Announcing Azure Firewall enhancements for troubleshooting network performance and traffic visibility

Microsoft Azure Firewall now offers new logging and metric enhancements that provide increased visibility and insights into traffic processed by the firewall, helping IT security administrators troubleshoot network issues.

• Azure Firewall is a cloud-native firewall as a service offering that enables customers to centrally govern and log all their traffic flows using a DevOps approach. The service supports both application and network-level filtering rules and is integrated with the Microsoft Defender Threat Intelligence feed to filter known malicious IP addresses and domains.
• IT administrators can enable these logs by reading the documentation linked in the article, enabling them to gain more insights into their network traffic and identify and resolve issues more effectively.
• The Latency Probe metric measures the overall latency of Azure Firewall and provides insight into the health of the service. IT administrators can use the metric for monitoring and alerting if there is observable latency and diagnosing if the Azure Firewall is the cause of latency in a network.
• The Flow Trace log enables IT administrators to monitor and track every packet through the firewall to identify packet drops or asymmetric routes. The log shows the additional TCP handshake logs in Flow Trace, such as SYN-ACK, FIN, FIN-ACK, RST, and INVALID, providing visibility into the return packet, failed connection, or an unrecognized packet.
• The Top Flows log shows the top connections that are contributing to the highest bandwidth in a given time frame through the firewall, helping IT administrators identify top traffic flows, unexpected or anomaly traffic, and make informed decisions on allowing or denying traffic.