@@ -22,7 +22,7 @@ function Test-AzureFirewallPolicyCRUD {
2222 $azureFirewallPolicyName = Get-ResourceName
2323 $azureFirewallPolicyAsJobName = Get-ResourceName
2424 $resourceTypeParent = " Microsoft.Network/FirewallPolicies"
25- $location = " westcentralus "
25+ $location = " eastus2euap "
2626
2727 $ruleGroupName = Get-ResourceName
2828
@@ -33,11 +33,6 @@ function Test-AzureFirewallPolicyCRUD {
3333
3434 $pipelineRcPriority = 154
3535
36- # AzureFirewallPolicyApplicationRuleCollection 2
37- $appRc2Name = " appRc2"
38- $appRc2Priority = 300
39- $appRc2ActionType = " Deny"
40-
4136 # AzureFirewallPolicyApplicationRule 1
4237 $appRule1Name = " appRule"
4338 $appRule1Desc = " desc1"
@@ -70,23 +65,22 @@ function Test-AzureFirewallPolicyCRUD {
7065 $networkRule1Desc = " desc1"
7166 $networkRule1SourceAddress1 = " 10.0.0.0"
7267 $networkRule1SourceAddress2 = " 111.1.0.0/24"
73- $networkRule1DestinationAddress1 = " * "
68+ $networkRule1DestinationAddress1 = " 10.10.10.1 "
7469 $networkRule1Protocol1 = " UDP"
7570 $networkRule1Protocol2 = " TCP"
7671 $networkRule1Protocol3 = " ICMP"
7772 $networkRule1DestinationPort1 = " 90"
7873
7974 # AzureFirewallPolicyNatRuleCollection
8075 $natRcName = " natRc"
81- $natRcPriority = 200
76+ $natRcPriority = 100
8277 $natRcActionType = " Dnat"
8378
8479 # AzureFirewallPolicyNatRule 1
8580 $natRule1Name = " natRule"
8681 $natRule1Desc = " desc1"
8782 $natRule1SourceAddress1 = " 10.0.0.0"
8883 $natRule1SourceAddress2 = " 111.1.0.0/24"
89- $natRule1DestinationAddress1 = " 1.2.3.4"
9084 $natRule1Protocol1 = " UDP"
9185 $natRule1Protocol2 = " TCP"
9286 $natRule1DestinationPort1 = " 90"
@@ -115,16 +109,22 @@ function Test-AzureFirewallPolicyCRUD {
115109 $appRule = New-AzFirewallPolicyApplicationRule - Name $appRule1Name - Description $appRule1Desc - Protocol $appRule1Protocol1 , $appRule1Protocol2 - TargetFqdn $appRule1Fqdn1 , $appRule1Fqdn2 - SourceAddress $appRule1SourceAddress1
116110 $appRule2 = New-AzFirewallPolicyApplicationRule - Name $appRule2Name - Description $appRule1Desc - Protocol $appRule2Protocol1 , $appRule2Protocol2 - TargetFqdn $appRule2Fqdn1 - SourceAddress $appRule2SourceAddress1
117111
118- # Create Network Rule Condition
112+ # Create Network Rule
119113 $networkRule = New-AzFirewallPolicyNetworkRule - Name $networkRule1Name - Description $networkRule1Desc - Protocol $networkRule1Protocol1 , $networkRule1Protocol2 - SourceAddress $networkRule1SourceAddress1 , $networkRule1SourceAddress2 - DestinationAddress $networkRule1DestinationAddress1 - DestinationPort $networkRule1DestinationPort1
120114
121- # Create Filter Rule with 2 rules
115+
116+ # Create Filter Rule with 2 application rules
122117 $appRc = New-AzFirewallPolicyFilterRuleCollection - Name $appRcName - Priority $appRcPriority - Rule $appRule , $appRule2 - ActionType $appRcActionType
123- # Create a second Filter Rule Collection with 1 rule
124- $appRc2 = New-AzFirewallPolicyFilterRuleCollection - Name $appRc2Name - Priority $appRc2Priority - Rule $networkRule - ActionType $appRc2ActionType
118+
119+ # Create a second Filter Rule Collection with 1 network rule
120+ $appRc2 = New-AzFirewallPolicyFilterRuleCollection - Name $networkRcName - Priority $networkRcPriority - Rule $networkRule - ActionType $networkRcActionType
121+
125122
126- # Create a NAT rule
127- $natRc = New-AzFirewallPolicyNatRuleCollection - Name $networkRcName - Priority $natRcPriority - Rule $networkRule - TranslatedAddress $natRule1TranslatedAddress - TranslatedPort $natRule1TranslatedPort - ActionType $natRcActionType
123+ # Create NAT rule
124+ $natRule = New-AzFirewallPolicyNatRule - Name $natRule1Name - Description $natRule1Desc - Protocol $natRule1Protocol1 , $natRule1Protocol2 - SourceAddress $natRule1SourceAddress1 , $natRule1SourceAddress2 - DestinationAddress $networkRule1DestinationAddress1 - DestinationPort $natRule1DestinationPort1 - TranslatedAddress $natRule1TranslatedAddress - TranslatedPort $natRule1TranslatedPort
125+
126+ # Create a NAT Rule Collection
127+ $natRc = New-AzFirewallPolicyNatRuleCollection - Name $natRcName - ActionType $natRcActionType - Priority $natRcPriority - Rule $natRule
128128
129129 New-AzFirewallPolicyRuleCollectionGroup - Name $ruleGroupName - Priority 100 - RuleCollection $appRc , $appRc2 , $natRc - FirewallPolicyObject $azureFirewallPolicy
130130
@@ -136,24 +136,25 @@ function Test-AzureFirewallPolicyCRUD {
136136 # Get AzureFirewallPolicy
137137 $getAzureFirewallPolicy = Get-AzFirewallPolicy - Name $azureFirewallPolicyName - ResourceGroupName $rgName
138138
139- # # verification
139+ # verification
140140 Assert-AreEqual $rgName $getAzureFirewallPolicy.ResourceGroupName
141141 Assert-AreEqual $azureFirewallPolicyName $getAzureFirewallPolicy.Name
142142 Assert-NotNull $getAzureFirewallPolicy.Location
143143 Assert-AreEqual $location $getAzureFirewallPolicy.Location
144144 Assert-AreEqual " Deny" $getAzureFirewallPolicy.ThreatIntelMode
145145
146- # # Check rule groups count
146+ # Check rule groups count
147147 Assert-AreEqual 1 @ ($getAzureFirewallPolicy.RuleCollectionGroups ).Count
148148
149149 $getRg = Get-AzFirewallPolicyRuleCollectionGroup - Name $ruleGroupName - AzureFirewallPolicy $getAzureFirewallPolicy
150150
151151 Assert-AreEqual 3 @ ($getRg.properties.ruleCollection ).Count
152152
153153 $filterRuleCollection1 = $getRg.Properties.GetRuleCollectionByName ($appRcName )
154- $natRuleCollection = $getRg.Properties.GetRuleCollectionByName ($networkRcName )
154+ $filterRuleCollection2 = $getRg.Properties.GetRuleCollectionByName ($networkRcName )
155+ $natRuleCollection = $getRg.Properties.GetRuleCollectionByName ($natRcName )
155156
156- # Verify filter Rule1
157+ # Verify Filter Rule Collection1
157158 Assert-AreEqual $appRcName $filterRuleCollection1.Name
158159 Assert-AreEqual $appRcPriority $filterRuleCollection1.Priority
159160 Assert-AreEqual $appRcActionType $filterRuleCollection1.Action.Type
@@ -176,29 +177,50 @@ function Test-AzureFirewallPolicyCRUD {
176177 Assert-AreEqual $appRule1Fqdn1 $appRule.TargetFqdns [0 ]
177178 Assert-AreEqual $appRule1Fqdn2 $appRule.TargetFqdns [1 ]
178179
179- # Verify NAT rule collection and NAT rule)
180- $natRule = $natRuleCollection.GetRuleByName ($networkRcName )
180+ # Verify Filter Rule Collection2
181+ Assert-AreEqual $networkRcName $filterRuleCollection2.Name
182+ Assert-AreEqual $networkRcPriority $filterRuleCollection2.Priority
183+ Assert-AreEqual $networkRcActionType $filterRuleCollection2.Action.Type
184+ Assert-AreEqual 1 $filterRuleCollection2.Rules.Count
185+
186+ $networkRule = $filterRuleCollection2.GetRuleByName ($networkRule1Name )
187+ # Verify Network rule
188+ Assert-AreEqual $networkRule1Name $networkRule.Name
181189
182- Assert-AreEqual $networkRcName $natRuleCollection.Name
190+ Assert-AreEqual 2 $networkRule.SourceAddresses.Count
191+ Assert-AreEqual $networkRule1SourceAddress1 $networkRule.SourceAddresses [0 ]
192+ Assert-AreEqual $networkRule1SourceAddress2 $networkRule.SourceAddresses [1 ]
193+
194+ Assert-AreEqual 2 $networkRule.Protocols.Count
195+ Assert-AreEqual $networkRule1Protocol1 $networkRule.Protocols [0 ]
196+ Assert-AreEqual $networkRule1Protocol2 $networkRule.Protocols [1 ]
197+
198+ Assert-AreEqual 1 $networkRule.DestinationPorts.Count
199+ Assert-AreEqual $networkRule1DestinationPort1 $networkRule.DestinationPorts [0 ]
200+
201+ # Verify NAT rule collection and NAT rule
202+ $natRule = $natRuleCollection.GetRuleByName ($natRule1Name )
203+
204+ Assert-AreEqual $natRcName $natRuleCollection.Name
183205 Assert-AreEqual $natRcPriority $natRuleCollection.Priority
184206
185- Assert-AreEqual $networkRule1Name $natRule.Name
207+ Assert-AreEqual $natRule1Name $natRule.Name
186208
187209 Assert-AreEqual 2 $natRule.SourceAddresses.Count
188210 Assert-AreEqual $natRule1SourceAddress1 $natRule.SourceAddresses [0 ]
189211 Assert-AreEqual $natRule1SourceAddress2 $natRule.SourceAddresses [1 ]
190212
191- Assert-AreEqual 1 $natRule.DestinationAddresses.Count
213+ Assert-AreEqual 1 $natRule.DestinationAddresses.Count
192214
193- Assert-AreEqual 2 $natRule.Protocols.Count
194- Assert-AreEqual $networkRule1Protocol1 $natRule.Protocols [0 ]
195- Assert-AreEqual $networkRule1Protocol2 $natRule.Protocols [1 ]
215+ Assert-AreEqual 2 $natRule.Protocols.Count
216+ Assert-AreEqual $natRule1Protocol1 $natRule.Protocols [0 ]
217+ Assert-AreEqual $natRule1Protocol2 $natRule.Protocols [1 ]
196218
197- Assert-AreEqual 1 $natRule.DestinationPorts.Count
219+ Assert-AreEqual 1 $natRule.DestinationPorts.Count
198220 Assert-AreEqual $natRule1DestinationPort1 $natRule.DestinationPorts [0 ]
199221
200- Assert-AreEqual $natRule1TranslatedAddress $natRuleCollection .TranslatedAddress
201- Assert-AreEqual $natRule1TranslatedPort $natRuleCollection .TranslatedPort
222+ Assert-AreEqual $natRule1TranslatedAddress $natRule .TranslatedAddress
223+ Assert-AreEqual $natRule1TranslatedPort $natRule .TranslatedPort
202224
203225
204226 $testPipelineRg = Get-AzFirewallPolicyRuleCollectionGroup - Name $ruleGroupName - AzureFirewallPolicyName $getAzureFirewallPolicy.Name - ResourceGroupName $rgname
@@ -208,7 +230,71 @@ function Test-AzureFirewallPolicyCRUD {
208230
209231 $azureFirewallPolicyAsJob = New-AzFirewallPolicy - Name $azureFirewallPolicyAsJobName - ResourceGroupName $rgname - Location $location - AsJob
210232 $result = $azureFirewallPolicyAsJob | Wait-Job
211- Assert-AreEqual " Completed" $result.State ;
233+ Assert-AreEqual " Completed" $result.State
234+ }
235+ finally {
236+ # Cleanup
237+ Clean - ResourceGroup $rgname
238+ }
239+ }
240+
241+
242+ <#
243+ . SYNOPSIS
244+ Tests AzureFirewallPolicyCRUD with ThreatIntelWhitelist.
245+ #>
246+ function Test-AzureFirewallPolicyWithThreatIntelWhitelistCRUD {
247+ # Setup
248+ $rgname = Get-ResourceGroupName
249+ $azureFirewallPolicyName = Get-ResourceName
250+ $azureFirewallPolicyAsJobName = Get-ResourceName
251+ $resourceTypeParent = " Microsoft.Network/FirewallPolicies"
252+ $location = " eastus2euap"
253+
254+ $ruleGroupName = Get-ResourceName
255+ $threatIntelWhiteListIp1 = " 20.3.4.5"
256+ $threatIntelWhiteListIp2 = " 37.1.2.3"
257+ $threatIntelWhiteListIp3 = " 208.199.20.37"
258+ $threatIntelWhiteListFqdn1 = " microsoft.com"
259+
260+ try {
261+ # Create the resource group
262+ $resourceGroup = New-AzResourceGroup - Name $rgname - Location $location - Tags @ { testtag = " testval"
263+
264+ $tiWhiteList = New-AzFirewallPolicyThreatIntelWhitelist - IpAddress $threatIntelWhiteListIp1 , $threatIntelWhiteListIp2 - FQDN $threatIntelWhiteListFqdn1
265+
266+ # Create AzureFirewallPolicy (with no rules, ThreatIntel is in Alert mode by default)
267+ $azureFirewallPolicy = New-AzFirewallPolicy - Name $azureFirewallPolicyName - ResourceGroupName $rgname - Location $location - ThreatIntelWhitelist $tiWhiteList
268+
269+ # Get AzureFirewallPolicy
270+ $getAzureFirewallPolicy = Get-AzFirewallPolicy - Name $azureFirewallPolicyName - ResourceGroupName $rgname
271+
272+ # verification
273+ Assert-AreEqual $rgName $getAzureFirewallPolicy.ResourceGroupName
274+ Assert-AreEqual $azureFirewallPolicyName $getAzureFirewallPolicy.Name
275+ Assert-NotNull $getAzureFirewallPolicy.Location
276+ Assert-AreEqual $location $getAzureFirewallPolicy.Location
277+ Assert-AreEqual " Alert" $getAzureFirewallPolicy.ThreatIntelMode
278+ Assert-NotNull $getAzureFirewallPolicy.ThreatIntelWhitelist
279+ Assert-AreEqual $threatIntelWhiteListIp1 $getAzureFirewallPolicy.ThreatIntelWhitelist.IpAddresses [0 ]
280+ Assert-AreEqual $threatIntelWhiteListIp2 $getAzureFirewallPolicy.ThreatIntelWhitelist.IpAddresses [1 ]
281+ Assert-AreEqual $threatIntelWhiteListFqdn1 $getAzureFirewallPolicy.ThreatIntelWhitelist.FQDNs [0 ]
282+
283+ # # Update ThreatIntel Whitelist
284+ $azureFirewallPolicy.ThreatIntelWhitelist.IpAddresses [0 ] = $threatIntelWhiteListIp3
285+
286+ # Set AzureFirewallPolicy
287+ Set-AzFirewallPolicy - InputObject $azureFirewallPolicy
288+ # Get AzureFirewallPolicy
289+ $getAzureFirewallPolicy = Get-AzFirewallPolicy - Name $azureFirewallPolicyName - ResourceGroupName $rgName
290+
291+ # #verification
292+ Assert-AreEqual $rgName $getAzureFirewallPolicy.ResourceGroupName
293+ Assert-AreEqual $azureFirewallPolicyName $getAzureFirewallPolicy.Name
294+ Assert-NotNull $getAzureFirewallPolicy.Location
295+ Assert-AreEqual $location $getAzureFirewallPolicy.Location
296+ Assert-NotNull $getAzureFirewallPolicy.ThreatIntelWhitelist
297+ Assert-AreEqual $threatIntelWhiteListIp3 $getAzureFirewallPolicy.ThreatIntelWhitelist.IpAddresses [0 ]
212298 }
213299 finally {
214300 # Cleanup
0 commit comments