Azure Firewall - force tunneling

Forced tunneling diverts internet-bound traffic to an on-premises next hop (like via VPN/ExpressRoute) instead of going directly to the internet. Without the management NIC, all traffic (including Azure Firewall's own internet-dependent traffic like threat intelligence, logging, updates) would be subject to your forced tunneling rules. This causes a chicken-and-egg problem: The firewall needs to access the internet (e.g., to pull updates), but if you've forced all outbound traffic to go through on-prem, you could inadvertently block critical Azure Firewall management traffic.

So to solve this, Azure splits the NICs into:

• Data plane NIC (FirewallSubnet): for inspected traffic.
• Management NIC (AzureFirewallManagementSubnet): for firewall's own system/management traffic (not user traffic).

You could potentially avoid the Management NIC but only if you don't force tunnel 0.0.0.0/0 (i.e., you're not hijacking all outbound traffic). Here's what's allowed without Management NIC:

You don't need the management NIC if you do the following (Azure Firewall will still use its data NIC to access Azure services and the internet):

• Add a User-Defined Route (UDR) to the FirewallSubnet, and
• Route only selected prefixes (like your on-prem CIDRs) to your on-prem next hop,
• While leaving internet-bound traffic to go out directly via default route,

However, if you add a UDR to redirect 0.0.0.0/0 from the FirewallSubnet, then:

• All traffic, including Azure Firewall's own system traffic, is redirected
• This breaks firewall management unless the management NIC is enabled

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin