A workload must send TCP traffic on port 8443 to a fixed partner appliance IP through Azure Firewall. The protocol is not HTTP. Which firewall rule type should you configure?
Show answer and explanation
Answer: A
Network rules match source and destination IP addresses, ports, and protocols, including TCP on arbitrary ports. A fixed IP and port destination with a non-HTTP protocol falls squarely into this category. Application rules are limited to web protocols and FQDN or web category matching. DNAT rules handle inbound publishing, and this flow leaves the workload toward a partner.
Why the other options are wrong
- B. Application rules work on FQDNs and web protocols such as HTTP and HTTPS. A raw TCP session to a fixed IP on port 8443 falls outside their scope.
- C. DNAT rules translate connections arriving at the firewall's public address. This flow is outbound toward a partner, so DNAT does not apply.
- D. Web categories filter outbound web browsing by content category. They do not permit a non-web TCP connection to one specific partner IP.