# Azure Firewall and Azure Network Security Groups (NSG)

Both Azure Firewall and Azure Network Security Groups (NSG) are a service to secure the in and out traffic for your VNets.

Here are some things to retain:

• The Azure Firewall protects workloads from OSI layer 3-7, the NSG at OSI Layers 3 and 4 to filter ingress and egress traffic from resources on an Azure Virtual Network (vNET)
• Azure Firewall goes beyond the classic security approach of authorization based on IP, port, and protocol by inspecting the network traffic itself to determine if the incoming/outgoing traffic is malicious.
• The NSG is generally deployed for individual vNets, subnets, and network interfaces for virtual machines to secure the traffic
• The Azure Firewall generally is deployed in its own VNet and is isolated from other Azure resources
• Azure Firewall can automatically scale
• Azure Firewall and NSG support service tags which are labels that represent a range of IP addresses for particular services
• Azure Network Security Group is a kind of basic firewall
• Azure Firewall provides several security features by default to protect from DoS protection, basic traffic monitoring, access control lists or intrusion.