Azure Network Circuit Peering

azurerm_express_route_circuit_peering (Terraform)

The Circuit Peering in Network can be configured in Terraform with the resource name azurerm_express_route_circuit_peering. The following sections describe 10 examples of how to use the resource and its parameters.

Example Usage from GitHub

AErmie/Terraform-Real-World-Edition

resource "azurerm_express_route_circuit_peering" "Hub-ExpressRoute-Peering" {
  peering_type                  = var.ExpressRoute-PeeringType
  express_route_circuit_name    = var.ExpressRoute-CircuitName
  resource_group_name           = var.ExpressRoute-RGName
  peer_asn                      = var.PeerASN
  primary_peer_address_prefix   = var.PrimaryPeerAddressPrefix

AErmie/TFCloud-IaC-Using-Terraform

resource "azurerm_express_route_circuit_peering" "Hub-ExpressRoute-Peering" {
  peering_type                  = var.ExpressRoute-PeeringType
  express_route_circuit_name    = var.ExpressRoute-CircuitName
  resource_group_name           = var.ExpressRoute-RGName
  peer_asn                      = var.PeerASN
  primary_peer_address_prefix   = var.PrimaryPeerAddressPrefix

karolnedza/migration

resource "azurerm_express_route_circuit_peering" "cloudN" {
  peering_type                  = "AzurePrivatePeering"
  express_route_circuit_name    = azurerm_express_route_circuit.cloudN.name
  resource_group_name           = "s5-vnet-rg-01"
  peer_asn                      = 65000              # on prem router ASN
  primary_peer_address_prefix   = "10.255.255.20/30" # IP prefix for ER

AErmie/DevSecOps

resource "azurerm_express_route_circuit_peering" "Hub-ExpressRoute-Peering" {
  peering_type                  = var.ExpressRoute-PeeringType
  express_route_circuit_name    = var.ExpressRoute-CircuitName
  resource_group_name           = var.ExpressRoute-RGName
  peer_asn                      = var.PeerASN
  primary_peer_address_prefix   = var.PrimaryPeerAddressPrefix

kevinhead/azurerm

resource "azurerm_express_route_circuit_peering" "this" {
  express_route_circuit_name    = var.express_route_circuit_name
  peer_asn                      = var.peer_asn
  peering_type                  = var.peering_type
  primary_peer_address_prefix   = var.primary_peer_address_prefix
  resource_group_name           = var.resource_group_name

niveklabs/azurerm

resource "azurerm_express_route_circuit_peering" "this" {
  express_route_circuit_name    = var.express_route_circuit_name
  peer_asn                      = var.peer_asn
  peering_type                  = var.peering_type
  primary_peer_address_prefix   = var.primary_peer_address_prefix
  resource_group_name           = var.resource_group_name

mb290/terraform-express-route-direct

resource "azurerm_express_route_circuit_peering" "example" {
  peering_type                  = "AzurePrivatePeering"
  express_route_circuit_name    = azurerm_express_route_circuit.example.name
  resource_group_name           = azurerm_resource_group.example.name
  shared_key                    = "ItsASecret"
  peer_asn                      = 100

claranet/terraform-azurerm-virtual-wan

resource "azurerm_express_route_circuit_peering" "ercprivatepeer" {
  for_each                      = var.express_route_enabled && var.express_route_private_peering_enabled ? toset(["express_route"]) : toset([])
  resource_group_name           = var.resource_group_name
  express_route_circuit_name    = azurerm_express_route_circuit.erc["express_route"].name
  peering_type                  = "AzurePrivatePeering"
  primary_peer_address_prefix   = var.express_route_circuit_private_peering_primary_peer_address_prefix

germanium-git/terraform_azure

resource "azurerm_express_route_circuit_peering" "example" {
  peering_type                  = "AzurePrivatePeering"
  # Acceptable values include AzurePrivatePeering, AzurePublicPeering and MicrosoftPeering
  express_route_circuit_name    = var.express_route_circuit_name
  resource_group_name           = var.rg_name
  peer_asn                      = var.peer_asn

mb290/terraform-azure-palo-hub

resource "azurerm_express_route_circuit_peering" "local" {
  count                         = var.configure_er_private_peering ? 1 : 0
  peering_type                  = "AzurePrivatePeering"
  express_route_circuit_name    = azurerm_express_route_circuit.local.name
  resource_group_name           = var.resource_group_name
  peer_asn                      = var.express_route_definitions.azure_private_peering.peer_asn

Parameters

• azure_asn optional computed - number
• express_route_circuit_name required - string
• id optional computed - string
• peer_asn optional computed - number
• peering_type required - string
• primary_azure_port optional computed - string
• primary_peer_address_prefix required - string
• resource_group_name required - string
• route_filter_id optional - string
• secondary_azure_port optional computed - string
• secondary_peer_address_prefix required - string
• shared_key optional - string
• vlan_id required - number
• ipv6 list block
  • primary_peer_address_prefix required - string
  • route_filter_id optional - string
  • secondary_peer_address_prefix required - string
  • microsoft_peering list block
    • advertised_public_prefixes optional - list of string
    • customer_asn optional - number
    • routing_registry_name optional - string
• microsoft_peering_config list block
  • advertised_public_prefixes required - list of string
  • customer_asn optional - number
  • routing_registry_name optional - string
• timeouts single block
  • create optional - string
  • delete optional - string
  • read optional - string
  • update optional - string

Explanation in Terraform Registry

Manages an ExpressRoute Circuit Peering.

Tips: Best Practices for The Other Azure Network Resources

In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

azurerm_network_security_group

Ensure to disable RDP port from the Internet

It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.

azurerm_network_security_rule

Ensure to set a more restrictive CIDR range for ingress from the internet

It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.

azurerm_network_watcher_flow_log

Ensure to enable Retention policy for flow logs and set it to enough duration

It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.