Internal Server Error - When deploying an Azure Firewall Policy with no changes

Question

Since last week when trying to deploy an Azure Firewall Policy rules we get the following error:

Internal Server Error: The response for resource had empty or invalid content

This only happens if there are no changes between the template being deployed and the current configuration of the policy. So an initial deployment will succeed, but every subsequent deployment (of the same template) fails, unless you either change a value (like the rule name) in the template or in the policy directly. After this, the deployment succeeds one time.

I have tested this over two separate tenants and three subscriptions and it will consistently behave like described.

For testing I created a simple bicep, containing only a policy and one rule:

param location string = resourceGroup().location  
  
var netRuleCollection = [  
  {  
    //Access from private agents to all  
    ruleCollectionType: 'FirewallPolicyFilterRuleCollection'  
    name: 'private-agents-to-sql'  
    priority: 1020  
    action: {  
      type: 'Allow'  
    }  
    rules: [  
      {  
        ruleType: 'NetworkRule'  
        name: 'mssql'  
        ipProtocols: [  
          'TCP'  
        ]  
        sourceAddresses: [  
         '10.10.1.0/24'  
        ]  
        destinationAddresses: [  
          '10.10.2.0/24'  
        ]  
        destinationPorts: [  
          '1433'  
        ]  
      }  
    ]  
  }  
]  
  
resource afp 'Microsoft.Network/firewallPolicies@2021-08-01' = {  
  name: 'my-afp-01'  
  location: location  
  properties: {  
    basePolicy: null  
    threatIntelMode: 'Off'  
    threatIntelWhitelist: {}  
    dnsSettings: {}  
    transportSecurity: null  
    sku: {  
      tier: 'Standard'  
    }  
  }  
}  
  
resource nw_policy 'Microsoft.Network/firewallPolicies/ruleCollectionGroups@2021-08-01' =  {  
  name: '${afp.name}/MyRuleCollection'  
  properties: {  
    priority: 1100  
    ruleCollections: netRuleCollection  
  }  
}  

Another way to reproduce this is to take an existing firewall policy and export it to template from the portal. This template will also fail to deploy unless you first make a change (to the policy or the template).

Answer 1

We also had raised a ticket with MS Support. Sadly no reply to this as of yet.

But on a brighter note: It appears the underlying issue has been fixed, when testing today behavior seems to back to normal and deployments no longer fail when there is no change in the configuration.

Answer 2

Hello @André van der Goes

Welcome to Microsoft Q&A Platform,

There's an internal bug that's related to this issue, which is being fixed globally.

I hope this helps!

----------

Please don’t forget to "Accept the answer" and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.