Azure Network Firewall
This page shows how to write Terraform and Azure Resource Manager for Network Firewall and write them securely.
azurerm_firewall (Terraform)
The Firewall in Network can be configured in Terraform with the resource name azurerm_firewall
. The following sections describe 10 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "azurerm_firewall" "standard" {
name = "testfirewall"
location = "eastus"
resource_group_name = azurerm_resource_group.example.name
ip_configuration {
resource "azurerm_firewall" "az_firewall" {
name = var.name
location = var.location
resource_group_name = var.resource_group_name
tags = local.tags
resource "azurerm_firewall" "standard" {
name = "testfirewall"
location = "eastus"
resource_group_name = azurerm_resource_group.example.name
ip_configuration {
resource "azurerm_firewall" "fw" {
name = var.res_fw_name
location = var.res_location
resource_group_name = var.res_fw_rg_name
tags = var.res_tags
resource "azurerm_firewall" "firewall" {
name = var.firewallname
location = var.location
resource_group_name = var.resourcegroup_name
ip_configuration {
resource "azurerm_firewall" "fw" {
name = var.fw_name
location = var.location
resource_group_name = var.resource_group
ip_configuration {
resource "azurerm_firewall" "example" {
name = "testfirewall"
location = var.location
resource_group_name = var.resourceGroupName
ip_configuration {
resource "azurerm_firewall" "firewall" {
name = local.firewall_name
location = azurerm_resource_group.hub.location
resource_group_name = azurerm_resource_group.hub.name
ip_configuration {
resource "azurerm_firewall" "vnet-hub-firewall" {
name = "hubfirewall"
location = data.azurerm_resource_group.main_rg.location
resource_group_name = data.azurerm_resource_group.main_rg.name
ip_configuration {
resource "azurerm_firewall" "azfwall" {
name = "azfwall"
location = azurerm_resource_group.spoke2-vnet-rg.location
resource_group_name = azurerm_resource_group.spoke2-vnet-rg.name
ip_configuration {
Parameters
-
dns_servers
optional - list of string -
firewall_policy_id
optional - string -
id
optional computed - string -
location
required - string -
name
required - string -
private_ip_ranges
optional - set of string -
resource_group_name
required - string -
sku_name
optional computed - string -
sku_tier
optional computed - string -
tags
optional - map from string to string -
threat_intel_mode
optional - string -
zones
optional - list of string -
ip_configuration
list block-
name
required - string -
private_ip_address
optional computed - string -
public_ip_address_id
required - string -
subnet_id
optional - string
-
-
management_ip_configuration
list block-
name
required - string -
private_ip_address
optional computed - string -
public_ip_address_id
required - string -
subnet_id
required - string
-
-
timeouts
single block -
virtual_hub
list block-
private_ip_address
optional computed - string -
public_ip_addresses
optional computed - list of string -
public_ip_count
optional - number -
virtual_hub_id
required - string
-
Explanation in Terraform Registry
Manages an Azure Firewall.
Tips: Best Practices for The Other Azure Network Resources
In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
azurerm_network_security_group
Ensure to disable RDP port from the Internet
It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.
azurerm_network_security_rule
Ensure to set a more restrictive CIDR range for ingress from the internet
It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.
azurerm_network_watcher_flow_log
Ensure to enable Retention policy for flow logs and set it to enough duration
It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.
Microsoft.Network/azureFirewalls (Azure Resource Manager)
The azureFirewalls in Microsoft.Network can be configured in Azure Resource Manager with the resource name Microsoft.Network/azureFirewalls
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
"Type": "Microsoft.Network/azureFirewalls",
"ResourceType": "Microsoft.Network/azureFirewalls",
"ExtensionResourceType": null,
"Sku": null,
"SubscriptionId": "00000000-0000-0000-0000-000000000000"
},
"type": "Microsoft.Network/azureFirewalls",
"apiVersion": "2020-08-01",
"location": "West Europe",
"properties": {
"networkRuleCollections": [
{
"type": "Microsoft.Network/azureFirewalls",
"apiVersion": "2020-08-01",
"location": "West Europe",
"properties": {
"networkRuleCollections": [
{
"type": "Microsoft.Network/azureFirewalls"
}
"type": "Microsoft.Network/azureFirewalls",
"name": "[parameters('firewallName')]",
"location": "[parameters('location')]",
"zones": "[if(equals(length(parameters('availabilityZones')), 0), json('null'), parameters('availabilityZones'))]",
"dependsOn": [
"[resourceId('Microsoft.Network/publicIPAddresses/', parameters('publicIPName'))]"
"type": "Microsoft.Network/azureFirewalls",
"name": "[parameters('name')]",
"location": "[parameters('location')]",
"properties": {
"virtualHub": {
"id": "[parameters('vwan_id')]"
"type": "Microsoft.Network/azureFirewalls",
"apiVersion": "2019-04-01",
"location": "string",
"tags": {},
"properties": {
"applicationRuleCollections": [
"type": "Microsoft.Network/azureFirewalls",
"name": "[parameters('azureFirewallName')]",
"location": "[resourceGroup().location]",
"dependsOn": [
"[resourceId('Microsoft.Network/publicIPAddresses', variables('azureFirewallPipName'))]"
],
"type": "Microsoft.Network/azureFirewalls",
"name": "[variables('firewallName')]",
"location": "[resourceGroup().location]",
"dependsOn": [
"[concat('Microsoft.Network/virtualNetworks/', parameters('vnet_name'))]",
"[concat('Microsoft.Network/publicIPAddresses/', variables('FwPublicIPName'))]"
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "0.1.0.0",
"parameters": {
"FirewallName": {
Parameters
name
required - stringtype
required - stringapiVersion
required - stringlocation
required - stringResource location.
tags
optional - stringResource tags.
properties
requiredapplicationRuleCollections
optional arrayproperties
optionalpriority
optional - integerPriority of the application rule collection resource.
action
optionaltype
optional - stringThe type of action.
rules
optional arrayname
optional - stringName of the application rule.
description
optional - stringDescription of the rule.
sourceAddresses
optional - arrayList of source IP addresses for this rule.
protocols
optional arrayprotocolType
optional - stringProtocol type.
port
optional - integerPort number for the protocol, cannot be greater than 64000. This field is optional.
targetFqdns
optional - arrayList of FQDNs for this rule.
fqdnTags
optional - arrayList of FQDN Tags for this rule.
sourceIpGroups
optional - arrayList of source IpGroups for this rule.
name
optional - stringThe name of the resource that is unique within the Azure firewall. This name can be used to access the resource.
natRuleCollections
optional arrayproperties
optionalpriority
optional - integerPriority of the NAT rule collection resource.
action
optionaltype
optional - stringThe type of action.
rules
optional arrayname
optional - stringName of the NAT rule.
description
optional - stringDescription of the rule.
sourceAddresses
optional - arrayList of source IP addresses for this rule.
destinationAddresses
optional - arrayList of destination IP addresses for this rule. Supports IP ranges, prefixes, and service tags.
destinationPorts
optional - arrayList of destination ports.
protocols
optional - arrayArray of AzureFirewallNetworkRuleProtocols applicable to this NAT rule.
translatedAddress
optional - stringThe translated address for this NAT rule.
translatedPort
optional - stringThe translated port for this NAT rule.
translatedFqdn
optional - stringThe translated FQDN for this NAT rule.
sourceIpGroups
optional - arrayList of source IpGroups for this rule.
name
optional - stringThe name of the resource that is unique within the Azure firewall. This name can be used to access the resource.
networkRuleCollections
optional arrayproperties
optionalpriority
optional - integerPriority of the network rule collection resource.
action
optionaltype
optional - stringThe type of action.
rules
optional arrayname
optional - stringName of the network rule.
description
optional - stringDescription of the rule.
protocols
optional - arrayArray of AzureFirewallNetworkRuleProtocols.
sourceAddresses
optional - arrayList of source IP addresses for this rule.
destinationAddresses
optional - arrayList of destination IP addresses.
destinationPorts
optional - arrayList of destination ports.
destinationFqdns
optional - arrayList of destination FQDNs.
sourceIpGroups
optional - arrayList of source IpGroups for this rule.
destinationIpGroups
optional - arrayList of destination IpGroups for this rule.
name
optional - stringThe name of the resource that is unique within the Azure firewall. This name can be used to access the resource.
ipConfigurations
optional arrayproperties
optionalsubnet
optionalid
required - stringResource ID.
publicIPAddress
optionalid
required - stringResource ID.
name
optional - stringName of the resource that is unique within a resource group. This name can be used to access the resource.
managementIpConfiguration
optionalproperties
optionalsubnet
optionalid
required - stringResource ID.
publicIPAddress
optionalid
required - stringResource ID.
name
optional - stringName of the resource that is unique within a resource group. This name can be used to access the resource.
threatIntelMode
optional - stringThe operation mode for Threat Intelligence.
virtualHub
optionalid
required - stringResource ID.
firewallPolicy
optionalid
required - stringResource ID.
hubIPAddresses
optionalpublicIPs
optionaladdresses
optional arrayaddress
optional - stringPublic IP Address value.
count
optional - integerThe number of Public IP addresses associated with azure firewall.
privateIPAddress
optional - stringPrivate IP Address associated with azure firewall.
sku
optionalname
optional - stringName of an Azure Firewall SKU.
tier
optional - stringTier of an Azure Firewall.
additionalProperties
optional - stringThe additional properties used to further config this azure firewall.
zones
optional - arrayA list of availability zones denoting where the resource needs to come from.
Frequently asked questions
What is Azure Network Firewall?
Azure Network Firewall is a resource for Network of Microsoft Azure. Settings can be wrote in Terraform.
Where can I find the example code for the Azure Network Firewall?
For Terraform, the gilyas/infracost, BrettOJ/azuread_adfs_jwt_token and infracost/infracost source code examples are useful. See the Terraform Example section for further details.
For Azure Resource Manager, the Azure/PSRule.Rules.Azure, snyk/snyk and snyk/snyk source code examples are useful. See the Azure Resource Manager Example section for further details.