Microsoft.Network azureFirewalls

The azureFirewalls resource type can be deployed to: Resource groups.

To learn about resource group deployments, see Bicep or ARM template.

Template format

To create a Microsoft.Network/azureFirewalls resource, add the following Bicep or JSON to your template.

resource symbolicname 'Microsoft.Network/azureFirewalls@2021-02-01' = {
  name: 'string'
  location: 'string'
  tags: {
    tagName1: 'tagValue1'
    tagName2: 'tagValue2'
  }
  properties: {
    additionalProperties: {}
    applicationRuleCollections: [
      {
        id: 'string'
        name: 'string'
        properties: {
          action: {
            type: 'string'
          }
          priority: int
          rules: [
            {
              description: 'string'
              fqdnTags: [ 'string' ]
              name: 'string'
              protocols: [
                {
                  port: int
                  protocolType: 'string'
                }
              ]
              sourceAddresses: [ 'string' ]
              sourceIpGroups: [ 'string' ]
              targetFqdns: [ 'string' ]
            }
          ]
        }
      }
    ]
    firewallPolicy: {
      id: 'string'
    }
    hubIPAddresses: {
      privateIPAddress: 'string'
      publicIPs: {
        addresses: [
          {
            address: 'string'
          }
        ]
        count: int
      }
    }
    ipConfigurations: [
      {
        id: 'string'
        name: 'string'
        properties: {
          publicIPAddress: {
            id: 'string'
          }
          subnet: {
            id: 'string'
          }
        }
      }
    ]
    managementIpConfiguration: {
      id: 'string'
      name: 'string'
      properties: {
        publicIPAddress: {
          id: 'string'
        }
        subnet: {
          id: 'string'
        }
      }
    }
    natRuleCollections: [
      {
        id: 'string'
        name: 'string'
        properties: {
          action: {
            type: 'string'
          }
          priority: int
          rules: [
            {
              description: 'string'
              destinationAddresses: [ 'string' ]
              destinationPorts: [ 'string' ]
              name: 'string'
              protocols: [ 'string' ]
              sourceAddresses: [ 'string' ]
              sourceIpGroups: [ 'string' ]
              translatedAddress: 'string'
              translatedFqdn: 'string'
              translatedPort: 'string'
            }
          ]
        }
      }
    ]
    networkRuleCollections: [
      {
        id: 'string'
        name: 'string'
        properties: {
          action: {
            type: 'string'
          }
          priority: int
          rules: [
            {
              description: 'string'
              destinationAddresses: [ 'string' ]
              destinationFqdns: [ 'string' ]
              destinationIpGroups: [ 'string' ]
              destinationPorts: [ 'string' ]
              name: 'string'
              protocols: [ 'string' ]
              sourceAddresses: [ 'string' ]
              sourceIpGroups: [ 'string' ]
            }
          ]
        }
      }
    ]
    sku: {
      name: 'string'
      tier: 'string'
    }
    threatIntelMode: 'string'
    virtualHub: {
      id: 'string'
    }
  }
  zones: [ 'string' ]
}

Property values

azureFirewalls

Name Description Value
type The resource type

For Bicep, set this value in the resource declaration.
'Microsoft.Network/azureFirewalls'
apiVersion The resource api version

For Bicep, set this value in the resource declaration.
'2021-02-01'
name The resource name string (required)
location Resource location. string
tags Resource tags. Dictionary of tag names and values. See Tags in templates
properties Properties of the Azure Firewall. AzureFirewallPropertiesFormat
zones A list of availability zones denoting where the resource needs to come from. string[]

AzureFirewallPropertiesFormat

Name Description Value
additionalProperties The additional properties of azure firewall. object
applicationRuleCollections Collection of application rule collections used by Azure Firewall. AzureFirewallApplicationRuleCollection[]
firewallPolicy Reference to another subresource. SubResource
hubIPAddresses IP addresses associated with azure firewall. HubIPAddresses
ipConfigurations IP configuration of the Azure Firewall resource. AzureFirewallIPConfiguration[]
managementIpConfiguration IP configuration of an Azure Firewall. AzureFirewallIPConfiguration
natRuleCollections Collection of NAT rule collections used by Azure Firewall. AzureFirewallNatRuleCollection[]
networkRuleCollections Collection of network rule collections used by Azure Firewall. AzureFirewallNetworkRuleCollection[]
sku SKU of an Azure Firewall. AzureFirewallSku
threatIntelMode The operation mode for Threat Intel. 'Alert'
'Deny'
'Off'
virtualHub Reference to another subresource. SubResource

AzureFirewallApplicationRuleCollection

Name Description Value
id Resource ID. string
name The name of the resource that is unique within the Azure firewall. This name can be used to access the resource. string
properties Properties of the application rule collection. AzureFirewallApplicationRuleCollectionPropertiesFormat

AzureFirewallApplicationRuleCollectionPropertiesFormat

Name Description Value
action Properties of the AzureFirewallRCAction. AzureFirewallRCAction
priority Priority of the application rule collection resource. int
rules Collection of rules used by a application rule collection. AzureFirewallApplicationRule[]

AzureFirewallRCAction

Name Description Value
type The action type of a rule collection. 'Allow'
'Deny'

AzureFirewallApplicationRule

Name Description Value
description Description of the rule. string
fqdnTags List of FQDN Tags for this rule. string[]
name Name of the application rule. string
protocols Array of ApplicationRuleProtocols. AzureFirewallApplicationRuleProtocol[]
sourceAddresses List of source IP addresses for this rule. string[]
sourceIpGroups List of source IpGroups for this rule. string[]
targetFqdns List of FQDNs for this rule. string[]

AzureFirewallApplicationRuleProtocol

Name Description Value
port Port number for the protocol, cannot be greater than 64000. This field is optional. int
protocolType The protocol type of a Application Rule resource. 'Http'
'Https'
'Mssql'

SubResource

Name Description Value
id Resource ID. string

HubIPAddresses

Name Description Value
privateIPAddress Private IP Address associated with azure firewall. string
publicIPs Public IP addresses associated with azure firewall. HubPublicIPAddresses

HubPublicIPAddresses

Name Description Value
addresses The list of Public IP addresses associated with azure firewall or IP addresses to be retained. AzureFirewallPublicIPAddress[]
count The number of Public IP addresses associated with azure firewall. int

AzureFirewallPublicIPAddress

Name Description Value
address Public IP Address value. string

AzureFirewallIPConfiguration

Name Description Value
id Resource ID. string
name Name of the resource that is unique within a resource group. This name can be used to access the resource. string
properties Properties of IP configuration of an Azure Firewall. AzureFirewallIPConfigurationPropertiesFormat

AzureFirewallIPConfigurationPropertiesFormat

Name Description Value
publicIPAddress Reference to another subresource. SubResource
subnet Reference to another subresource. SubResource

AzureFirewallNatRuleCollection

Name Description Value
id Resource ID. string
name The name of the resource that is unique within the Azure firewall. This name can be used to access the resource. string
properties Properties of the NAT rule collection. AzureFirewallNatRuleCollectionProperties

AzureFirewallNatRuleCollectionProperties

Name Description Value
action AzureFirewall NAT Rule Collection Action. AzureFirewallNatRCAction
priority Priority of the NAT rule collection resource. int
rules Collection of rules used by a NAT rule collection. AzureFirewallNatRule[]

AzureFirewallNatRCAction

Name Description Value
type The action type of a NAT rule collection. 'Dnat'
'Snat'

AzureFirewallNatRule

Name Description Value
description Description of the rule. string
destinationAddresses List of destination IP addresses for this rule. Supports IP ranges, prefixes, and service tags. string[]
destinationPorts List of destination ports. string[]
name Name of the NAT rule. string
protocols Array of AzureFirewallNetworkRuleProtocols applicable to this NAT rule. String array containing any of:
'Any'
'ICMP'
'TCP'
'UDP'
sourceAddresses List of source IP addresses for this rule. string[]
sourceIpGroups List of source IpGroups for this rule. string[]
translatedAddress The translated address for this NAT rule. string
translatedFqdn The translated FQDN for this NAT rule. string
translatedPort The translated port for this NAT rule. string

AzureFirewallNetworkRuleCollection

Name Description Value
id Resource ID. string
name The name of the resource that is unique within the Azure firewall. This name can be used to access the resource. string
properties Properties of the network rule collection. AzureFirewallNetworkRuleCollectionPropertiesFormat

AzureFirewallNetworkRuleCollectionPropertiesFormat

Name Description Value
action Properties of the AzureFirewallRCAction. AzureFirewallRCAction
priority Priority of the network rule collection resource. int
rules Collection of rules used by a network rule collection. AzureFirewallNetworkRule[]

AzureFirewallNetworkRule

Name Description Value
description Description of the rule. string
destinationAddresses List of destination IP addresses. string[]
destinationFqdns List of destination FQDNs. string[]
destinationIpGroups List of destination IpGroups for this rule. string[]
destinationPorts List of destination ports. string[]
name Name of the network rule. string
protocols Array of AzureFirewallNetworkRuleProtocols. String array containing any of:
'Any'
'ICMP'
'TCP'
'UDP'
sourceAddresses List of source IP addresses for this rule. string[]
sourceIpGroups List of source IpGroups for this rule. string[]

AzureFirewallSku

Name Description Value
name Name of an Azure Firewall SKU. 'AZFW_Hub'
'AZFW_VNet'
tier Tier of an Azure Firewall. 'Premium'
'Standard'

Quickstart templates

The following quickstart templates deploy this resource type.

Template Description
Use Azure Firewall as a DNS Proxy in a Hub & Spoke topology

Deploy to Azure
This sample show how to deploy a hub-spoke topology in Azure using the Azure Firewall. The hub virtual network acts as a central point of connectivity to many spoke virtual networks that are connected to hub virtual network via virtual network peering.
Create a Firewall and FirewallPolicy with Rules and Ipgroups

Deploy to Azure
This template deploys an Azure Firewall with Firewall Policy (including multiple application and network rules) referencing IP Groups in application and network rules.
Create a Firewall with FirewallPolicy and IpGroups

Deploy to Azure
This template creates an Azure Firewall with FirewalllPolicy referencing Network Rules with IpGroups. Also, includes a Linux Jumpbox vm setup
Create an Azure Firewall with IpGroups

Deploy to Azure
This template creates an Azure Firewall with Application and Network Rules referring to IP Groups. Also, includes a Linux Jumpbox vm setup
Create an Azure Firewall with Availability Zones

Deploy to Azure
This template creates an Azure Firewall with Availability Zones and any number of Public IPs in a virtual network and sets up 1 sample application rule and 1 sample network rule
Create an Azure Firewall sandbox with forced tunneling

Deploy to Azure
This template creates an Azure Firewall sandbox (Linux) with one firewall force tunneled through another firewall in a peered VNET
Testing environment for Azure Firewall Premium

Deploy to Azure
This template creates an Azure Firewall Premium and Firewall Policy with premium features such as Intrusion Inspection Detection (IDPS), TLS inspection and Web Category filtering
Create a sandbox setup of Azure Firewall with Linux VMs

Deploy to Azure
This template creates a virtual network with 3 subnets (server subnet, jumpbox subet and AzureFirewall subnet), a jumpbox VM with public IP, A server VM, UDR route to point to Azure Firewall for the Server Subnet and an Azure Firewall with 1 or more Public IP addresses, 1 sample application rule, 1 sample network rule and default private ranges
Create a sandbox setup with Firewall Policy

Deploy to Azure
This template creates a virtual network with 3 subnets (server subnet, jumpbox subet and AzureFirewall subnet), a jumpbox VM with public IP, A server VM, UDR route to point to Azure Firewall for the Server Subnet and an Azure Firewall with 1 or more Public IP addresses. Also creates a Firewall policy with 1 sample application rule, 1 sample network rule and default private ranges
Create a sandbox setup of Azure Firewall with Zones

Deploy to Azure
This template creates a virtual network with three subnets (server subnet, jumpbox subnet, and Azure Firewall subnet), a jumpbox VM with public IP, A server VM, UDR route to point to Azure Firewall for the ServerSubnet,an Azure Firewall with one or more Public IP addresses, one sample application rule, and one sample network rule and Azure Firewall in Availability Zones 1, 2, and 3.
Create an Azure Firewall with multiple IP public addresses

Deploy to Azure
This template creates an Azure Firewall with two public IP addresses and two Windows Server 2019 servers to test.
Secured virtual hubs

Deploy to Azure
This template creates a secured virtual hub using Azure Firewall to secure your cloud network traffic destined to the Internet.