NSG vs Firewall vs WAF: Which Azure Security Tool Do You Need?
These three tools all filter traffic, but at different layers and scopes. Here's how to tell them apart — and when you might need more than one.
Network Security Group (NSG)
- Layer:
- Layer 3/4 (network & transport)
- Scope:
- Subnet or network interface
Basic allow/deny traffic filtering between subnets or VMs based on IP, port, and protocol — your first line of segmentation.
Try the NSG Rule Builder tool →Azure Firewall
- Layer:
- Layer 3/4/7 (network, transport & some application)
- Scope:
- Entire virtual network or hub in a hub-spoke topology
Centralized, stateful traffic filtering and outbound/inbound rules across an entire network — including DNAT and FQDN-based application rules.
Try the Firewall Rule Generator tool →Web Application Firewall (WAF)
- Layer:
- Layer 7 (application)
- Scope:
- Individual web applications behind Application Gateway or Front Door
Protecting internet-facing web apps from OWASP Top 10 threats like SQL injection and cross-site scripting — traffic-content-aware, not just IP/port-based.
Try the WAF Web Shield tool →Using them together
Most production Azure environments layer all three: NSGs for baseline subnet segmentation, Azure Firewall for centralized network-wide policy, and WAF for application-layer protection on internet-facing web apps. They're complementary, not mutually exclusive.
Want more definitions like these? Browse the full Azure Networking Glossary.