This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Hello,
I downloaded the JSON from the following link:
https://www.microsoft.com/en-us/download/details.aspx?id=56519
which includes all the Azure public ip address.
How can I import the file to my Azure firewall configuration?
Thanks.
Regards,
Samuel
Hi Samuel,
You can use automation via preferred tool such as ARM templates or BICEP.
Check the process over here - quick-create-multiple-ip-template
==
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Hello @JimmySalian-2011 ,
Since the Azure public ip address range is always updated by Microsoft, is there any template to update the Azure firewall configuration directly from the following link automatically?
https://www.microsoft.com/en-us/download/details.aspx?id=56519
Thanks.
Regards,
Samuel
Hi @Samuel Cheung ,
I would suggest to create IP Groups and import the file there but it has limitations to 5000 IP's per group and it must be converted to CSV.
Then use IP Groups into Azure Firewall.
https://learn.microsoft.com/en-us/azure/firewall/ip-groups
or instead of importing all these addresses maybe you could use tags for services when you create policies in firewall.
Hello @RAFAŁ ŻAK ,
Sorry I cannot find the import button for importing the JSON file in the page
https://learn.microsoft.com/en-us/azure/firewall/ip-groups
Is there any screen dump that can show it?
Thanks.
Regards,
Samuel
You cannot import JSON there just CSV and it's limited to 5000 IP's so it's to much to entire file you mentioned.
Hello @RAFAŁ ŻAK ,
One of the service tags I needs is "AzureBotService".
From
https://learn.microsoft.com/en-us/azure/virtual-network/service-tags-overview
It is not available for "Can use with Azure Firewall"
Does it mean that I cannot configure the Azure Firewall with this service tag?
Thanks.
Regards,
Samuel
Exactly, you cannot use this service tag in Azure Firewall but Azure Bot Service has a few IP per region only so If you don't need all of them I would go with Azure IP Group
Hello @RAFAŁ ŻAK
Thanks for your clarification.
Why the azure public ip address json file cannot be directly imported for the Azure setting?
Then, what is the use of the Azure ip address range json file for downloading?
Thanks.
Regards,
Samuel
This file contain all Azure Public IP and and their service tag.
I would say it's not even recommended to use all of them if your services will not communicate with them.
In short, Microsoft provide one file with all IP's and you are responsible for creating policies on your firewall..
You can open this file and find what you need for your firewall rules.
Hi @Samuel Cheung ,
Did you create the Rules which meet your goal?
I just think about it again and i think you could use powershell to get list of IP's used by service for example:
$servicetags= Get-AzNetworkServiceTag -Location WestEurope
and then
$servicetags.Values | Where-Object { $_.Name -eq "AzureBotService"}
Finally, In order to automate the process you could update Firewall Rules by powershell:
https://learn.microsoft.com/en-us/azure/firewall/deploy-rules-powershell
@Samuel Cheung it has to be via ARM or Bicep or Terraform or you can create a Public IP prefix public-ip-address-prefix
create-ip-group
==
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.