Setting up a virtual Cisco ASA to work with our servers located at an Azure data center.

Hello everyone. I am in charge of a project In which I will be setting up a virtual firewall to connect to our servers at an Azure data center. I'm knowledgeable in networking, but don't know how to do this off the top of my head so I am looking for a little guidance so I know the right questions to ask, and I can bring some good suggestions to the table when we have our meeting about how we will set it up.

We are migrating away from our current data center provider. From my understanding, this whole thing works by having a virtual firewall that has a separate vlan and VPN connection to each server at the data center. When we deploy our Network at our customer sites, we install a physical Cisco ASA 5506. Its mostly there to manage the internal Network and provide DHCP, and VPN access to the server which contains our active directory.

Our Azure center is already set up. So it sounds like we just need to get the virtual firewall set up to talk to the servers, NAT their IP address, and set up security.

How can I ensure that the servers on the separate VLANs have no chance at talking with each other?

What general security rules need to be in place?

What kind of Nat rules?

Ultimately, how would you set up a virtual firewall to talk with your servers at a data center?

Side question, how does our physical firewalls onsite come in to play with connecting to the Azure data center. Do they do so through the virtual firewall which has NAT rules configured for the servers?

I hope this makes sense to those that read this. It's hard to know what im even trying to ask because I've never done anything like this before... But I can definitely answer any additional questions.

Any help is extraordinarily appreciated

Thank you guys very much, from one IT guy to another.