What is needed to deploy an Azure Firewall?

Azure Firewall requires it’s own empty subnet and an unused IP address space. You will need to create an address space, if one isn’t available.

Do I also need NSGs?

No. Once an Azure Firewall is in place, no NSGs are needed.

Do I also need ASGs?

No. An Application Security Group is a grouped set of azure resources that can be referenced via a common set of NSGs rules.

Do I also Azure Policy?

No. These are different from Firewalls – these are more around Governance.