Azure Network Table
This page shows how to write Terraform and Azure Resource Manager for Network Table and write them securely.
azurerm_route_table (Terraform)
The Table in Network can be configured in Terraform with the resource name azurerm_route_table
. The following sections describe 7 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "azurerm_route_table" "DMZ1RT" {
name = "DMZ1RT"
location = azurerm_resource_group.rg.location
resource_group_name = azurerm_resource_group.rg.name
route {
resource "azurerm_route_table" "makissubnet-udr" {
name = "makissubnet-udr"
location = "europe"
resource_group_name = "my-rg"
disable_bgp_route_propagation = false
route {
resource "azurerm_route_table" "PAN_FW_RT_Trust" {
name = var.routeTableTrust
location = data.terraform_remote_state.vnet.outputs.resource_group_location
resource_group_name = data.terraform_remote_state.vnet.outputs.resource_group_name
route {
resource "azurerm_route_table" "dmz" {
name = "DMZRouteTable"
location = azurerm_resource_group.resource_group.location
resource_group_name = azurerm_resource_group.resource_group.name
route = [
{
resource "azurerm_route_table" "DMZ1RT" {
name = "DMZ1RT"
location = azurerm_resource_group.rg.location
resource_group_name = azurerm_resource_group.rg.name
route {
resource "azurerm_route_table" "sandbox1subnet1rt" {
name = "sandbox1subnet1-routetable"
location = azurerm_resource_group.transithub.location
resource_group_name = azurerm_resource_group.transithub.name
route {
resource "azurerm_route_table" "rtFrontend" {
name = "rtFrontend"
location = var.loc
resource_group_name = var.rgfirewall
disable_bgp_route_propagation = true
/*
Parameters
-
disable_bgp_route_propagation
optional - bool -
id
optional computed - string -
location
required - string -
name
required - string -
resource_group_name
required - string -
route
optional computed - list of object-
address_prefix
- string -
name
- string -
next_hop_in_ip_address
- string -
next_hop_type
- string
-
-
subnets
optional computed - set of string -
tags
optional - map from string to string -
timeouts
single block
Explanation in Terraform Registry
Manages a Route Table
NOTE on Route Tables and Routes: Terraform currently provides both a standalone Route resource, and allows for Routes to be defined in-line within the Route Table resource. At this time you cannot use a Route Table with in-line Routes in conjunction with any Route resources. Doing so will cause a conflict of Route configurations and will overwrite Routes.
Tips: Best Practices for The Other Azure Network Resources
In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
azurerm_network_security_group
Ensure to disable RDP port from the Internet
It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.
azurerm_network_security_rule
Ensure to set a more restrictive CIDR range for ingress from the internet
It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.
azurerm_network_watcher_flow_log
Ensure to enable Retention policy for flow logs and set it to enough duration
It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.
Microsoft.Network/routeTables (Azure Resource Manager)
The routeTables in Microsoft.Network can be configured in Azure Resource Manager with the resource name Microsoft.Network/routeTables
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
"type": "Microsoft.Network/routeTables",
"apiVersion": "2019-06-01",
"name": "[parameters('route_table_name')]",
"location": "[parameters('location')]",
"properties": {
"disableBgpRoutePropagation": false,
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"fw-internal-ip":{
"type": "Microsoft.Network/routeTables",
"location": "[resourceGroup().location]",
"properties": {
"disableBgpRoutePropagation": false,
"routes": [
{
"type": "Microsoft.Network/routeTables",
"location": "[resourceGroup().location]",
"properties": {
"disableBgpRoutePropagation": false,
"routes": [
{
"type": "Microsoft.Network/routeTables",
"location": "[resourceGroup().location]",
"properties": {
"disableBgpRoutePropagation": false,
"routes": [
{
"type": "Microsoft.Network/routeTables",
"apiVersion": "2019-11-01",
"name": "[parameters('routeTables')]",
"location": "westeurope",
"tags": {
"ManagedBy": "v-ololim"
"type": "Microsoft.Network/routeTables",
"apiVersion": "2018-12-01",
"name": "[variables('RT-rda-name')]",
"location": "[parameters('location')]",
"tags": {
"Project": "GRS"
"type": "Microsoft.Network/routeTables",
"name": "[parameters('GatewayRouteTableName')]",
"location": "[parameters('location')]",
"tags": {
"displayName": "Route Table - Gateway Subnet"
},
"type": "Microsoft.Network/routeTables",
"name": "[parameters('GatewayRouteTableName')]",
"location": "[parameters('location')]",
"tags": {
"displayName": "Route Table - Gateway Subnet"
},
"type": "Microsoft.Network/routeTables",
"apiVersion": "2018-12-01",
"name": "[variables('RT-rda-name')]",
"location": "[parameters('location')]",
"tags": {
"Project": "GRS"
Parameters
name
required - stringtype
required - stringapiVersion
required - stringlocation
required - stringResource location.
tags
optional - stringResource tags.
properties
requiredroutes
optional arrayproperties
optionaladdressPrefix
required - stringThe destination CIDR to which the route applies.
nextHopType
required - stringThe type of Azure hop the packet should be sent to.
nextHopIpAddress
optional - stringThe IP address packets should be forwarded to. Next hop values are only allowed in routes where the next hop type is VirtualAppliance.
hasBgpOverride
optional - booleanA value indicating whether this route overrides overlapping BGP routes regardless of LPM.
name
optional - stringThe name of the resource that is unique within a resource group. This name can be used to access the resource.
disableBgpRoutePropagation
optional - booleanWhether to disable the routes learned by BGP on that route table. True means disable.
Frequently asked questions
What is Azure Network Table?
Azure Network Table is a resource for Network of Microsoft Azure. Settings can be wrote in Terraform.
Where can I find the example code for the Azure Network Table?
For Terraform, the rdarst/Terraform-CheckPoint_Azure-ScaleSet_R80.40, gertzakis/azure-udr-generator and hashicorp/workshop-consul-terraform-sync source code examples are useful. See the Terraform Example section for further details.
For Azure Resource Manager, the suprithakashyap/Azure-devops, tgiorgio/eoe-grs and cbellee/azure-iac-examples source code examples are useful. See the Azure Resource Manager Example section for further details.