* [Blog](https://www2.paloaltonetworks.com/blog) * [Palo Alto Networks](https://www2.paloaltonetworks.com/blog/corporate/) * [Cloud Computing](https://www2.paloaltonetworks.com/blog/category/cloud-computing-2/) * Understanding the Differe... # Understanding the Differences Between Azure Firewall and the VM-Series [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2F2018%2F08%2Fcloud-understanding-differences-azure-firewall-vm-series%2F) [](https://twitter.com/share?text=Understanding+the+Differences+Between+Azure+Firewall+and+the+VM-Series&url=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2F2018%2F08%2Fcloud-understanding-differences-azure-firewall-vm-series%2F) [](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2F2018%2F08%2Fcloud-understanding-differences-azure-firewall-vm-series%2F&title=Understanding+the+Differences+Between+Azure+Firewall+and+the+VM-Series&summary=&source=) [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www2.paloaltonetworks.com/blog/2018/08/cloud-understanding-differences-azure-firewall-vm-series/&ts=markdown) \[\](mailto:?subject=Understanding the Differences Between Azure Firewall and the VM-Series) Link copied By [Matt Keil](https://www.paloaltonetworks.com/blog/author/matt/?ts=markdown "Posts by Matt Keil") Aug 06, 2018 4 minutes [Cloud Computing](https://www.paloaltonetworks.com/blog/category/cloud-computing-2/?ts=markdown) [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown) [Secure the Cloud](https://www.paloaltonetworks.com/blog/category/secure-the-cloud/?ts=markdown) [Azure](https://www.paloaltonetworks.com/blog/tag/azure/?ts=markdown) [Azure Firewall](https://www.paloaltonetworks.com/blog/tag/azure-firewall/?ts=markdown) [Cloud Security](https://www.paloaltonetworks.com/blog/tag/cloud-security/?ts=markdown) [VM-Series](https://www.paloaltonetworks.com/blog/tag/vm-series/?ts=markdown) Microsoft recently announced the Azure Firewall (in public preview) as an optional set of extra cost security features that would be deployed in conjunction with Azure Network Security Groups. Key features include: * A stateful firewall as a service that provides outbound control over traffic based on port, protocol and/or by manually whitelisting the fully qualified domain name, or FQDN (i.e., www.github.com). * Built-in high availability with unrestricted cloud scalability; fully integrated with Azure Monitor for logging and analytics. * Price based on each Azure Firewall instance deployed plus bandwidth consumed. More info can be found here: [https://azure.microsoft.com/en-us/services/azure-firewall/](https://azure.microsoft.com/en-us/services/azure-firewall/) Whereas Network Security Groups are required to enable an Azure VNet, both the VM-Series and Azure Firewall are optional, and as such, customers and partners should understand how they can improve their security posture. Key VM-Series Differentiators The VM-Series differs from Azure Firewall by providing customers with a broader, more complete set of security functionality that, when combined with security automation, can help ensure workloads and data on Azure are protected from threats. Specific VM-Series differentiators include: * Can be deployed to protect traffic flows in all directions, not just outbound -- including inbound, outbound, and east-west. * Bi-directional control over applications (web-based and otherwise) not ports, resulting in a threat footprint reduction for improved security and compliance. * For allowed traffic, policies can prevent data exfiltration and threats, including vulnerability exploits, known and unknown malware. * Granular control over web-based developer resources with PAN-DB URL Filtering -- blacklist known malicious categories; whitelist specific developer resource URLs and/or categories. * Automation features such as dynamic address groups, external dynamic lists, and HTTP log forwarding to dynamically drive policy updates and ensure that developer environments are protected at the speed of the cloud. * Consistent security policies and enforcement across private cloud and public cloud environments. A more specific comparison can be found in the table below. |----------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------|-----------------------------------|-----------------------------------------| | **General Features** | **VM-Series on Azure** | **Azure Network Security Groups** | **Azure** **Firewall** | | IP/Port/Protocol-based security | X | X | X | | Port ranges used within policy | X | X | X | | Source and/or destination within policy | X | X | X | | CIDR-based rules | X | X | X | | ACL-like features within a policy | X | X | X | | Security applied after traffic enters Resource Group | X | X | X | | Drop vs. deny distinction within a policy | X | | | | **Next-Generation Firewall Features** | | | | | Policy-based identification and control over thousands of applications; create custom applications; manage unknown traffic based on policy | X | | Web apps only based on whitelisted FQDN | | Policy-based, bi-directional SSL decryption and inspection; per-policy SSH control | X | | | | Bi-directional control of traffic based on country or geographic region | X | | | | QoS: policy-based traffic shaping (priority, guaranteed, maximum) per application, per user, per tunnel, based on DSCP classification | X | | | | Zone-based network segmentation and protection | X | | | | TCP protocol validation, ensuring that standard three-way handshake is valid | X | | | | **Additional Features** | | | | | **Threat Prevention:** Prevent known threats (vulnerability exploits, malware and botnets), block polymorphic malware | X | | | | \*\*Advanced Malware Protection (WildFire^®^):\*\*Detect potential malware, detonate, analyze and automatically deliver protections | X | | | | \*\*URL Filtering:\*\*Control access to web resources based on category and/or specific URL; prevent access to known malicious sites and credential phishing sites | X | | Based on whitelisted FQDN only | | \*\*File and Data Filtering:\*\*Bi-directional control over unauthorized file and data transfer | X | | | | \*\*Contextual Threat Intelligence (AutoFocus™):\*\*Context around attacks, adversaries and campaigns, including targeted industries | X | | | | \*\*Policy Automation:\*\*Tagging to automate policy updates, ingest third-party data directly into policy | X | | | | \*\*Centralized Management and Visibility:\*\*Single pane of glass delivers aggregated logging and event correlation; actionable insight into traffic and threats | X | | | | **Mobile Security (GlobalProtect™):** Extend policy to remote users and devices | X | | | | \*\*Integration with Azure Security Command Center:\*\*Gain more complete visibility into Azure account security status | X | X | X | | \*\*Scale Out Architectures:\*\*Integration with load balancing for scalability and availability | X | X | X | *** ** * ** *** ## Related Blogs ### [Cloud Computing](https://www.paloaltonetworks.com/blog/category/cloud-computing-2/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown), [Secure the Cloud](https://www.paloaltonetworks.com/blog/category/secure-the-cloud/?ts=markdown) [#### Microsoft Ignite: Showcasing Our Cloud Offerings and the Depth of Our Microsoft Partnership](https://www2.paloaltonetworks.com/blog/2018/09/microsoft-ignite-showcasing-cloud-offerings-depth-microsoft-partnership/) ### [Cloud Computing](https://www.paloaltonetworks.com/blog/category/cloud-computing-2/?ts=markdown), [Events](https://www.paloaltonetworks.com/blog/category/events/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown), [Secure the Cloud](https://www.paloaltonetworks.com/blog/category/secure-the-cloud/?ts=markdown) [#### Visit Us at VMworld 2018 USA](https://www2.paloaltonetworks.com/blog/2018/08/visit-us-vmworld-2018-usa/) ### [Cloud Computing](https://www.paloaltonetworks.com/blog/category/cloud-computing-2/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown), [Secure the Cloud](https://www.paloaltonetworks.com/blog/category/secure-the-cloud/?ts=markdown) [#### Four Cloud Security Concerns (and How to Address Them)](https://www2.paloaltonetworks.com/blog/2019/05/cloud-security-concerns-address/) ### [Cloud Computing](https://www.paloaltonetworks.com/blog/category/cloud-computing-2/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown), [Secure the Cloud](https://www.paloaltonetworks.com/blog/category/secure-the-cloud/?ts=markdown) [#### Six Essentials for Your Cloud Security Program](https://www2.paloaltonetworks.com/blog/2019/04/six-essentials-cloud-security-program/) ### [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown), [Secure the Cloud](https://www.paloaltonetworks.com/blog/category/secure-the-cloud/?ts=markdown) [#### 8 Azure Security Best Practices](https://www2.paloaltonetworks.com/blog/2019/03/8-azure-security-best-practices/) ### [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown), [Secure the Cloud](https://www.paloaltonetworks.com/blog/category/secure-the-cloud/?ts=markdown) [#### Destination Cloud: Start Secure, Stay Secure With the Latest VM-Series Enhancements](https://www2.paloaltonetworks.com/blog/2019/02/destination-cloud-start-secure-stay-secure-latest-vm-series-enhancements/) ### Subscribe to the Blog! Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more. ![spinner](https://www2.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up Please enter a valid email. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder. This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. {#footer} {#footer} ## Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown) ## Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) ## Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language