Microsoft.Network firewallPolicies 2021-02-01

Bicep resource definition

The firewallPolicies resource type can be deployed with operations that target:

• Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Network/firewallPolicies resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.Network/firewallPolicies@2021-02-01' = {
  identity: {
    type: 'string'
    userAssignedIdentities: {
      {customized property}: {}
    }
  }
  location: 'string'
  name: 'string'
  properties: {
    basePolicy: {
      id: 'string'
    }
    dnsSettings: {
      enableProxy: bool
      requireProxyForNetworkRules: bool
      servers: [
        'string'
      ]
    }
    insights: {
      isEnabled: bool
      logAnalyticsResources: {
        defaultWorkspaceId: {
          id: 'string'
        }
        workspaces: [
          {
            region: 'string'
            workspaceId: {
              id: 'string'
            }
          }
        ]
      }
      retentionDays: int
    }
    intrusionDetection: {
      configuration: {
        bypassTrafficSettings: [
          {
            description: 'string'
            destinationAddresses: [
              'string'
            ]
            destinationIpGroups: [
              'string'
            ]
            destinationPorts: [
              'string'
            ]
            name: 'string'
            protocol: 'string'
            sourceAddresses: [
              'string'
            ]
            sourceIpGroups: [
              'string'
            ]
          }
        ]
        signatureOverrides: [
          {
            id: 'string'
            mode: 'string'
          }
        ]
      }
      mode: 'string'
    }
    sku: {
      tier: 'string'
    }
    snat: {
      privateRanges: [
        'string'
      ]
    }
    threatIntelMode: 'string'
    threatIntelWhitelist: {
      fqdns: [
        'string'
      ]
      ipAddresses: [
        'string'
      ]
    }
    transportSecurity: {
      certificateAuthority: {
        keyVaultSecretId: 'string'
        name: 'string'
      }
    }
  }
  tags: {
    {customized property}: 'string'
  }
}

Property values

Components1Jq1T4ISchemasManagedserviceidentityPropertiesUserassignedidentitiesAdditionalproperties

DnsSettings

FirewallPolicyCertificateAuthority

FirewallPolicyInsights

FirewallPolicyIntrusionDetection

FirewallPolicyIntrusionDetectionBypassTrafficSpecifications

FirewallPolicyIntrusionDetectionConfiguration

FirewallPolicyIntrusionDetectionSignatureSpecification

FirewallPolicyLogAnalyticsResources

FirewallPolicyLogAnalyticsWorkspace

FirewallPolicyPropertiesFormat

FirewallPolicySku

FirewallPolicySnat

FirewallPolicyThreatIntelWhitelist

FirewallPolicyTransportSecurity

ManagedServiceIdentity

ManagedServiceIdentityUserAssignedIdentities

Microsoft.Network/firewallPolicies

ResourceTags

SubResource

Quickstart samples

The following quickstart samples deploy this resource type.

ARM template resource definition

The firewallPolicies resource type can be deployed with operations that target:

• Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Network/firewallPolicies resource, add the following JSON to your template.

{
  "type": "Microsoft.Network/firewallPolicies",
  "apiVersion": "2021-02-01",
  "name": "string",
  "identity": {
    "type": "string",
    "userAssignedIdentities": {
      "{customized property}": {
      }
    }
  },
  "location": "string",
  "properties": {
    "basePolicy": {
      "id": "string"
    },
    "dnsSettings": {
      "enableProxy": "bool",
      "requireProxyForNetworkRules": "bool",
      "servers": [ "string" ]
    },
    "insights": {
      "isEnabled": "bool",
      "logAnalyticsResources": {
        "defaultWorkspaceId": {
          "id": "string"
        },
        "workspaces": [
          {
            "region": "string",
            "workspaceId": {
              "id": "string"
            }
          }
        ]
      },
      "retentionDays": "int"
    },
    "intrusionDetection": {
      "configuration": {
        "bypassTrafficSettings": [
          {
            "description": "string",
            "destinationAddresses": [ "string" ],
            "destinationIpGroups": [ "string" ],
            "destinationPorts": [ "string" ],
            "name": "string",
            "protocol": "string",
            "sourceAddresses": [ "string" ],
            "sourceIpGroups": [ "string" ]
          }
        ],
        "signatureOverrides": [
          {
            "id": "string",
            "mode": "string"
          }
        ]
      },
      "mode": "string"
    },
    "sku": {
      "tier": "string"
    },
    "snat": {
      "privateRanges": [ "string" ]
    },
    "threatIntelMode": "string",
    "threatIntelWhitelist": {
      "fqdns": [ "string" ],
      "ipAddresses": [ "string" ]
    },
    "transportSecurity": {
      "certificateAuthority": {
        "keyVaultSecretId": "string",
        "name": "string"
      }
    }
  },
  "tags": {
    "{customized property}": "string"
  }
}

Property values

Components1Jq1T4ISchemasManagedserviceidentityPropertiesUserassignedidentitiesAdditionalproperties

DnsSettings

FirewallPolicyCertificateAuthority

FirewallPolicyInsights

FirewallPolicyIntrusionDetection

FirewallPolicyIntrusionDetectionBypassTrafficSpecifications

FirewallPolicyIntrusionDetectionConfiguration

FirewallPolicyIntrusionDetectionSignatureSpecification

FirewallPolicyLogAnalyticsResources

FirewallPolicyLogAnalyticsWorkspace

FirewallPolicyPropertiesFormat

FirewallPolicySku

FirewallPolicySnat

FirewallPolicyThreatIntelWhitelist

FirewallPolicyTransportSecurity

ManagedServiceIdentity

ManagedServiceIdentityUserAssignedIdentities

Microsoft.Network/firewallPolicies

ResourceTags

SubResource

Quickstart templates

The following quickstart templates deploy this resource type.

Template	Description
Create a Firewall and FirewallPolicy with Rules and Ipgroups	This template deploys an Azure Firewall with Firewall Policy (including multiple application and network rules) referencing IP Groups in application and network rules.
Create a Firewall with FirewallPolicy and IpGroups	This template creates an Azure Firewall with FirewalllPolicy referencing Network Rules with IpGroups. Also, includes a Linux Jumpbox vm setup
Create a Firewall, FirewallPolicy with Explicit Proxy	This template creates an Azure Firewall, FirewalllPolicy with Explicit Proxy and Network Rules with IpGroups. Also, includes a Linux Jumpbox vm setup
Create a sandbox setup with Firewall Policy	This template creates a virtual network with 3 subnets (server subnet, jumpbox subet and AzureFirewall subnet), a jumpbox VM with public IP, A server VM, UDR route to point to Azure Firewall for the Server Subnet and an Azure Firewall with 1 or more Public IP addresses. Also creates a Firewall policy with 1 sample application rule, 1 sample network rule and default private ranges
Secured virtual hubs	This template creates a secured virtual hub using Azure Firewall to secure your cloud network traffic destined to the Internet.
SharePoint Subscription / 2019 / 2016 fully configured	Create a DC, a SQL Server 2022, and from 1 to 5 server(s) hosting a SharePoint Subscription / 2019 / 2016 farm with an extensive configuration, including trusted authentication, user profiles with personal sites, an OAuth trust (using a certificate), a dedicated IIS site for hosting high-trust add-ins, etc... The latest version of key softwares (including Fiddler, vscode, np++, 7zip, ULS Viewer) is installed. SharePoint machines have additional fine-tuning to make them immediately usable (remote administration tools, custom policies for Edge and Chrome, shortcuts, etc...).
Testing environment for Azure Firewall Premium	This template creates an Azure Firewall Premium and Firewall Policy with premium features such as Intrusion Inspection Detection (IDPS), TLS inspection and Web Category filtering
Use Azure Firewall as a DNS Proxy in a Hub & Spoke topology	This sample show how to deploy a hub-spoke topology in Azure using the Azure Firewall. The hub virtual network acts as a central point of connectivity to many spoke virtual networks that are connected to hub virtual network via virtual network peering.

Terraform (AzAPI provider) resource definition

The firewallPolicies resource type can be deployed with operations that target:

• Resource groups

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Network/firewallPolicies resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.Network/firewallPolicies@2021-02-01"
  name = "string"
  identity = {
    type = "string"
    userAssignedIdentities = {
      {customized property} = {
      }
    }
  }
  location = "string"
  body = jsonencode({
    properties = {
      basePolicy = {
        id = "string"
      }
      dnsSettings = {
        enableProxy = bool
        requireProxyForNetworkRules = bool
        servers = [
          "string"
        ]
      }
      insights = {
        isEnabled = bool
        logAnalyticsResources = {
          defaultWorkspaceId = {
            id = "string"
          }
          workspaces = [
            {
              region = "string"
              workspaceId = {
                id = "string"
              }
            }
          ]
        }
        retentionDays = int
      }
      intrusionDetection = {
        configuration = {
          bypassTrafficSettings = [
            {
              description = "string"
              destinationAddresses = [
                "string"
              ]
              destinationIpGroups = [
                "string"
              ]
              destinationPorts = [
                "string"
              ]
              name = "string"
              protocol = "string"
              sourceAddresses = [
                "string"
              ]
              sourceIpGroups = [
                "string"
              ]
            }
          ]
          signatureOverrides = [
            {
              id = "string"
              mode = "string"
            }
          ]
        }
        mode = "string"
      }
      sku = {
        tier = "string"
      }
      snat = {
        privateRanges = [
          "string"
        ]
      }
      threatIntelMode = "string"
      threatIntelWhitelist = {
        fqdns = [
          "string"
        ]
        ipAddresses = [
          "string"
        ]
      }
      transportSecurity = {
        certificateAuthority = {
          keyVaultSecretId = "string"
          name = "string"
        }
      }
    }
  })
  tags = {
    {customized property} = "string"
  }
}

Property values

Components1Jq1T4ISchemasManagedserviceidentityPropertiesUserassignedidentitiesAdditionalproperties

DnsSettings

FirewallPolicyCertificateAuthority

FirewallPolicyInsights

FirewallPolicyIntrusionDetection

FirewallPolicyIntrusionDetectionBypassTrafficSpecifications

FirewallPolicyIntrusionDetectionConfiguration

FirewallPolicyIntrusionDetectionSignatureSpecification

FirewallPolicyLogAnalyticsResources

FirewallPolicyLogAnalyticsWorkspace

FirewallPolicyPropertiesFormat

FirewallPolicySku

FirewallPolicySnat

FirewallPolicyThreatIntelWhitelist

FirewallPolicyTransportSecurity

ManagedServiceIdentity

ManagedServiceIdentityUserAssignedIdentities

Microsoft.Network/firewallPolicies

ResourceTags

SubResource