> ## Documentation Index > Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt > Use this file to discover all available pages before exploring further. # Introduction > Design and implement Azure Firewall providing centralized stateful network and application protection, rule processing, deployment guidance, and hub and spoke enforcement in Azure. Design and implement Azure Firewall. Azure Firewall is a cloud-native, stateful firewall-as-a-service that protects Azure virtual networks by providing centralized, policy-driven network and application-level protection. It inspects and logs traffic, offers high availability by default, and integrates with Azure monitoring and policy services to deliver a scalable enforcement point for enterprise network architectures. Below are the learning objectives for this lesson. We'll: * Understand the core capabilities of Azure Firewall, including stateful traffic inspection, built-in high availability, and integration with Azure Monitor, Azure Policy, and diagnostic logging. * Learn how Azure Firewall evaluates and applies NAT rules, network rules, and application rules to control, filter, and translate traffic. * Explore deployment options and step-by-step configuration of Azure Firewall using the Azure portal ([Azure portal](https://portal.azure.com)) and automation approaches. * See how Azure Firewall functions as a central security enforcement point in hub-and-spoke network topologies, including traffic flow patterns and route considerations. * Clarify differences between Azure Firewall and other Azure network controls (Network Security Groups, Azure DDoS Protection, Application Gateway) to determine the appropriate use case for each. The image outlines learning objectives related to Azure Firewall, including its capabilities, processing of NAT and network rules, setup, and use in network design. It features a colorful design with numbered points. ## Learning outcomes (at a glance) | Objective | What you'll learn / achieve | | ------------------------------ | --------------------------------------------------------------------------------------------------- | | Core capabilities | How stateful inspection, scaling, and built-in HA work; integration with Azure Monitor and logging. | | Rule processing | How NAT rules, network rules, and application rules are evaluated and the order of precedence. | | Deployment & configuration | Portal walkthrough, recommended resource group and VNet patterns, and automation considerations. | | Hub-spoke enforcement | How to centralize traffic inspection in hub-and-spoke topologies and manage user-defined routes. | | Comparison with other controls | When to use Azure Firewall vs. NSGs, Application Gateway, or other Azure network services. | Tip: Use Azure Firewall as the centralized enforcement layer for outbound and east-west traffic in hub-and-spoke topologies, and pair it with NSGs for per-subnet micro-segmentation to achieve layered defense. ## Links and references * Azure portal: [https://portal.azure.com](https://portal.azure.com) * Azure Firewall overview: [https://learn.microsoft.com/azure/firewall](https://learn.microsoft.com/azure/firewall) * Azure networking concepts: [https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/virtual-network-hub-spoke](https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/virtual-network-hub-spoke) Warning: Azure Firewall is billed based on deployment SKU and processed data; review pricing and service limits before production deployment. See the Azure Firewall pricing and limits documentation for details.