Azure Firewall Exploring IDPS

Показать описание

Concept of IDPS
IDPS combines two major functionalities: intrusion detection, which monitors network and system activities for malicious actions or policy violations, and
intrusion prevention, which actively blocks or prevents those detected threats from carrying out their intended actions. Essentially, IDPS acts as a watchdog and a gatekeeper, ensuring that only safe traffic is allowed through while keeping threats at bay.
Azure Firewall Premium provides signature-based IDPS to allow rapid detection of attacks by looking for specific patterns, such as byte sequences in network traffic, or known malicious instruction sequences used by malware.
The IDPS signatures are applicable for both application and network-level traffic (Layers 3-7). They're fully managed and continuously updated. IDPS can be applied to inbound, spoke-to-spoke (East-West), and outbound traffic. Spoke-to-spoke (East-West) includes traffic that goes from/to an on-premises network.
IDPS allows you to detect attacks in all ports and protocols for nonencrypted traffic. However, when HTTPS traffic needs to be inspected, Azure Firewall can use its TLS inspection capability to decrypt the traffic and better detect malicious activities.
The IDPS Bypass List is a configuration that allows you to not filter traffic to any of the IP addresses, ranges, and subnets specified in the bypass list. The IDPS Bypass list is not intended to be a way to improve throughput performance, as the firewall is still subject to the performance associated with your use case. (Show doc for bypass list)
In Azure Firewall Premium IDPS, private IP address ranges are used to identify if traffic is inbound, outbound, or internal (East-West). Each signature is applied on specific traffic direction, as indicated in the signature rules table.
traffic sent from a private IP address range to a private IP address range is considered internal. To modify your private IP addresses, you can now easily edit, remove, or add ranges as needed. (show doc for private IDPS)

My name is Arun Pachehra and i am an IT Professional & a fitness enthusiast. Its been more than 16 years working with various technologies and now i am planning to share with you all. As per plan i am going to publish the entire Az 303 series first and if things would go as planned then a lot of stuff would come your way including Q&A , Production issues and various interesting stuff.