The following arguments are supported:
Please Note:
Availability Zones are only supported in several regions at this time.
An ip_configuration block supports the following:
NOTE
The Subnet used for the Firewall must have the name AzureFirewallSubnet and the subnet mask must be at least a /26.
NOTE
At least one and only one ip_configuration block may contain a subnet_id.
NOTE
When multiple ip_configuration blocks with public_ip_address_id are configured, terraform apply will raise an error when one or some of these ip_configuration blocks are removed. because the public_ip_address_id is still used by the firewall resource until the firewall resource is updated. and the destruction of azurerm_public_ip happens before the update of firewall by default. to destroy of azurerm_public_ip will cause the error. The workaround is to set create_before_destroy=true to the azurerm_public_ip resource lifecycle block. See more detail: destroying.md#create-before-destroy
NOTE
The Public IP must have a Static allocation and Standard SKU.
A management_ip_configuration block supports the following:
NOTE
The Management Subnet used for the Firewall must have the name AzureFirewallManagementSubnet and the subnet mask must be at least a /26.
NOTE
The Public IP must have a Static allocation and Standard SKU.
A virtual_hub block supports the following:
resource "azurerm_resource_group" "example" {
name = "example-resources"
location = "West Europe"
}
resource "azurerm_virtual_network" "example" {
name = "testvnet"
address_space = ["10.0.0.0/16"]
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
}
resource "azurerm_subnet" "example" {
name = "AzureFirewallSubnet"
resource_group_name = azurerm_resource_group.example.name
virtual_network_name = azurerm_virtual_network.example.name
address_prefixes = ["10.0.1.0/24"]
}
resource "azurerm_public_ip" "example" {
name = "testpip"
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
allocation_method = "Static"
sku = "Standard"
}
resource "azurerm_firewall" "example" {
name = "testfirewall"
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
sku_name = "AZFW_VNet"
sku_tier = "Standard"
ip_configuration {
name = "configuration"
subnet_id = azurerm_subnet.example.id
public_ip_address_id = azurerm_public_ip.example.id
}
}
az network firewall create --name
--resource-group
[--allow-active-ftp {0, 1, f, false, n, no, t, true, y, yes}]
[--conf-name]
[--count]
[--dns-servers]
[--enable-dns-proxy {0, 1, f, false, n, no, t, true, y, yes}]
[--enable-fat-flow-logging {0, 1, f, false, n, no, t, true, y, yes}]
[--enable-udp-log-optimization {0, 1, f, false, n, no, t, true, y, yes}]
[--firewall-policy]
[--location]
[--m-conf-name]
[--m-public-ip]
[--no-wait {0, 1, f, false, n, no, t, true, y, yes}]
[--private-ranges]
[--public-ip]
[--route-server-id]
[--sku {AZFW_Hub, AZFW_VNet}]
[--tags]
[--threat-intel-mode {Alert, Deny, Off}]
[--tier {Basic, Premium, Standard}]
[--vhub]
[--vnet-name]
[--zones]
az network firewall create -g MyResourceGroup -n MyFirewall --private-ranges 10.0.0.0 10.0.0.0/16 IANAPrivateRanges
Categorized by Availability, Security & Compliance and Cost
.svg){kind=icon}
