Skip to content

Commit 78fcf11

Browse files
wyunchi-mswyunchi-ms
authored
Merge pull request Azure#10334 from saisujithreddym/firewallsku
Firewall on the virtual Hub
2 parents 52d4026 + f768b81 commit 78fcf11

File tree

10 files changed

+1943
-60
lines changed

10 files changed

+1943
-60
lines changed

‎src/Network/Network.Test/ScenarioTests/AzureFirewallTests.cs

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,5 +57,14 @@ public void TestAzureFirewallAllocateAndDeallocate()
5757
{
5858
TestRunner.RunTestScript("Test-AzureFirewallAllocateAndDeallocate");
5959
}
60+
61+
[Fact]
62+
[Trait(Category.AcceptanceType, Category.CheckIn)]
63+
[Trait(Category.Owner, NrpTeamAlias.azurefirewall)]
64+
public void TestAzureFirewallVirtualHubCRUD()
65+
{
66+
TestRunner.RunTestScript("Test-AzureFirewallVirtualHubCRUD");
67+
}
68+
6069
}
6170
}

‎src/Network/Network.Test/ScenarioTests/AzureFirewallTests.ps1

Lines changed: 71 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,7 @@
1616
.SYNOPSIS
1717
Tests AzureFirewallCRUD.
1818
#>
19-
function Test-AzureFirewallCRUD
20-
{
19+
function Test-AzureFirewallCRUD {
2120
# Setup
2221
$rgname = Get-ResourceGroupName
2322
$azureFirewallName = Get-ResourceName
@@ -97,8 +96,7 @@ function Test-AzureFirewallCRUD
9796
$natRule1TranslatedAddress = "10.1.2.3"
9897
$natRule1TranslatedPort = "91"
9998

100-
try
101-
{
99+
try {
102100
# Create the resource group
103101
$resourceGroup = New-AzResourceGroup -Name $rgname -Location $location -Tags @{ testtag = "testval" }
104102

@@ -201,7 +199,7 @@ function Test-AzureFirewallCRUD
201199
Assert-ThrowsContains { $natRule.AddProtocol("ABCD") } "Invalid protocol"
202200
# Test handling of ICMP protocol
203201
Assert-ThrowsContains {
204-
New-AzFirewallNatRule -Name $natRule1Name -Protocol $natRule1Protocol1,"ICMP" -SourceAddress $natRule1SourceAddress1 -DestinationAddress $natRule1DestinationAddress1 -DestinationPort $natRule1DestinationPort1 -TranslatedAddress $natRule1TranslatedAddress -TranslatedPort $natRule1TranslatedPort
202+
New-AzFirewallNatRule -Name $natRule1Name -Protocol $natRule1Protocol1, "ICMP" -SourceAddress $natRule1SourceAddress1 -DestinationAddress $natRule1DestinationAddress1 -DestinationPort $natRule1DestinationPort1 -TranslatedAddress $natRule1TranslatedAddress -TranslatedPort $natRule1TranslatedPort
205203
} "The argument `"ICMP`" does not belong to the set"
206204
Assert-ThrowsContains { $natRule.AddProtocol("ICMP") } "Invalid protocol"
207205

@@ -395,8 +393,7 @@ function Test-AzureFirewallCRUD
395393
$list = Get-AzFirewall -ResourceGroupName $rgname
396394
Assert-AreEqual 0 @($list).Count
397395
}
398-
finally
399-
{
396+
finally {
400397
# Cleanup
401398
Clean-ResourceGroup $rgname
402399
}
@@ -406,8 +403,7 @@ function Test-AzureFirewallCRUD
406403
.SYNOPSIS
407404
Tests AzureFirewallCRUD With Availability Zones.
408405
#>
409-
function Test-AzureFirewallCRUDWithZones
410-
{
406+
function Test-AzureFirewallCRUDWithZones {
411407
# Setup
412408
$rgname = Get-ResourceGroupName
413409
$azureFirewallName = Get-ResourceName
@@ -480,8 +476,7 @@ function Test-AzureFirewallCRUDWithZones
480476
$natRule1TranslatedAddress = "10.1.2.3"
481477
$natRule1TranslatedPort = "91"
482478

483-
try
484-
{
479+
try {
485480
# Create the resource group
486481
$resourceGroup = New-AzResourceGroup -Name $rgname -Location $location -Tags @{ testtag = "testval" }
487482

@@ -493,7 +488,7 @@ function Test-AzureFirewallCRUDWithZones
493488
$publicip = New-AzPublicIpAddress -ResourceGroupName $rgname -name $publicIpName -location $location -AllocationMethod Static -Sku Standard
494489

495490
# Create AzureFirewall (with no rules, ThreatIntel is in Alert mode by default)
496-
$azureFirewall = New-AzFirewall –Name $azureFirewallName -ResourceGroupName $rgname -Location $location -VirtualNetworkName $vnetName -PublicIpName $publicIpName -Zone 1,2,3
491+
$azureFirewall = New-AzFirewall –Name $azureFirewallName -ResourceGroupName $rgname -Location $location -VirtualNetworkName $vnetName -PublicIpName $publicIpName -Zone 1, 2, 3
497492

498493
# Get AzureFirewall
499494
$getAzureFirewall = Get-AzFirewall -name $azureFirewallName -ResourceGroupName $rgname
@@ -577,7 +572,7 @@ function Test-AzureFirewallCRUDWithZones
577572
Assert-ThrowsContains { $natRule.AddProtocol("ABCD") } "Invalid protocol"
578573
# Test handling of ICMP protocol
579574
Assert-ThrowsContains {
580-
New-AzFirewallNatRule -Name $natRule1Name -Protocol $natRule1Protocol1,"ICMP" -SourceAddress $natRule1SourceAddress1 -DestinationAddress $natRule1DestinationAddress1 -DestinationPort $natRule1DestinationPort1 -TranslatedAddress $natRule1TranslatedAddress -TranslatedPort $natRule1TranslatedPort
575+
New-AzFirewallNatRule -Name $natRule1Name -Protocol $natRule1Protocol1, "ICMP" -SourceAddress $natRule1SourceAddress1 -DestinationAddress $natRule1DestinationAddress1 -DestinationPort $natRule1DestinationPort1 -TranslatedAddress $natRule1TranslatedAddress -TranslatedPort $natRule1TranslatedPort
581576
} "The argument `"ICMP`" does not belong to the set"
582577
Assert-ThrowsContains { $natRule.AddProtocol("ICMP") } "Invalid protocol"
583578

@@ -594,8 +589,8 @@ function Test-AzureFirewallCRUDWithZones
594589
# Add NetworkRuleCollections to the Firewall using method AddNetworkRuleCollection
595590
$azureFirewall.AddNetworkRuleCollection($netRc)
596591

597-
# Update ThreatIntel mode
598-
$azureFirewall.ThreatIntelMode = "Deny"
592+
# Update ThreatIntel mode
593+
$azureFirewall.ThreatIntelMode = "Deny"
599594

600595
# Set AzureFirewall
601596
Set-AzFirewall -AzureFirewall $azureFirewall
@@ -610,7 +605,7 @@ function Test-AzureFirewallCRUDWithZones
610605
Assert-NotNull $getAzureFirewall.Location
611606
Assert-AreEqual $location $getAzureFirewall.Location
612607
Assert-NotNull $getAzureFirewall.Etag
613-
Assert-AreEqual "Deny" $getAzureFirewall.ThreatIntelMode
608+
Assert-AreEqual "Deny" $getAzureFirewall.ThreatIntelMode
614609

615610
Assert-AreEqual 1 @($getAzureFirewall.IpConfigurations).Count
616611
Assert-NotNull $azureFirewallIpConfiguration[0].Subnet.Id
@@ -760,8 +755,7 @@ function Test-AzureFirewallCRUDWithZones
760755
$list = Get-AzFirewall -ResourceGroupName $rgname
761756
Assert-AreEqual 0 @($list).Count
762757
}
763-
finally
764-
{
758+
finally {
765759
# Cleanup
766760
Clean-ResourceGroup $rgname
767761
}
@@ -771,8 +765,7 @@ function Test-AzureFirewallCRUDWithZones
771765
.SYNOPSIS
772766
Tests AzureFirewall with new style params for VNET and Public IPs - objects instead of strings
773767
#>
774-
function Test-AzureFirewallPIPAndVNETObjectTypeParams
775-
{
768+
function Test-AzureFirewallPIPAndVNETObjectTypeParams {
776769
# Setup
777770
$rgname = Get-ResourceGroupName
778771
$azureFirewallName = Get-ResourceName
@@ -784,8 +777,7 @@ function Test-AzureFirewallPIPAndVNETObjectTypeParams
784777
$publicIp1Name = Get-ResourceName
785778
$publicIp2Name = Get-ResourceName
786779

787-
try
788-
{
780+
try {
789781
# Create the resource group
790782
$resourceGroup = New-AzResourceGroup -Name $rgname -Location $location -Tags @{ testtag = "testval" }
791783

@@ -917,8 +909,7 @@ function Test-AzureFirewallPIPAndVNETObjectTypeParams
917909
$list = Get-AzFirewall -ResourceGroupName $rgname
918910
Assert-AreEqual 0 @($list).Count
919911
}
920-
finally
921-
{
912+
finally {
922913
# Cleanup
923914
Clean-ResourceGroup $rgname
924915
}
@@ -928,8 +919,7 @@ function Test-AzureFirewallPIPAndVNETObjectTypeParams
928919
.SYNOPSIS
929920
Tests AzureFirewall Set and Remove IpConfiguration
930921
#>
931-
function Test-AzureFirewallAllocateAndDeallocate
932-
{
922+
function Test-AzureFirewallAllocateAndDeallocate {
933923
# Setup
934924
$rgname = Get-ResourceGroupName
935925
$azureFirewallName = Get-ResourceName
@@ -940,8 +930,7 @@ function Test-AzureFirewallAllocateAndDeallocate
940930
$subnetName = "AzureFirewallSubnet"
941931
$publicIpName = Get-ResourceName
942932

943-
try
944-
{
933+
try {
945934
# Create the resource group
946935
$resourceGroup = New-AzResourceGroup -Name $rgname -Location $location -Tags @{ testtag = "testval" }
947936

@@ -1031,8 +1020,60 @@ function Test-AzureFirewallAllocateAndDeallocate
10311020
$list = Get-AzFirewall -ResourceGroupName $rgname
10321021
Assert-AreEqual 0 @($list).Count
10331022
}
1034-
finally
1035-
{
1023+
finally {
1024+
# Cleanup
1025+
Clean-ResourceGroup $rgname
1026+
}
1027+
}
1028+
1029+
<#
1030+
.SYNOPSIS
1031+
Tests AzureFirewall Set and Remove IpConfiguration
1032+
#>
1033+
function Test-AzureFirewallVirtualHubCRUD {
1034+
# Setup
1035+
$rgname = Get-ResourceGroupName
1036+
$azureFirewallName = Get-ResourceName
1037+
$resourceTypeParent = "Microsoft.Network/AzureFirewalls"
1038+
$policyLocation = "westcentralus"
1039+
$location = Get-ProviderLocation $resourceTypeParent
1040+
$azureFirewallPolicyName = Get-ResourceName
1041+
$sku = "AZFW_Hub"
1042+
$tier = "Standard"
1043+
1044+
try {
1045+
# Create the resource group
1046+
$resourceGroup = New-AzResourceGroup -Name $rgname -Location $location -Tags @{ testtag = "testval" }
1047+
1048+
# Create AzureFirewallPolicy (with no rules, ThreatIntel is in Alert mode by default)
1049+
$azureFirewallPolicy = New-AzFirewallPolicy -Name $azureFirewallPolicyName -ResourceGroupName $rgname -Location $policyLocation
1050+
1051+
# Get the AzureFirewallPolicy
1052+
$getazureFirewallPolicy = Get-AzFirewallPolicy -Name $azureFirewallPolicyName -ResourceGroupName $rgname
1053+
1054+
1055+
Assert-NotNull $azureFirewallPolicy
1056+
Assert-NotNull $getazureFirewallPolicy.Id
1057+
1058+
$azureFirewallPolicyId = $getazureFirewallPolicy.Id
1059+
1060+
New-AzFirewall –Name $azureFirewallName -ResourceGroupName $rgname -Location $location -Sku $sku -FirewallPolicyId $azureFirewallPolicyId
1061+
1062+
# Get AzureFirewall
1063+
$getAzureFirewall = Get-AzFirewall -name $azureFirewallName -ResourceGroupName $rgname
1064+
1065+
#verification
1066+
Assert-AreEqual $rgName $getAzureFirewall.ResourceGroupName
1067+
Assert-AreEqual $azureFirewallName $getAzureFirewall.Name
1068+
Assert-NotNull $getAzureFirewall.Location
1069+
Assert-AreEqual (Normalize-Location $location) $getAzureFirewall.Location
1070+
Assert-NotNull $sku $getAzureFirewall.Sku
1071+
Assert-AreEqual $sku $getAzureFirewall.Sku.Name
1072+
Assert-AreEqual $tier $getAzureFirewall.Sku.Tier
1073+
Assert-NotNull $getAzureFirewall.FirewallPolicy
1074+
Assert-AreEqual $azureFirewallPolicyId $getAzureFirewall.FirewallPolicy.Id
1075+
}
1076+
finally {
10361077
# Cleanup
10371078
Clean-ResourceGroup $rgname
10381079
}

‎src/Network/Network.Test/SessionRecords/Commands.Network.Test.ScenarioTests.AzureFirewallTests/TestAzureFirewallVirtualHubCRUD.json

Lines changed: 1657 additions & 0 deletions
Large diffs are not rendered by default.

‎src/Network/Network/AzureFirewall/AzureFirewallBaseCmdlet.cs

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
using Microsoft.Azure.Commands.ResourceManager.Common.Tags;
1919
using Microsoft.Azure.Management.Network;
2020
using Microsoft.Azure.Management.Network.Models;
21+
using Newtonsoft.Json;
2122

2223
namespace Microsoft.Azure.Commands.Network
2324
{
@@ -47,6 +48,14 @@ protected IVirtualNetworksOperations VirtualNetworkClient
4748
}
4849
}
4950

51+
protected IVirtualHubsOperations VirtualHubClient
52+
{
53+
get
54+
{
55+
return NetworkClient.NetworkManagementClient.VirtualHubs;
56+
}
57+
}
58+
5059
protected IPublicIPAddressesOperations PublicIPAddressesClient
5160
{
5261
get

‎src/Network/Network/AzureFirewall/NewAzureFirewallCommand.cs

Lines changed: 77 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -21,15 +21,16 @@
2121
using Microsoft.Azure.Commands.ResourceManager.Common.Tags;
2222
using Microsoft.Azure.Management.Network;
2323
using Microsoft.WindowsAzure.Commands.Common.CustomAttributes;
24+
using Microsoft.Azure.Management.Internal.Resources.Utilities.Models;
2425
using MNM = Microsoft.Azure.Management.Network.Models;
2526

2627
namespace Microsoft.Azure.Commands.Network
2728
{
2829
[Cmdlet(VerbsCommon.New, ResourceManager.Common.AzureRMConstants.AzureRMPrefix + "Firewall", SupportsShouldProcess = true, DefaultParameterSetName = DefaultParameterSet), OutputType(typeof(PSAzureFirewall))]
2930
public class NewAzureFirewallCommand : AzureFirewallBaseCmdlet
31+
3032
{
3133
private const string DefaultParameterSet = "Default";
32-
3334
private PSVirtualNetwork virtualNetwork;
3435
private PSPublicIpAddress[] publicIpAddresses;
3536

@@ -58,7 +59,7 @@ public class NewAzureFirewallCommand : AzureFirewallBaseCmdlet
5859
[CmdletParameterBreakingChange(
5960
"VirtualNetworkName",
6061
deprecateByVersion: "2.0.0",
61-
ChangeDescription = "This parameter will be removed in an upcoming breaking change release. After this point the Virtual Network will be provided as an object instead of a string.",
62+
ChangeDescription = "This parameter will be removed in an upcoming breaking change release. After this point the Virtual Network will be provided as an object instead of a string.",
6263
OldWay = "New-AzFirewall -VirtualNetworkName \"vnet-name\"",
6364
NewWay = "New-AzFirewall -VirtualNetwork $vnet",
6465
OldParamaterType = typeof(string),
@@ -155,6 +156,28 @@ public class NewAzureFirewallCommand : AzureFirewallBaseCmdlet
155156
HelpMessage = "A list of availability zones denoting where the firewall needs to come from.")]
156157
public string[] Zone { get; set; }
157158

159+
[Parameter(
160+
Mandatory = false,
161+
ValueFromPipelineByPropertyName = true,
162+
HelpMessage = "The sku type for firewall")]
163+
[ValidateSet(
164+
MNM.AzureFirewallSkuName.AZFWHub,
165+
MNM.AzureFirewallSkuName.AZFWVNet,
166+
IgnoreCase = false)]
167+
public string Sku { get; set; }
168+
169+
[Parameter(
170+
Mandatory = false,
171+
ValueFromPipelineByPropertyName = true,
172+
HelpMessage = "The virtual hub that a firewall is attached to")]
173+
public string VirtualHubId { get; set; }
174+
175+
[Parameter(
176+
Mandatory = false,
177+
ValueFromPipelineByPropertyName = true,
178+
HelpMessage = "The firewall policy attached to the firewall")]
179+
public string FirewallPolicyId { get; set; }
180+
158181
public override void Execute()
159182
{
160183
// Old params provided - Get the virtual network, get the public IP address
@@ -190,25 +213,61 @@ public override void Execute()
190213

191214
private PSAzureFirewall CreateAzureFirewall()
192215
{
193-
var firewall = new PSAzureFirewall()
216+
var firewall = new PSAzureFirewall();
217+
if (Sku == MNM.AzureFirewallSkuName.AZFWHub)
194218
{
195-
Name = this.Name,
196-
ResourceGroupName = this.ResourceGroupName,
197-
Location = this.Location,
198-
ApplicationRuleCollections = this.ApplicationRuleCollection?.ToList(),
199-
NatRuleCollections = this.NatRuleCollection?.ToList(),
200-
NetworkRuleCollections = this.NetworkRuleCollection?.ToList(),
201-
ThreatIntelMode = this.ThreatIntelMode ?? MNM.AzureFirewallThreatIntelMode.Alert
202-
};
203-
204-
if (this.Zone != null)
205-
{
206-
firewall.Zones = this.Zone?.ToList();
207-
}
208219

209-
if (this.virtualNetwork != null)
220+
if (VirtualHubId != null && this.Location != null)
221+
{
222+
var resourceInfo = new ResourceIdentifier(VirtualHubId);
223+
var hub = this.VirtualHubClient.Get(resourceInfo.ResourceGroupName, resourceInfo.ResourceName);
224+
if (hub.Location != this.Location)
225+
{
226+
throw new ArgumentException("VirtualHub and Firewall cannot be in different locations", nameof(VirtualHubId));
227+
}
228+
229+
}
230+
231+
var sku = new PSAzureFirewallSku();
232+
sku.Name = MNM.AzureFirewallSkuName.AZFWHub;
233+
sku.Tier = MNM.AzureFirewallSkuTier.Standard;
234+
235+
firewall = new PSAzureFirewall()
236+
{
237+
Name = this.Name,
238+
ResourceGroupName = this.ResourceGroupName,
239+
Location = this.Location,
240+
Sku = sku,
241+
VirtualHub = VirtualHubId != null ? new MNM.SubResource(VirtualHubId) : null,
242+
FirewallPolicy = FirewallPolicyId != null ? new MNM.SubResource(FirewallPolicyId) : null
243+
};
244+
}
245+
else
210246
{
211-
firewall.Allocate(this.virtualNetwork, this.publicIpAddresses);
247+
var sku = new PSAzureFirewallSku();
248+
sku.Name = MNM.AzureFirewallSkuName.AZFWVNet;
249+
sku.Tier = MNM.AzureFirewallSkuTier.Standard;
250+
firewall = new PSAzureFirewall()
251+
{
252+
Name = this.Name,
253+
ResourceGroupName = this.ResourceGroupName,
254+
Location = this.Location,
255+
ApplicationRuleCollections = this.ApplicationRuleCollection?.ToList(),
256+
NatRuleCollections = this.NatRuleCollection?.ToList(),
257+
NetworkRuleCollections = this.NetworkRuleCollection?.ToList(),
258+
ThreatIntelMode = this.ThreatIntelMode ?? MNM.AzureFirewallThreatIntelMode.Alert,
259+
Sku = sku
260+
};
261+
262+
if (this.Zone != null)
263+
{
264+
firewall.Zones = this.Zone?.ToList();
265+
}
266+
267+
if (this.virtualNetwork != null)
268+
{
269+
firewall.Allocate(this.virtualNetwork, this.publicIpAddresses);
270+
}
212271
}
213272

214273
// Map to the sdk object

0 commit comments

Comments
 (0)