DDoS Protection vs WAF vs Azure Firewall vs NSG: which layer each covers
Verdict: DDoS Protection covers layers 3 and 4 volumetric floods; a WAF covers layer 7 web exploits; Azure Firewall is stateful east-west and north-south inspection; an NSG is a static layer 3/4 filter. Pair DDoS with a WAF.
| Criterion | DDoS Protection | Web Application Firewall | Azure Firewall | NSG |
|---|---|---|---|---|
| Layer | L3/L4 volumetric | L7 web exploits | L3-L7 stateful, east-west and north-south | L3/L4 static subnet filter |
| What it stops | SYN floods and other volumetric attacks | SQL injection, cross-site scripting via OWASP rule sets | General traffic inspection between VNets and to the internet | Allow or deny by 5-tuple rule |
| Combine with | A WAF, for a public web app | DDoS Protection, for the network layer | Sits centrally in a hub VNet | Not a substitute for DDoS or WAF |
| Tiering note | IP Protection is pay-per-IP, no plan; Network Protection is plan-based | Front Door Premium adds managed rule sets and bot protection | Single stateful appliance, not per-subnet | Static rules, not auto-tuned |
| Choose when | Volumetric or protocol floods against a public IP | HTTP payload inspection is required | Centralised inspection of hub-spoke and internet traffic is required | Simple subnet or NIC-level allow/deny is enough |
Rules
- DDoS IP Protection is pay-per-protected-IP and needs no protection plan; DDoS Network Protection is organised around a plan applied across a virtual network.
- DDoS Protection covers layers 3 and 4 only; a WAF such as the Application Gateway WAF SKU is required separately for layer 7 web application protection.
- Azure Firewall is a fully stateful managed appliance that inspects both east-west (spoke-to-spoke) and north-south (internet-bound) traffic.
- Front Door Premium adds two capabilities Standard lacks: Microsoft-managed WAF rule sets and bot protection using Microsoft threat intelligence.
Traps
- DDoS Protection does not inspect or block malicious HTTP request payloads - it operates at layers 3 and 4 only.
- A WAF alone does not provide sufficient mitigation against volumetric layer 3/4 floods.
- NSG rules provide static traffic filtering, not an auto-tuned, always-on DDoS mitigation mechanism.
- Custom WAF rules, geo-filtering, and platform-level DDoS protection are common to both Front Door Standard and Premium - only managed rule sets and bot protection are Premium-exclusive.