Azure Network Gateway
This page shows how to write Terraform and Azure Resource Manager for Network Gateway and write them securely.
azurerm_express_route_gateway (Terraform)
The Gateway in Network can be configured in Terraform with the resource name azurerm_express_route_gateway
. The following sections describe 10 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "azurerm_express_route_gateway" "er_gateway" {
depends_on = [azurerm_virtual_hub.vwan_hub]
count = var.virtual_hub_config.deploy_er ? 1 : 0
name = azurecaf_naming_convention.er_gateway.0.result
location = var.location
resource "azurerm_express_route_gateway" "this" {
location = var.location
name = var.name
resource_group_name = var.resource_group_name
scale_units = var.scale_units
tags = var.tags
resource "azurerm_express_route_gateway" "er_gateway" {
count = try(var.virtual_hub_config.deploy_er, false) ? 1 : 0
name = azurecaf_name.er_gateway.0.result
location = var.location
resource_group_name = var.resource_group_name
resource "azurerm_express_route_gateway" "er_gateway" {
depends_on = [azurerm_virtual_hub.vwan_hub]
count = var.virtual_hub_config.deploy_er ? 1 : 0
name = azurecaf_naming_convention.er_gateway.0.result
location = var.location
resource "azurerm_express_route_gateway" "er_gateway" {
count = try(var.virtual_hub_config.deploy_er, false) ? 1 : 0
name = azurecaf_name.er_gateway.0.result
location = var.location
resource_group_name = var.resource_group_name
resource "azurerm_express_route_gateway" "er_gateway" {
depends_on = [azurerm_virtual_hub.vwan_hub]
count = var.virtual_hub_config.deploy_er ? 1 : 0
name = azurecaf_name.er_gateway.0.result
location = var.location
resource "azurerm_express_route_gateway" "this" {
location = var.location
name = var.name
resource_group_name = var.resource_group_name
scale_units = var.scale_units
tags = var.tags
resource "azurerm_express_route_gateway" "main" {
for_each = { for e in var.er_gateway : e.name => e }
name = each.value.name
resource_group_name = var.resource_group_name
location = var.resource_group_location
virtual_hub_id = azurerm_virtual_hub.main[each.value.region].id
resource "azurerm_express_route_gateway" "er_gateway" {
count = try(var.virtual_hub_config.deploy_er, false) ? 1 : 0
name = azurecaf_name.er_gateway.0.result
location = var.location
resource_group_name = var.resource_group_name
resource "azurerm_express_route_gateway" "er_gateway" {
depends_on = [azurerm_virtual_hub.vwan_hub]
count = var.virtual_hub_config.deploy_er ? 1 : 0
name = azurecaf_naming_convention.er_gateway.0.result
location = var.location
Parameters
-
id
optional computed - string -
location
required - string -
name
required - string -
resource_group_name
required - string -
scale_units
required - number -
tags
optional - map from string to string -
virtual_hub_id
required - string -
timeouts
single block
Explanation in Terraform Registry
Manages an ExpressRoute gateway.
Tips: Best Practices for The Other Azure Network Resources
In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
azurerm_network_security_group
Ensure to disable RDP port from the Internet
It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.
azurerm_network_security_rule
Ensure to set a more restrictive CIDR range for ingress from the internet
It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.
azurerm_network_watcher_flow_log
Ensure to enable Retention policy for flow logs and set it to enough duration
It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.
Microsoft.Network/expressRouteGateways (Azure Resource Manager)
The expressRouteGateways in Microsoft.Network can be configured in Azure Resource Manager with the resource name Microsoft.Network/expressRouteGateways
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
"type": "Microsoft.Network/expressRouteGateways",
"location": "westus",
"properties": {
"virtualHub": {
"id": "/subscriptions/subid/resourceGroups/resourceGroupId/providers/Microsoft.Network/virtualHubs/virtualHubName"
},
"type": "Microsoft.Network/expressRouteGateways",
"location": "westus",
"properties": {
"virtualHub": {
"id": "/subscriptions/subid/resourceGroups/resourceGroupId/providers/Microsoft.Network/virtualHubs/virtualHubName"
},
"type": "Microsoft.Network/expressRouteGateways",
"location": "westus",
"properties": {
"virtualHub": {
"id": "/subscriptions/subid/resourceGroups/resourceGroupId/providers/Microsoft.Network/virtualHubs/virtualHubName"
},
"type": "Microsoft.Network/expressRouteGateways",
"location": "westus",
"properties": {
"virtualHub": {
"id": "/subscriptions/subid/resourceGroups/resourceGroupId/providers/Microsoft.Network/virtualHubs/virtualHubName"
},
"type": "Microsoft.Network/expressRouteGateways",
"location": "westus",
"properties": {
"virtualHub": {
"id": "/subscriptions/subid/resourceGroups/resourceGroupId/providers/Microsoft.Network/virtualHubs/virtualHubName"
},
"type": "Microsoft.Network/expressRouteGateways",
"location": "westus",
"properties": {
"virtualHub": {
"id": "/subscriptions/subid/resourceGroups/resourceGroupId/providers/Microsoft.Network/virtualHubs/virtualHubName"
},
"type": "Microsoft.Network/expressRouteGateways",
"location": "westus",
"properties": {
"virtualHub": {
"id": "/subscriptions/subid/resourceGroups/resourceGroupId/providers/Microsoft.Network/virtualHubs/virtualHubName"
},
"type": "Microsoft.Network/expressRouteGateways",
"location": "westus",
"properties": {
"virtualHub": {
"id": "/subscriptions/subid/resourceGroups/resourceGroupId/providers/Microsoft.Network/virtualHubs/virtualHubName"
},
"type": "Microsoft.Network/expressRouteGateways",
"location": "westus",
"properties": {
"virtualHub": {
"id": "/subscriptions/subid/resourceGroups/resourceGroupId/providers/Microsoft.Network/virtualHubs/virtualHubName"
},
"type": "Microsoft.Network/expressRouteGateways",
"location": "westus",
"properties": {
"virtualHub": {
"id": "/subscriptions/subid/resourceGroups/resourceGroupId/providers/Microsoft.Network/virtualHubs/virtualHubName"
},
Parameters
name
required - stringtype
required - stringapiVersion
required - stringlocation
required - stringResource location.
tags
optional - stringResource tags.
properties
requiredautoScaleConfiguration
optionalbounds
optionalmin
optional - integerMinimum number of scale units deployed for ExpressRoute gateway.
max
optional - integerMaximum number of scale units deployed for ExpressRoute gateway.
virtualHub
requiredid
required - stringResource ID.
Frequently asked questions
What is Azure Network Gateway?
Azure Network Gateway is a resource for Network of Microsoft Azure. Settings can be wrote in Terraform.
Where can I find the example code for the Azure Network Gateway?
For Terraform, the tushar7653/testcaf, kevinhead/azurerm and anmoltoppo/Terraform source code examples are useful. See the Terraform Example section for further details.
For Azure Resource Manager, the sanjaypavan/OldAzure-Rest-API, shawns1/shawns1CI and shawns1/shawns1CI source code examples are useful. See the Azure Resource Manager Example section for further details.