AZ-104Hands-on lab55 min
Module lab — Azure Firewall in a hub-spoke network (extended)
لاب الدرس — Azure Firewall في شبكة Hub-spoke (موضوع ممتد)
Contoso has a hub vnet-hub ( 10.90.0.0/16 , AzureFirewallSubnet 10.90.1.0/26 ) peered with vnet-spoke1 (vm-spoke1, 10.91.1.4 ) and vnet-spoke2 (vm-spoke2, 10.92.1.4 ). Peerings already allow forwarded traffic. Security wants every spoke flow — to the Internet and between spokes — inspected by one Azure Firewall managed with a Firewall Policy, with least-privilege rules, an inbound SSH publication, DNS proxy and threat intelligence in deny mode. This is beyond the AZ-104 core, but it is what a real hub looks like.
The 6 tasks you will do
- Task 1 — Deploy the firewall with a Firewall Policyالمهمة 1 — انشر الـ Firewall بـ Firewall Policy
- Task 2 — Force the spokes through the firewall (UDR)المهمة 2 — ودّي ترافيك الـ Spokes على الـ Firewall إجباري (UDR)
- Task 3 — Spoke-to-spoke SSH with IP Groups (network rule)المهمة 3 — SSH بين الـ Spokes بالـ IP Groups (Network rule)
- Task 4 — Least-privilege Internet access (application rule)المهمة 4 — دخول للإنترنت بأقل صلاحيات (Application rule)
- Task 5 — Publish SSH of vm-spoke2 with DNATالمهمة 5 — انشر الـ SSH بتاع vm-spoke2 بـ DNAT
- Task 6 — DNS proxy and threat intelligenceالمهمة 6 — DNS proxy و Threat intelligence