How to import Azure Public IP Range JSON to Azure Firewall

Samuel Cheung 1

Hello,

I downloaded the JSON from the following link:
https://www.microsoft.com/en-us/download/details.aspx?id=56519
which includes all the Azure public ip address.

How can I import the file to my Azure firewall configuration?

Thanks.
Regards,
Samuel

2 answers

JimmySalian-2011 41,916 Reputation points

2022-09-07T11:00:47.597+00:00

Hi Samuel,

You can use automation via preferred tool such as ARM templates or BICEP.

Check the process over here - quick-create-multiple-ip-template

==
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.
Samuel Cheung 1 Reputation point

2022-09-07T11:57:25.487+00:00

Hello @JimmySalian-2011 ,

Since the Azure public ip address range is always updated by Microsoft, is there any template to update the Azure firewall configuration directly from the following link automatically?

https://www.microsoft.com/en-us/download/details.aspx?id=56519

Thanks.
Regards,
Samuel

JimmySalian-2011 41,916 Reputation points

2022-09-07T12:01:26.607+00:00

@Samuel Cheung it has to be via ARM or Bicep or Terraform or you can create a Public IP prefix public-ip-address-prefix

create-ip-group

==
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Sign in to comment
rafalzak 3,216 Reputation points

2022-09-07T11:07:21.077+00:00

Hi @Samuel Cheung ,

I would suggest to create IP Groups and import the file there but it has limitations to 5000 IP's per group and it must be converted to CSV.
Then use IP Groups into Azure Firewall.
https://learn.microsoft.com/en-us/azure/firewall/ip-groups
or instead of importing all these addresses maybe you could use tags for services when you create policies in firewall.
Please sign in to rate this answer.
Samuel Cheung 1 Reputation point

2022-09-07T11:52:38.597+00:00

Hello @rafalzak ,

Sorry I cannot find the import button for importing the JSON file in the page
https://learn.microsoft.com/en-us/azure/firewall/ip-groups

Is there any screen dump that can show it?

Thanks.
Regards,
Samuel

rafalzak 3,216 Reputation points

2022-09-07T11:55:27.89+00:00

You cannot import JSON there just CSV and it's limited to 5000 IP's so it's to much to entire file you mentioned.

Samuel Cheung 1 Reputation point

2022-09-07T12:33:41.683+00:00

Hello @rafalzak ,

One of the service tags I needs is "AzureBotService".

From

https://learn.microsoft.com/en-us/azure/virtual-network/service-tags-overview

It is not available for "Can use with Azure Firewall"

Does it mean that I cannot configure the Azure Firewall with this service tag?

Thanks.
Regards,
Samuel

rafalzak 3,216 Reputation points

2022-09-07T12:37:42.52+00:00

Exactly, you cannot use this service tag in Azure Firewall but Azure Bot Service has a few IP per region only so If you don't need all of them I would go with Azure IP Group

Samuel Cheung 1 Reputation point

2022-09-07T12:51:41.03+00:00

Hello @rafalzak

Thanks for your clarification.
Why the azure public ip address json file cannot be directly imported for the Azure setting?
Then, what is the use of the Azure ip address range json file for downloading?

Thanks.
Regards,
Samuel

rafalzak 3,216 Reputation points

2022-09-07T12:54:48.19+00:00

This file contain all Azure Public IP and and their service tag.
I would say it's not even recommended to use all of them if your services will not communicate with them.
In short, Microsoft provide one file with all IP's and you are responsible for creating policies on your firewall..
You can open this file and find what you need for your firewall rules.

rafalzak 3,216 Reputation points

2022-09-16T09:23:02.933+00:00

Hi @Samuel Cheung ,

Did you create the Rules which meet your goal?

rafalzak 3,216 Reputation points

2022-09-16T09:35:56.1+00:00

I just think about it again and i think you could use powershell to get list of IP's used by service for example:
$servicetags= Get-AzNetworkServiceTag -Location WestEurope
and then
$servicetags.Values | Where-Object { $_.Name -eq "AzureBotService"}

Finally, In order to automate the process you could update Firewall Rules by powershell:
https://learn.microsoft.com/en-us/azure/firewall/deploy-rules-powershell
Sign in to comment