Azure Firewall - RuleCollection with no rules

Hello Peter Stieber

Please check below details:

What happens if a rule collection (network, NAT, or application) is defined but contains no rules?

If a rule collection (whether it's a network, NAT, or application rule collection) has no rules, the configured action (like Allow or Deny) does not get applied to any traffic. An empty rule collection acts as if it doesn't exist, so it doesn't effectively create an implicit 'Allow All' or 'Deny All' scenario. Traffic won't be affected by that rule collection at all, since there's nothing in it to enforce."

• Rule collections only apply their action (Allow/Deny) when at least one rule matches.
• If there are no rules, then no match is possible, and the collection is skipped.
• Azure Firewall has an implicit deny at the end of rule processing, so unmatched traffic is denied by default.
• This behavior is consistent across network, NAT, and application rule collections.

What is the behavior of an empty rule collection group (i.e., one that contains no rule collections at all)?

A rule collection group is a container for multiple rule collections. If a group contains no rule collections at all:

• It is completely ignored by Azure Firewall.
• It has no implicit effect on traffic and It does not override or interfere with other rule collection groups.

Summary: An empty rule collection group is non-functional and has no impact on traffic.

Refer: https://learn.microsoft.com/en-us/azure/firewall/policy-rule-sets

I hope this helps! If these answers your query, do click the "Upvote" and click "Accept the answer" of which might be beneficial to other community members reading this thread.

If the above is unclear or you are unsure about something, please add a comment below.