Internet Access cloud firewall
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 2990d30 · +150 −0 lines · also on GitHub
The file is new at this commit, or was moved here from another path: every line shows as added.
1
+---
2
+title: Configure Global Secure Access cloud firewall with remote networks for internet access
3
+description: Learn how to configure and use GSA Cloud Firewall to protect against unauthorized internet access from branch offices using Remote Networks for Internet Access.
4
+author: jenniferf-skc
5
+ms.author: jfields
6
+manager: pmwongera
7
+ms.topic: how-to
8
+ms.service: global-secure-access
9
+ms.subservice: entra-private-access
10
+ms.date: 11/18/2025
11
+ms.custom: it-pro
12
+ms.reviewer: shkhalid
13
+ai-usage: ai-assisted
14
+
15
+#customer intent: As a Global Secure Access administrator, I want to learn how to configure and use GSA Cloud Firewall to protect against unauthorized internet access from branch offices using Remote Networks for Internet Access.
16
+---
17
+
18
+# Configure Global Secure Access cloud firewall (preview)
19
+
20
+Global Secure Access (GSA) Cloud Firewall (CFW) protects customers from unauthorized egress access by applying policies on network traffic. Cloud firewall provides centralized management, visibility, and consistent policies for branches.
21
+
22
+The current scope of this preview is using GSA Cloud Firewall to enforce policies on Internet traffic from branch offices using Remote Networks for Internet Access (also in preview).
23
+
24
+With this preview, you can:
25
+
26
+- Define granular Firewall filtering rules, where you'll define the traffic matching conditions and an action in case the traffic matches.
27
+
28
+- Define 5-tuple rules based on source IP, source Port, destination IP, destination Port, and destination Protocol (TCP, UDP).
29
+
30
+- Define and enforce an action between **Allow** and **Block**.
31
+
32
+## Prerequisites
33
+
34
+- Configure [remote networks for internet access](how-to-create-remote-networks.md).
35
+
36
+## Supported scenarios
37
+
38
+This preview supports these scenarios:
39
+
40
+| # | **Scenario** |
41
+|---|--------------|
42
+| 1 | Admin can create a cloud firewall policy with default Allow action (can't be changed).<br><br>The default action is applied to all traffic that does not match any of the rules in the policy. |
43
+| 2 | Admin can add/update rules in a cloud firewall policy and assign priorities to each rule.<br><br>Rule Matching conditions: In each of these rules, admin can define these traffic matching conditions: source IPv4, source Port, destination IPv4, destination Port, and Protocol (TCP, UDP or both).<br><br>The action for each rule can be set to **Allow** or **Block**. |
44
+| 3 | Admin can enable or disable an individual cloud firewall policy rule. |
45
+| 4 | Admin can delete an individual cloud firewall policy rule. |
46
+| 5 | Admin can link a cloud firewall policy to the baseline profile for the remote network. |
47
+| 6 | Admin can enable or disable the linked firewall policy to the baseline profile (security profile with priority=65000) |
48
+| 7 | Admin can delete the linked firewall policy with the baseline profile and link another one. |
49
+
50
+## Scenario configuration steps
51
+
52
+### Create a cloud firewall policy with the default **Allow** action.
53
+
54
+1. Sign in to your [Entra admin center](https://entra.microsoft.com/?Microsoft_Azure_Network_Access_isCloudFirewallPolicyEnabled=true&exp.isCloudFirewallPolicyEnabled=true#view/Microsoft_Azure_Network_Access/CloudFirewallPolicy.ReactView).
55
+
56
+1. Browse to **Global Secure Access 🡪 Secure 🡪 Cloud firewall policies 🡪 Create firewall policy.**
57
+
58
+1. Provide a **Name** and **Description**, then click **Create**.
59
+
60
+:::image type="content" source="media/how-to-configure-cloud-firewall/create-cloud-firewall-policy.png" alt-text="Screenshot showing the Create firewall policy page in the Entra admin center" lightbox="media/how-to-configure-cloud-firewall/create-cloud-firewall-policy.png":::
61
+
62
+### Add or update a cloud firewall rule, assign priority and enable or disable
63
+
64
+1. Click on the created firewall policy in the previous step.
65
+
66
+1. Under **Rules**, select **Add** rule.
67
+
68
+:::image type="content" source="media/how-to-configure-cloud-firewall/edit-rules.png" alt-text="Screenshot showing the Add rule option in the cloud firewall policy" lightbox="media/how-to-configure-cloud-firewall/edit-rules.png":::
69
+
70
+3. Configure the 5-tuple rule:
71
+
72
+ 1. Provide a **Name** and **Description**.
73
+
74
+ 1. Assign a priority to the rule relevant to other rules in this policy. Rule priority must be greater than or equal to 100 and should be unique within the policy. Lower value means higher priority.
75
+
76
+ 1. Select Rule settings **Status** to set to **Enable** or **Disable**. Default status is disabled and starting the rule with disabled status is recommended until ready to enforce.
77
+
78
+ 1. Configure the source and destination matching conditions. Note these important limitations:
79
+
80
+ - IPs are defined as IPs, IP ranges, or Classless Inter-Domain Routings (CIDRs).
81
+
82
+ - Destination Fully Qualified Domain Names (FQDNs) aren't supported currently so we recommend keeping it at the **Not set** value (default).
83
+
84
+ 1. Set the **Action** to **Allow** or **Block**.
85
+
86
+:::image type="content" source="media/how-to-configure-cloud-firewall/select-action.png" alt-text="Screenshot showing the cloud firewall rule configuration page" lightbox="media/how-to-configure-cloud-firewall/select-action.png":::
87
+
88
+ > [!NOTE]
89
+ > In the rule, source IP, source port, destination IP, destination port, and protocol are logically AND.
90
+ >
91
+ > For instance, you configure a rule as shown here:
92
+ >
93
+ > - Source IP = 10.0.0.5
94
+ > - Source Port = 12345
95
+ > - Destination IP = 192.168.1.20
96
+ > - Destination Port = 443
97
+ > - Protocol = TCP
98
+ >
99
+ > This firewall rule matches traffic that simultaneously meets the conditions for source IP, source Port, destination Port, destination IP, and Protocol. Not set values (default) in source and destination matching conditions are ignored.
100
+
101
+4. (Optional) Update any values in the rule and save them.
102
+
103
+### Delete a cloud firewall rule
104
+
105
+1. Use the trash bin icon under the **Actions** column to permanently delete any rule.
106
+
107
+:::image type="content" source="media/how-to-configure-cloud-firewall/edit-rules-2.png" alt-text="Screenshot showing the delete option for cloud firewall rules" lightbox="media/how-to-configure-cloud-firewall/edit-rules-2.png":::
108
+
109
+ > [!TIP]
110
+ > You can also disable the rule if you intend to use the rule in the future rather than deleting it.
111
+
112
+### Link a cloud firewall policy to the baseline profile for the remote network
113
+
114
+> [!IMPORTANT]
115
+> As a best practice, we recommend creating rules in the policy first before linking the policy to the baseline profile. Creating rules in the policy ensures all changes apply collectively. Ensuring collective changes is important if you create a "block-all" rule for the entire branch traffic, then add rules to allow certain traffic. Without following this best practice, you might inadvertently block yourself for all branch traffic.
116
+
117
+1. In your [Entra admin center](https://entra.microsoft.com/?Microsoft_Azure_Network_Access_isCloudFirewallPolicyEnabled=true&exp.isCloudFirewallPolicyEnabled=true#view/Microsoft_Azure_Network_Access/CloudFirewallPolicy.ReactView), browse to **Global Secure Access > Secure > Security Profiles > Baseline Profile**.
118
+
119
+:::image type="content" source="media/how-to-configure-cloud-firewall/security-baseline-profile.png" alt-text="Screenshot showing the navigation to Security Profiles" lightbox="media/how-to-configure-cloud-firewall/security-baseline-profile.png":::
120
+
121
+2. Click on **Edit profile**, then select **Link policy** to link an existing cloud firewall policy.
122
+
123
+:::image type="content" source="media/how-to-configure-cloud-firewall/edit-baseline-policy-link-policies.png" alt-text="Screenshot showing the Link policy option" lightbox="media/how-to-configure-cloud-firewall/edit-baseline-policy-link-policies.png":::
124
+
125
+Only one cloud firewall policy can be linked to a baseline profile. Linking a cloud firewall policy to a security profile other than the baseline profile won’t have any effect.
126
+
127
+### Enable or disable the linked firewall policy to the baseline profile
128
+
129
+1. Use the pencil icon to change the State of a linked firewall policy from **enabled** to **disabled** or vice versa.
130
+
131
+:::image type="content" source="media/how-to-configure-cloud-firewall/link-policy-status.png" alt-text="Screenshot showing the enable/disable option for linked firewall policy" lightbox="media/how-to-configure-cloud-firewall/link-policy-status.png":::
132
+
133
+### Delete the linked firewall policy and link to another one
134
+
135
+1. Use the trash bin icon to permanently delete any rule.
136
+1. Navigate to the **Link a policy** section to link to another policy.
137
+
138
+:::image type="content" source="media/how-to-configure-cloud-firewall/link-a-policy.png" alt-text="Screenshot showing the confirmation dialog for deleting linked policy" lightbox="media/how-to-configure-cloud-firewall/link-a-policy.png":::
139
+
140
+## Known limitations
141
+
142
+- The destination FQDN isn't supported in the cloud firewall rule.
143
+
144
+- It may take 15-20 minutes for any firewall policy updates to take effect.
145
+
146
+- Cloud firewall capability isn't currently supported with Global Secure Access clients.
147
+
148
+## Next steps
149
+
150
+[How to use the Global Secure Access traffic logs](how-to-view-traffic-logs.md)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:37 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.