":{"rendered":"Azure Firewall and network virtual appliances"},"content":{"rendered":"\n

Network security solutions can be delivered as appliances on premises, as network virtual appliances (NVAs) that run in the cloud or as a cloud native offering (known as firewall-as-a-service).<\/p>\n\n\n\n

Customers often ask us how Azure Firewall is different from Network Virtual Appliances, whether it can coexist with these solutions, where it excels, what\u2019s missing, and the TCO benefits expected. We answer these questions in this blog post.<\/p>\n\n\n\n

Network virtual appliances (NVAs)<\/h2>\n\n\n\n

Third party networking offerings play a critical role in Azure, allowing you to use brands and solutions you already know, trust and have skills to manage. Most third-party networking offerings are delivered as NVAs today and provide a diverse set of capabilities such as firewalls, WAN optimizers, application delivery controllers, routers, load balancers, proxies, and more. These third party capabilities enable many hybrid solutions and are generally available through the Azure Marketplace<\/a>. For best practices to consider before deploying a NVA, see Best practices to consider before deploying a network virtual appliance<\/a>.<\/p>\n\n\n\n

Cloud native network security<\/h2>\n\n\n\n

A cloud native network security service (known as firewall-as-a-service) is highly available by design. It auto scales with usage, and you pay as you use it. Support is included at some level, and it has a published and committed SLA. It fits into DevOps model for deployment and uses cloud native monitoring tools.<\/p>\n\n\n\n

What is Azure Firewall?<\/h2>\n\n\n\n

Azure Firewall is a cloud native network security service. It offers fully stateful network and application level traffic filtering for VNet resources, with built-in high availability and cloud scalability delivered as a service. You can protect your VNets by filtering outbound, inbound, spoke-to-spoke, VPN, and ExpressRoute traffic. Connectivity policy enforcement is supported across multiple VNets and Azure subscriptions. You can use Azure Monitor to centrally log all events. You can archive the logs to a storage account, stream events to your Event Hub, or send them to Log Analytics or your security information and event management (SIEM) product of your choice.<\/p>\n\n\n\n

Is Azure Firewall a good fit for your organization security architecture?<\/h2>\n\n\n\n

Organizations have diverse security needs. In certain cases, even the same organization may have different security requirements for different environments. As mentioned above, third party offerings play a critical role in Azure. Today, most next-generation firewalls are offered as Network Virtual Appliances (NVA) and they provide a richer next-generation firewall feature set which is a must-have for specific environments\/organizations.  In the future, we intend to enable chaining scenarios to allow you to use Azure Firewall for specific traffic types, with an option to send all or some traffic to a third party offering for further inspection. This third-party offering can be either a NVA or a cloud native solution.<\/p>\n\n\n\n

Many Azure customers find the Azure Firewall feature set is a good fit and it provides some key advantages as a cloud native managed service:<\/p>\n\n\n\n