Azure firewall basic in public preview

Microsoft has released a new SKU for Azure Firewalls called Basic, it’s still in Preview, so keep that in mind.

It is cheaper than Standard but has enough capabilities for most customers.

See the full announcement here.

And more information on my AZ-500 study guide on what Azure Firewall is about and how to set it up.


I made a table from the picture inside the announcement for easier reading. So credits go to Microsoft.

From here you can see the differences with them all with one glimpse.

Feature CategoryFeatureFirewall BasicStandardFirewall Premium
L3-L7 FilteringApplication level FQON filtering (SNI based) for HTTPS and SQLXXX
Network level FQDN filtering — all ports and protocolsXX
Stateful firewall (S tuple rules)XXX
Network Address Translation (SNAT/DNAT)XXX
Reliability & PerformanceAvailability zonesXXX
Built-in HAXXX
Cloud scalability (auto-scale as traffic grows)up to 250MbpsUp to 30 GbpsUp to 1M Gbps
Fat Flow supportN/A1 Gbps10 Gbps
Ease Of ManagementCentral management via Firewall ManagerXXX
Policy Analytics (Rule Management over time)XXX
Enterprise IntegrationFull logging including SIEM integrationXXX
Service Tags and FQDN Tags for easy policy managementXXX
Easy DevOps integration using REST/pS/CLl/Templbtes/ TerraformXXX
Web content filtering (web categories)XX
DNS Proxy and custom DNSXX
Advanced Threat ProtectionThreat intelligence-based filtering (known malicious IP address/ domains)AlertXX
Inbound TLS termination (TLS reverse proxy)using App GW
Outbound TLS termination (TLS forward proxy)X
Fully managed IDPSX
URL filtering (full path – incl. SSI termination)X

Availability zones

Availability zones are still supported in Basic.

You can place your Azure Firewall in an availability zone in some areas (or multiple, for zone redundancy). You might have selected an Azure region that doesn’t yet support availability zones if you are unable to select a zone.

Azure regions with availability zones

Azure provides the most extensive global footprint of any cloud provider and is rapidly opening new regions and availability zones.

AmericasEuropeMiddle EastAfricaAsia Pacific
Brazil SouthFrance CentralQatar CentralSouth Africa NorthAustralia East
Canada CentralGermany West CentralUAE NorthCentral India
Central USNorth EuropeJapan East
East USNorway EastKorea Central
East US 2UK SouthSoutheast Asia
South Central USWest EuropeEast Asia
US Gov VirginiaSweden CentralChina North 3
West US 2Switzerland North
West US 3


The performance will be gapped to 250mb/s, which is enough from remote locations and SMB sector clients.

Threat protection

Protection gets the biggest hit but you get alerts and can act based on them but all other features isn’t there with Basic.


But the pricing is a lot lower for deployment but higher for data processing.

Basic (Preview)StandardPremium
Deployment€0.411 per deployment hour€1.298 per deployment hour€1.818 per deployment hour
Data Processing€0.068 per GB processed€0.017 per GB processed€0.017 per GB processed


And remember the Hub and Spoke for all the firewall deployments inside Azure, it just makes sense.

CIDR cheat sheet

And if you are like me, you need this also. I never ever remember them, , so if You are like me, here You go.

Author: Harri Jaakkonen

Leave a Reply

Your email address will not be published. Required fields are marked *