title: Do I need to enable the firewall on Virtual Network if I have enabled the firewall on the application gateway?
body: <p>I have set up a Virtual Network with an Application Gateway (which has both DDoS Protection and Firewall enabled). The Application Gateway forward the requests to a WebApp. There are no other components in the Virtual Network.</p>
  
  <p>I also see that there is a Firewall on the Virtual Network as well. When I enable it, it asked that I need to create a subnet called AzureFirewallSubnet.</p>
  
  <p>My question is, do I need to enable this firewall? does it make any difference to my scenario?</p>
  
  <p>Thanks.</p>
  
  <p>My scenario is similar to <img src="https://i.stack.imgur.com/50kKe.png" alt="diagram">.</p>