How to associate an existent Public IP with Azure Firewall

Rodrigo Rosa 41

Hey guys,

Is it possible to use one or more existing/pre-defined IPs with the Azure Firewall?

*The Firewall is in a secure hub environment

There are documents/scripts to create new IPs and associate them with the Firewall, via portal as well, but none of them mention associating existing IPs.

The idea is -> Create a Public IP prefix (/30) and then attach these IPs to the Firewall.

Is it currently possible?

BR,

KapilAnanth-MSFT 35,001 Reputation points Microsoft Employee

2024-03-12T12:46:42.4266667+00:00
@Rodrigo Rosa ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

Your requirement should be possible, directly via Portal.

I don't see any requirement of using script (Powershell/CLI) to achieve this.

Please note, Public IP Address Prefix as a "whole" resource cannot be attached to a Azure Firewall.

Nevertheless, you should be able to attach individual IPs from the Prefix to the Azure Firewall.

See :

Public IP address prefix Scenarios

In the Azure Firewall,

First change the Public IP to use one of the IPs from the /30 Prefix

See : Change the public IP address for a firewall

Then add the rest of the 3 IP Addresses from the /30 Prefix as additional IP configurations

See : Add a public IP configuration to a firewall

The only requirement is that

You can't update the IP address if the firewall's existing IP has any destination network address translation (DNAT) rules associated with it.

Make sure you do not have any DNAT rules or Delete them and then recreate them once you updated the IP Addresses.

Please let us know if we can be of any further assistance here.

Thanks,

Kapil

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.
Rodrigo Rosa 41 Reputation points

2024-03-12T13:09:26.25+00:00

Hello Kapil,

I think my environment is different. As I said, the Firewall is part of a virtual hub and managed by the Firewall Manager.

In the portal, I have only the option (to specify the number of Public IPs to add). Azure will randomly create the IPs.

I cannot add an existing IP.

Thank you for the answer!

BR,
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Didier Van Hoye 6 Reputation points MVP

2024-03-12T17:20:50.8533333+00:00

Unfortunately, as you found out, this is not supported with a Secured Hub in a VWAN, so the whole prefix concept goes out the window. Still on my ask list however together with NAT GW support etc.
Rodrigo Rosa 41 Reputation points

2024-03-13T11:13:45.03+00:00

Yes. A quite simple feature that unfortunately is not available. Thanks!

Accepted answer

KapilAnanth-MSFT 35,001 Reputation points Microsoft Employee

2024-03-14T12:20:34.3566667+00:00

@Rodrigo Rosa ,

My sincere apologies.

Your observation is correct, Selecting a specific IP Address for secured Hub's Firewall is currently not feasible.

You may vote for this feature in Azure Feedback Hub forum .

All the feedback shared in these forums are monitored and reviewed by the Microsoft engineering teams responsible for building Azure

https://feedback.azure.com/d365community/idea/4d8b024a-8926-ec11-b6e6-000d3a4f0789#comments.

Currently, this is the public facing documentation for this : New-AzFirewallHubPublicIpAddress

I shall work internally to get the documentation updated.

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

How to associate an existent Public IP with Azure Firewall

0 additional answers