azure firewall IPgroups

prasantc 956

Is azure firewall IPgroups a global metadata that could be recognized across the continental region connection. If I have a IPgroupEU with IP address from EMEA region, can I reference it in US west region or I would need to create new IP group in US west with the same name with the same set of IP addresses?

KapilAnanth-MSFT 48,486 Reputation points Microsoft Employee

2023-07-10T10:17:54.2466667+00:00

@prasantc

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to know if we could use the IPgroups cross region wise.

I see lukemurraynz has provided an answer

Kindly let us know if that helps or you need further assistance on this issue.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Accepted answer

Luke Murray 11,246 Reputation points MVP

2023-07-09T21:18:29.35+00:00
These are regional resources - so they are held in a specific region, but I was able to do a quick test:

Created an IP Group in Canada

Confirmed, I could add the IP Group to my Azure Firewall in Australia East.

Although, technically - it seems to be possible - you run the risk of issues happening in the IP Group region, and causing issues, such as not being able to make changes or firewall rules not working if the region with the IP group goes down. Very low likelihood, but worth mentioning.
Please sign in to rate this answer.

1 person found this answer helpful.
prasantc 956 Reputation points

2023-07-11T00:33:05.34+00:00

One question I forgot to ask is -

What happens if I have vWAN with three secured hub in Europe, Asia and Amer? Do I have to create IPgroups mapping same range and similar block of IP addresses in all three regions

Luke Murray 11,246 Reputation points MVP

2023-07-11T02:38:48.63+00:00

Based on the testing I did (cross subscription and regions on an Azure Firewall that was in a secured hub), no, you don't need to.

prasantc 956 Reputation points

2023-07-11T19:44:25.0666667+00:00

Thanks for testing and confirming it. I will give it try on VS subscription with WAN playground repo
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

azure firewall IPgroups

0 additional answers

Your answer