Issue with Azure firewall

Gayan Koswaththa 20

Hi , I am getting below error in the Azure Firewall when try to update the policies

Failed to delete the rule 'rule-2'.application-resources-firewall-chlid-policy Failed with 1 faulted referenced firewalls

It is deleted but still getting the error

And I can see that it is not working , Required functionality is not working

what could be the reason ??

Vidya Viraktamath 160 Reputation points Microsoft Employee

2024-05-31T12:13:19.24+00:00
The error message suggests that the rule 'rule-2' you're trying to delete is still being referenced by a firewall, which is preventing the deletion. Here are some steps you can take to troubleshoot:

Check Firewall Rules: Review the rules in your Azure Firewall to see if 'rule-2' is still being referenced. If it is, you'll need to remove these references before you can delete 'rule-2'.

Check Child Policies: If 'rule-2' is part of a child policy, ensure that the policy is not being used by any other firewalls. If it is, you'll need to remove these references before you can delete 'rule-2'.

Check Firewall State: Sometimes, Azure Firewall can take some time to update its state after a rule is deleted. Wait a few minutes and then try to delete 'rule-2' again.

Review Provisioning State: Verify the provisioning state of the firewall policy to see if it’s in a failed, updating, or succeeded state.

Sequential Deployment: If you’re using ARM templates or Bicep for deployment, ensure that ruleCollectionGroups are deployed sequentially rather than in parallel. Link - https://learn.microsoft.com/en-us/answers/questions/673917/update-of-azure-firewall-policies-failes-faulted-r

Use PowerShell or CLI: Sometimes, using Azure PowerShell or Azure CLI to force delete or update policies can bypass issues encountered through the portal.

Hope this helps. If you have any follow-up questions, please let me know. would be happy to help.

**

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
GitaraniSharma-MSFT 49,006 Reputation points Microsoft Employee

2024-05-31T12:51:46.29+00:00

Hello @Gayan Koswaththa ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that when you try to update your Azure Firewall policies, you are getting the following error "Failed to delete the rule 'rule-2'.application-resources-firewall-chlid-policy Failed with 1 faulted referenced firewall". And you also mentioned that rule-2 is already deleted but you are still getting an error related to it.

I checked internally and found that there was a transient issue on our control plane causing recent failures during Firewall policy PUT operations.

The Azure Firewall product group team mentioned the below:

As this is a transient issue, if we retry, it might work & operation will succeed.

May I know if you retried the PUT (update) operation? If not, could you please retry and let me know if you are still facing issues?

Regards,

Gita
Gayan Koswaththa 20 Reputation points

2024-05-31T15:29:46.09+00:00

Hi ,
Thanks for the quick comments .
Actually I want to modify,delete,add rules on a firewall child policy

In each operation I am getting the above error. I added it for the reference.

Lets say I add a DNAT rule,
first it showing the above notification which ends with "application-resources-firewall-chlid-policy Failed with 1 faulted referenced firewalls"

Even though I got the error , in the rule collection it shows the rule is added .
But required functionality, after adding the rule is not working .

The same thing happen when modifying and removing the rules in the child policy .
Lets say I modify a rule .first it show me the error but in the rule collection it is showing updated. But the required functionality not working.
Required functionality means the nat,allow IP address,deny IP addresses.
I hope this make sense.

@Vidya Viraktamath how can I remove the references ?
@GitaraniSharma I tried few times but got the same result
KapilAnanth-MSFT 39,211 Reputation points Microsoft Employee

2024-06-05T17:12:28.7266667+00:00
@Gayan Koswaththa ,

I tired to repo your environment and I was unable to.

Can you confirm if the Parent Firewall exists and is not deleted?

Are you using Azure Portal or CLI/Powershell?

If you are using Portal, can you give it a try using CLI/Powershell and let us know?

Cheers,

Kapil
GitaraniSharma-MSFT 49,006 Reputation points Microsoft Employee

2024-06-10T10:13:42.6566667+00:00

@Gayan Koswaththa , could you please provide the details asked by @KapilAnanth-MSFT above?

Share via

Issue with Azure firewall