Azure – Azure Firewall Manager can now integrate with virtual networks

As introduced some time ago, Azure Firewall Manager (AFM) is the central configuration and management point for Azure Firewall.

Well, AFM has been updated and is now able to integrate with your virtual network.


The integration consists on ‘converting’ your Azure Virtual Network to a hub virtual network.

This is handy if your network architecture is based on virtual networks only – meaning you have no VPN, SDWAN or third party security service integration.

When to choose a hub virtual network vs a secured virtual hub is summarized in the below table:

Hub virtual network Secured virtual hub
Underlying resource Virtual network Virtual WAN hub
Hub-and-Spoke Using virtual network peering Automated using hub virtual network connection
On-premises connectivity VPN Gateway up to 10 Gbps and 30 S2S connections; ExpressRoute More scalable VPN Gateway up to 20 Gbps and 1000 S2S connections; ExpressRoute
Automated branch connectivity using SDWAN Not supported Supported
Hubs per region Multiple VNet per region Single hub per region
Azure Firewall – multiple public IP addresses You provided it

Not yet available; planned for GA


Azure Firewall Availability Zones Supported Not yet available; planned for GA
Advanced internet security with 3rd party Security as a service partners VPN connectivity enabled and managed by you Automated using a Trusted Security Partner
Centralized route management to attract traffic to the hub

Customer managed UDR

Planned for later: UDR default route automation

Web Application Firewall on Application Gateway Supported

Not available

Planned for later

Network Virtual Appliance Supported

Not available

Planned for later

To start using it, logon to your Azure portal ( and search for Firewall Manager


From there, just click on View hub virtual network from the Getting Started blade or directly reach the Hub virtual networks blade


From this blade you can create a new hub virtual network or convert an existing virtual network


When you create a new hub virtual network, you have to define the resource group., location and IP ranges (as for any virtual networks) but then you will define your Azure Firewall policies

image_thumb[4]  image_thumb[5]

If you want to convert an existing virtual network to a hub virtual network, you just have to select the VNet to be converted and then define the Azure Firewall policies