Challenge: secure a hub-spoke landing zone with Azure Firewall

تحدي: أمّن Landing zone ‏Hub-spoke بـ Azure Firewall

Northwind already deployed fw-core (Standard, policy fwpol-core ) in vnet-hub ( 10.94.0.0/16 ). Spokes: vnet-spoke1 (web tier, vm-spoke1 10.95.1.4 ) and vnet-spoke2 (database tier, vm-spoke2 10.96.1.4 , SQL on TCP 1433). Nothing goes through the firewall yet, and one of the peerings was created by a script with default settings. No steps — meet the requirements with least privilege. Resource group: rg-ch-fw .

The 4 tasks you will do

• Requirement 1 — Everything from the spokes is inspectedالمتطلب 1 — كل حاجة طالعة من الـ Spokes تتفحص
• Requirement 2 — Web tier may reach SQL, nothing elseالمتطلب 2 — الـ Web tier يوصل للـ SQL وبس
• Requirement 3 — Controlled browsing with threat protectionالمتطلب 3 — تصفح متحكم فيه مع حماية من التهديدات
• Requirement 4 — Publish the web server to partners onlyالمتطلب 4 — انشر الـ Web server للشركاء بس

The lesson it belongs to

• Extended: Azure Firewall and route tables in a hub-spoke network