# Outbound traffic from VNET integrated workloads is routed through Azure Firewall
Azure Firewall provides centralized inspection, logging, and enforcement for outbound network traffic.
Source: https://maester.dev/docs/tests/ZTA.25535
## Overview
Azure Firewall provides centralized inspection, logging, and enforcement for outbound network traffic. When you don't route outbound traffic from virtual network (VNet) integrated workloads through Azure Firewall, traffic can leave your environment without inspection or policy enforcement. VNet integrated workloads include virtual machines, AKS node pools, App Service with VNet integration, and Azure Functions in VNet.
Without routing outbound traffic through Azure Firewall:
- Threat actors can use uninspected outbound paths for data exfiltration and command-and-control communication.
- Organizations lose consistent enforcement of egress security controls such as threat intelligence filtering, intrusion detection and prevention, and TLS inspection.
- Security teams lack visibility into outbound traffic patterns, which makes it difficult to detect and investigate suspicious network activity.
## Remediation
- [Configure Azure Firewall routing](https://learn.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#configure-routing) to direct outbound traffic from workload subnets through the firewall's private IP address.
- [Manage route tables and routes](https://learn.microsoft.com/azure/virtual-network/manage-route-table?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) to create user-defined routes for the default route (0.0.0.0/0) pointing to the Azure Firewall private IP.
- [Control App Service outbound traffic with Azure Firewall](https://learn.microsoft.com/azure/app-service/network-secure-outbound-traffic-azure-firewall?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) for App Service VNet integration scenarios.
- [Configure Azure Firewall rules](https://learn.microsoft.com/azure/firewall/rule-processing?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) to allow required outbound traffic while blocking malicious destinations.
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Medium |
| Impact on users | Low |
| Pillar | Network |
| Category | Azure Network Security |
| Product | [Azure](/docs/tests/products/azure) |
| Feature | Network security |
| Area | Infrastructure hardening |
| ATT&CK | [T1071](/docs/tests?mitre=T1071) Application Layer Protocol, [T1041](/docs/tests?mitre=T1041) Exfiltration Over C2 Channel |
| Licence | Azure_Firewall_Basic, Azure_Firewall_Standard, Azure_Firewall_Premium |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.