Azure Firewall vs. Network Security Groups (NSG): Deep Architectural Comparison

### Overview: Layer 4 vs. Layer 7 Security

In Azure networking, **Network Security Groups (NSGs)** and **Azure Firewall** serve complementary roles in a defense-in-depth architecture.

| Feature | Network Security Group (NSG) | Azure Firewall | | :--- | :--- | :--- | | **OSI Layer** | Layer 3 & Layer 4 (IP, Port, Protocol) | Layer 3, 4 & Layer 7 (FQDNs, HTTP/S, TLS) | | **Scope** | Subnet & NIC level | Centralized VNet / Hub level | | **Threat Intelligence** | Basic Service Tags | Built-in IDPS & Threat Intel alerts/kills | | **Outbound Filtering** | IP/Port rules only | FQDN filtering (e.g. allow *.ubuntu.com) | | **Management** | Distributed per resource/subnet | Centralized rule collections & policy objects |

Recommended Enterprise Pattern

Deploy **Azure Firewall** in the central Hub VNet for central internet egress filtering and inter-spoke inspection, while retaining **NSGs** on individual subnets to restrict East-West traffic between servers in the same subnet.