Microsoft.Network azureFirewalls

Article
12/28/2022
22 minutes to read

Bicep resource definition

The azureFirewalls resource type can be deployed to:

Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Network/azureFirewalls resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.Network/azureFirewalls@2022-07-01' = {
  name: 'string'
  location: 'string'
  tags: {
    tagName1: 'tagValue1'
    tagName2: 'tagValue2'
  }
  properties: {
    additionalProperties: {}
    applicationRuleCollections: [
      {
        id: 'string'
        name: 'string'
        properties: {
          action: {
            type: 'string'
          }
          priority: int
          rules: [
            {
              description: 'string'
              fqdnTags: [
                'string'
              ]
              name: 'string'
              protocols: [
                {
                  port: int
                  protocolType: 'string'
                }
              ]
              sourceAddresses: [
                'string'
              ]
              sourceIpGroups: [
                'string'
              ]
              targetFqdns: [
                'string'
              ]
            }
          ]
        }
      }
    ]
    firewallPolicy: {
      id: 'string'
    }
    hubIPAddresses: {
      privateIPAddress: 'string'
      publicIPs: {
        addresses: [
          {
            address: 'string'
          }
        ]
        count: int
      }
    }
    ipConfigurations: [
      {
        id: 'string'
        name: 'string'
        properties: {
          publicIPAddress: {
            id: 'string'
          }
          subnet: {
            id: 'string'
          }
        }
      }
    ]
    managementIpConfiguration: {
      id: 'string'
      name: 'string'
      properties: {
        publicIPAddress: {
          id: 'string'
        }
        subnet: {
          id: 'string'
        }
      }
    }
    natRuleCollections: [
      {
        id: 'string'
        name: 'string'
        properties: {
          action: {
            type: 'string'
          }
          priority: int
          rules: [
            {
              description: 'string'
              destinationAddresses: [
                'string'
              ]
              destinationPorts: [
                'string'
              ]
              name: 'string'
              protocols: [
                'string'
              ]
              sourceAddresses: [
                'string'
              ]
              sourceIpGroups: [
                'string'
              ]
              translatedAddress: 'string'
              translatedFqdn: 'string'
              translatedPort: 'string'
            }
          ]
        }
      }
    ]
    networkRuleCollections: [
      {
        id: 'string'
        name: 'string'
        properties: {
          action: {
            type: 'string'
          }
          priority: int
          rules: [
            {
              description: 'string'
              destinationAddresses: [
                'string'
              ]
              destinationFqdns: [
                'string'
              ]
              destinationIpGroups: [
                'string'
              ]
              destinationPorts: [
                'string'
              ]
              name: 'string'
              protocols: [
                'string'
              ]
              sourceAddresses: [
                'string'
              ]
              sourceIpGroups: [
                'string'
              ]
            }
          ]
        }
      }
    ]
    sku: {
      name: 'string'
      tier: 'string'
    }
    threatIntelMode: 'string'
    virtualHub: {
      id: 'string'
    }
  }
  zones: [
    'string'
  ]
}

Property values

azureFirewalls

Name	Description	Value
name	The resource name	string (required) Character limit: 1-80 Valid characters: Alphanumerics, underscores, periods, and hyphens. Start with alphanumeric. End with alphanumeric or underscore.
location	Resource location.	string
tags	Resource tags.	Dictionary of tag names and values. See Tags in templates
properties	Properties of the azure firewall.	AzureFirewallPropertiesFormat
zones	A list of availability zones denoting where the resource needs to come from.	string[]

AzureFirewallPropertiesFormat

Name	Description	Value
additionalProperties	The additional properties used to further config this azure firewall.	object
applicationRuleCollections	Collection of application rule collections used by Azure Firewall.	AzureFirewallApplicationRuleCollection[]
firewallPolicy	The firewallPolicy associated with this azure firewall.	SubResource
hubIPAddresses	IP addresses associated with AzureFirewall.	HubIPAddresses
ipConfigurations	IP configuration of the Azure Firewall resource.	AzureFirewallIPConfiguration[]
managementIpConfiguration	IP configuration of the Azure Firewall used for management traffic.	AzureFirewallIPConfiguration
natRuleCollections	Collection of NAT rule collections used by Azure Firewall.	AzureFirewallNatRuleCollection[]
networkRuleCollections	Collection of network rule collections used by Azure Firewall.	AzureFirewallNetworkRuleCollection[]
sku	The Azure Firewall Resource SKU.	AzureFirewallSku
threatIntelMode	The operation mode for Threat Intelligence.	'Alert' 'Deny' 'Off'
virtualHub	The virtualHub to which the firewall belongs.	SubResource

AzureFirewallApplicationRuleCollection

Name	Description	Value
id	Resource ID.	string
name	The name of the resource that is unique within the Azure firewall. This name can be used to access the resource.	string
properties	Properties of the azure firewall application rule collection.	AzureFirewallApplicationRuleCollectionPropertiesForm...

AzureFirewallApplicationRuleCollectionPropertiesForm...

Name	Description	Value
action	The action type of a rule collection.	AzureFirewallRCAction
priority	Priority of the application rule collection resource.	int
rules	Collection of rules used by a application rule collection.	AzureFirewallApplicationRule[]

AzureFirewallRCAction

Name	Description	Value
type	The type of action.	'Allow' 'Deny'

AzureFirewallApplicationRule

Name	Description	Value
description	Description of the rule.	string
fqdnTags	List of FQDN Tags for this rule.	string[]
name	Name of the application rule.	string
protocols	Array of ApplicationRuleProtocols.	AzureFirewallApplicationRuleProtocol[]
sourceAddresses	List of source IP addresses for this rule.	string[]
sourceIpGroups	List of source IpGroups for this rule.	string[]
targetFqdns	List of FQDNs for this rule.	string[]

AzureFirewallApplicationRuleProtocol

Name	Description	Value
port	Port number for the protocol, cannot be greater than 64000. This field is optional.	int
protocolType	Protocol type.	'Http' 'Https' 'Mssql'

SubResource

Name	Description	Value
id	Resource ID.	string

HubIPAddresses

Name	Description	Value
privateIPAddress	Private IP Address associated with azure firewall.	string
publicIPs	Public IP addresses associated with azure firewall.	HubPublicIPAddresses

HubPublicIPAddresses

Name	Description	Value
addresses	The list of Public IP addresses associated with azure firewall or IP addresses to be retained.	AzureFirewallPublicIPAddress[]
count	The number of Public IP addresses associated with azure firewall.	int

AzureFirewallPublicIPAddress

Name	Description	Value
address	Public IP Address value.	string

AzureFirewallIPConfiguration

Name	Description	Value
id	Resource ID.	string
name	Name of the resource that is unique within a resource group. This name can be used to access the resource.	string
properties	Properties of the azure firewall IP configuration.	AzureFirewallIPConfigurationPropertiesFormat

AzureFirewallIPConfigurationPropertiesFormat

Name	Description	Value
publicIPAddress	Reference to the PublicIP resource. This field is a mandatory input if subnet is not null.	SubResource
subnet	Reference to the subnet resource. This resource must be named 'AzureFirewallSubnet' or 'AzureFirewallManagementSubnet'.	SubResource

AzureFirewallNatRuleCollection

Name	Description	Value
id	Resource ID.	string
name	The name of the resource that is unique within the Azure firewall. This name can be used to access the resource.	string
properties	Properties of the azure firewall NAT rule collection.	AzureFirewallNatRuleCollectionProperties

AzureFirewallNatRuleCollectionProperties

Name	Description	Value
action	The action type of a NAT rule collection.	AzureFirewallNatRCAction
priority	Priority of the NAT rule collection resource.	int
rules	Collection of rules used by a NAT rule collection.	AzureFirewallNatRule[]

AzureFirewallNatRCAction

Name	Description	Value
type	The type of action.	'Dnat' 'Snat'

AzureFirewallNatRule

Name	Description	Value
description	Description of the rule.	string
destinationAddresses	List of destination IP addresses for this rule. Supports IP ranges, prefixes, and service tags.	string[]
destinationPorts	List of destination ports.	string[]
name	Name of the NAT rule.	string
protocols	Array of AzureFirewallNetworkRuleProtocols applicable to this NAT rule.	String array containing any of: 'Any' 'ICMP' 'TCP' 'UDP'
sourceAddresses	List of source IP addresses for this rule.	string[]
sourceIpGroups	List of source IpGroups for this rule.	string[]
translatedAddress	The translated address for this NAT rule.	string
translatedFqdn	The translated FQDN for this NAT rule.	string
translatedPort	The translated port for this NAT rule.	string

AzureFirewallNetworkRuleCollection

Name	Description	Value
id	Resource ID.	string
name	The name of the resource that is unique within the Azure firewall. This name can be used to access the resource.	string
properties	Properties of the azure firewall network rule collection.	AzureFirewallNetworkRuleCollectionPropertiesFormat

AzureFirewallNetworkRuleCollectionPropertiesFormat

Name	Description	Value
action	The action type of a rule collection.	AzureFirewallRCAction
priority	Priority of the network rule collection resource.	int
rules	Collection of rules used by a network rule collection.	AzureFirewallNetworkRule[]

AzureFirewallNetworkRule

Name	Description	Value
description	Description of the rule.	string
destinationAddresses	List of destination IP addresses.	string[]
destinationFqdns	List of destination FQDNs.	string[]
destinationIpGroups	List of destination IpGroups for this rule.	string[]
destinationPorts	List of destination ports.	string[]
name	Name of the network rule.	string
protocols	Array of AzureFirewallNetworkRuleProtocols.	String array containing any of: 'Any' 'ICMP' 'TCP' 'UDP'
sourceAddresses	List of source IP addresses for this rule.	string[]
sourceIpGroups	List of source IpGroups for this rule.	string[]

AzureFirewallSku

Name	Description	Value
name	Name of an Azure Firewall SKU.	'AZFW_Hub' 'AZFW_VNet'
tier	Tier of an Azure Firewall.	'Basic' 'Premium' 'Standard'

Quickstart templates

The following quickstart templates deploy this resource type.

Template	Description
Use Azure Firewall as a DNS Proxy in a Hub & Spoke topology	This sample show how to deploy a hub-spoke topology in Azure using the Azure Firewall. The hub virtual network acts as a central point of connectivity to many spoke virtual networks that are connected to hub virtual network via virtual network peering.
Create a Firewall and FirewallPolicy with Rules and Ipgroups	This template deploys an Azure Firewall with Firewall Policy (including multiple application and network rules) referencing IP Groups in application and network rules.
Create a Firewall, FirewallPolicy with Explicit Proxy	This template creates an Azure Firewall, FirewalllPolicy with Explicit Proxy and Network Rules with IpGroups. Also, includes a Linux Jumpbox vm setup
Create a Firewall with FirewallPolicy and IpGroups	This template creates an Azure Firewall with FirewalllPolicy referencing Network Rules with IpGroups. Also, includes a Linux Jumpbox vm setup
Create an Azure Firewall with IpGroups	This template creates an Azure Firewall with Application and Network Rules referring to IP Groups. Also, includes a Linux Jumpbox vm setup
Create an Azure Firewall with Availability Zones	This template creates an Azure Firewall with Availability Zones and any number of Public IPs in a virtual network and sets up 1 sample application rule and 1 sample network rule
Create an Azure Firewall sandbox with forced tunneling	This template creates an Azure Firewall sandbox (Linux) with one firewall force tunneled through another firewall in a peered VNET
Testing environment for Azure Firewall Premium	This template creates an Azure Firewall Premium and Firewall Policy with premium features such as Intrusion Inspection Detection (IDPS), TLS inspection and Web Category filtering
Create a sandbox setup of Azure Firewall with Linux VMs	This template creates a virtual network with 3 subnets (server subnet, jumpbox subet and AzureFirewall subnet), a jumpbox VM with public IP, A server VM, UDR route to point to Azure Firewall for the Server Subnet and an Azure Firewall with 1 or more Public IP addresses, 1 sample application rule, 1 sample network rule and default private ranges
Create a sandbox setup with Firewall Policy	This template creates a virtual network with 3 subnets (server subnet, jumpbox subet and AzureFirewall subnet), a jumpbox VM with public IP, A server VM, UDR route to point to Azure Firewall for the Server Subnet and an Azure Firewall with 1 or more Public IP addresses. Also creates a Firewall policy with 1 sample application rule, 1 sample network rule and default private ranges
Create a sandbox setup of Azure Firewall with Zones	This template creates a virtual network with three subnets (server subnet, jumpbox subnet, and Azure Firewall subnet), a jumpbox VM with public IP, A server VM, UDR route to point to Azure Firewall for the ServerSubnet,an Azure Firewall with one or more Public IP addresses, one sample application rule, and one sample network rule and Azure Firewall in Availability Zones 1, 2, and 3.
Create an Azure Firewall with multiple IP public addresses	This template creates an Azure Firewall with two public IP addresses and two Windows Server 2019 servers to test.
Secured virtual hubs	This template creates a secured virtual hub using Azure Firewall to secure your cloud network traffic destined to the Internet.

ARM template resource definition

The azureFirewalls resource type can be deployed to:

Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Network/azureFirewalls resource, add the following JSON to your template.

{
  "type": "Microsoft.Network/azureFirewalls",
  "apiVersion": "2022-07-01",
  "name": "string",
  "location": "string",
  "tags": {
    "tagName1": "tagValue1",
    "tagName2": "tagValue2"
  },
  "properties": {
    "additionalProperties": {},
    "applicationRuleCollections": [
      {
        "id": "string",
        "name": "string",
        "properties": {
          "action": {
            "type": "string"
          },
          "priority": "int",
          "rules": [
            {
              "description": "string",
              "fqdnTags": [ "string" ],
              "name": "string",
              "protocols": [
                {
                  "port": "int",
                  "protocolType": "string"
                }
              ],
              "sourceAddresses": [ "string" ],
              "sourceIpGroups": [ "string" ],
              "targetFqdns": [ "string" ]
            }
          ]
        }
      }
    ],
    "firewallPolicy": {
      "id": "string"
    },
    "hubIPAddresses": {
      "privateIPAddress": "string",
      "publicIPs": {
        "addresses": [
          {
            "address": "string"
          }
        ],
        "count": "int"
      }
    },
    "ipConfigurations": [
      {
        "id": "string",
        "name": "string",
        "properties": {
          "publicIPAddress": {
            "id": "string"
          },
          "subnet": {
            "id": "string"
          }
        }
      }
    ],
    "managementIpConfiguration": {
      "id": "string",
      "name": "string",
      "properties": {
        "publicIPAddress": {
          "id": "string"
        },
        "subnet": {
          "id": "string"
        }
      }
    },
    "natRuleCollections": [
      {
        "id": "string",
        "name": "string",
        "properties": {
          "action": {
            "type": "string"
          },
          "priority": "int",
          "rules": [
            {
              "description": "string",
              "destinationAddresses": [ "string" ],
              "destinationPorts": [ "string" ],
              "name": "string",
              "protocols": [ "string" ],
              "sourceAddresses": [ "string" ],
              "sourceIpGroups": [ "string" ],
              "translatedAddress": "string",
              "translatedFqdn": "string",
              "translatedPort": "string"
            }
          ]
        }
      }
    ],
    "networkRuleCollections": [
      {
        "id": "string",
        "name": "string",
        "properties": {
          "action": {
            "type": "string"
          },
          "priority": "int",
          "rules": [
            {
              "description": "string",
              "destinationAddresses": [ "string" ],
              "destinationFqdns": [ "string" ],
              "destinationIpGroups": [ "string" ],
              "destinationPorts": [ "string" ],
              "name": "string",
              "protocols": [ "string" ],
              "sourceAddresses": [ "string" ],
              "sourceIpGroups": [ "string" ]
            }
          ]
        }
      }
    ],
    "sku": {
      "name": "string",
      "tier": "string"
    },
    "threatIntelMode": "string",
    "virtualHub": {
      "id": "string"
    }
  },
  "zones": [ "string" ]
}

Property values

azureFirewalls

Name	Description	Value
type	The resource type	'Microsoft.Network/azureFirewalls'
apiVersion	The resource api version	'2022-07-01'
name	The resource name	string (required) Character limit: 1-80 Valid characters: Alphanumerics, underscores, periods, and hyphens. Start with alphanumeric. End with alphanumeric or underscore.
location	Resource location.	string
tags	Resource tags.	Dictionary of tag names and values. See Tags in templates
properties	Properties of the azure firewall.	AzureFirewallPropertiesFormat
zones	A list of availability zones denoting where the resource needs to come from.	string[]

AzureFirewallPropertiesFormat

Name	Description	Value
additionalProperties	The additional properties used to further config this azure firewall.	object
applicationRuleCollections	Collection of application rule collections used by Azure Firewall.	AzureFirewallApplicationRuleCollection[]
firewallPolicy	The firewallPolicy associated with this azure firewall.	SubResource
hubIPAddresses	IP addresses associated with AzureFirewall.	HubIPAddresses
ipConfigurations	IP configuration of the Azure Firewall resource.	AzureFirewallIPConfiguration[]
managementIpConfiguration	IP configuration of the Azure Firewall used for management traffic.	AzureFirewallIPConfiguration
natRuleCollections	Collection of NAT rule collections used by Azure Firewall.	AzureFirewallNatRuleCollection[]
networkRuleCollections	Collection of network rule collections used by Azure Firewall.	AzureFirewallNetworkRuleCollection[]
sku	The Azure Firewall Resource SKU.	AzureFirewallSku
threatIntelMode	The operation mode for Threat Intelligence.	'Alert' 'Deny' 'Off'
virtualHub	The virtualHub to which the firewall belongs.	SubResource

AzureFirewallApplicationRuleCollection

Name	Description	Value
id	Resource ID.	string
name	The name of the resource that is unique within the Azure firewall. This name can be used to access the resource.	string
properties	Properties of the azure firewall application rule collection.	AzureFirewallApplicationRuleCollectionPropertiesForm...

AzureFirewallApplicationRuleCollectionPropertiesForm...

Name	Description	Value
action	The action type of a rule collection.	AzureFirewallRCAction
priority	Priority of the application rule collection resource.	int
rules	Collection of rules used by a application rule collection.	AzureFirewallApplicationRule[]

AzureFirewallRCAction

Name	Description	Value
type	The type of action.	'Allow' 'Deny'

AzureFirewallApplicationRule

Name	Description	Value
description	Description of the rule.	string
fqdnTags	List of FQDN Tags for this rule.	string[]
name	Name of the application rule.	string
protocols	Array of ApplicationRuleProtocols.	AzureFirewallApplicationRuleProtocol[]
sourceAddresses	List of source IP addresses for this rule.	string[]
sourceIpGroups	List of source IpGroups for this rule.	string[]
targetFqdns	List of FQDNs for this rule.	string[]

AzureFirewallApplicationRuleProtocol

Name	Description	Value
port	Port number for the protocol, cannot be greater than 64000. This field is optional.	int
protocolType	Protocol type.	'Http' 'Https' 'Mssql'

SubResource

Name	Description	Value
id	Resource ID.	string

HubIPAddresses

Name	Description	Value
privateIPAddress	Private IP Address associated with azure firewall.	string
publicIPs	Public IP addresses associated with azure firewall.	HubPublicIPAddresses

HubPublicIPAddresses

Name	Description	Value
addresses	The list of Public IP addresses associated with azure firewall or IP addresses to be retained.	AzureFirewallPublicIPAddress[]
count	The number of Public IP addresses associated with azure firewall.	int

AzureFirewallPublicIPAddress

Name	Description	Value
address	Public IP Address value.	string

AzureFirewallIPConfiguration

Name	Description	Value
id	Resource ID.	string
name	Name of the resource that is unique within a resource group. This name can be used to access the resource.	string
properties	Properties of the azure firewall IP configuration.	AzureFirewallIPConfigurationPropertiesFormat

AzureFirewallIPConfigurationPropertiesFormat

Name	Description	Value
publicIPAddress	Reference to the PublicIP resource. This field is a mandatory input if subnet is not null.	SubResource
subnet	Reference to the subnet resource. This resource must be named 'AzureFirewallSubnet' or 'AzureFirewallManagementSubnet'.	SubResource

AzureFirewallNatRuleCollection

Name	Description	Value
id	Resource ID.	string
name	The name of the resource that is unique within the Azure firewall. This name can be used to access the resource.	string
properties	Properties of the azure firewall NAT rule collection.	AzureFirewallNatRuleCollectionProperties

AzureFirewallNatRuleCollectionProperties

Name	Description	Value
action	The action type of a NAT rule collection.	AzureFirewallNatRCAction
priority	Priority of the NAT rule collection resource.	int
rules	Collection of rules used by a NAT rule collection.	AzureFirewallNatRule[]

AzureFirewallNatRCAction

Name	Description	Value
type	The type of action.	'Dnat' 'Snat'

AzureFirewallNatRule

Name	Description	Value
description	Description of the rule.	string
destinationAddresses	List of destination IP addresses for this rule. Supports IP ranges, prefixes, and service tags.	string[]
destinationPorts	List of destination ports.	string[]
name	Name of the NAT rule.	string
protocols	Array of AzureFirewallNetworkRuleProtocols applicable to this NAT rule.	String array containing any of: 'Any' 'ICMP' 'TCP' 'UDP'
sourceAddresses	List of source IP addresses for this rule.	string[]
sourceIpGroups	List of source IpGroups for this rule.	string[]
translatedAddress	The translated address for this NAT rule.	string
translatedFqdn	The translated FQDN for this NAT rule.	string
translatedPort	The translated port for this NAT rule.	string

AzureFirewallNetworkRuleCollection

Name	Description	Value
id	Resource ID.	string
name	The name of the resource that is unique within the Azure firewall. This name can be used to access the resource.	string
properties	Properties of the azure firewall network rule collection.	AzureFirewallNetworkRuleCollectionPropertiesFormat

AzureFirewallNetworkRuleCollectionPropertiesFormat

Name	Description	Value
action	The action type of a rule collection.	AzureFirewallRCAction
priority	Priority of the network rule collection resource.	int
rules	Collection of rules used by a network rule collection.	AzureFirewallNetworkRule[]

AzureFirewallNetworkRule

Name	Description	Value
description	Description of the rule.	string
destinationAddresses	List of destination IP addresses.	string[]
destinationFqdns	List of destination FQDNs.	string[]
destinationIpGroups	List of destination IpGroups for this rule.	string[]
destinationPorts	List of destination ports.	string[]
name	Name of the network rule.	string
protocols	Array of AzureFirewallNetworkRuleProtocols.	String array containing any of: 'Any' 'ICMP' 'TCP' 'UDP'
sourceAddresses	List of source IP addresses for this rule.	string[]
sourceIpGroups	List of source IpGroups for this rule.	string[]

AzureFirewallSku

Name	Description	Value
name	Name of an Azure Firewall SKU.	'AZFW_Hub' 'AZFW_VNet'
tier	Tier of an Azure Firewall.	'Basic' 'Premium' 'Standard'

Quickstart templates

The following quickstart templates deploy this resource type.

Template	Description
Use Azure Firewall as a DNS Proxy in a Hub & Spoke topology	This sample show how to deploy a hub-spoke topology in Azure using the Azure Firewall. The hub virtual network acts as a central point of connectivity to many spoke virtual networks that are connected to hub virtual network via virtual network peering.
Create a Firewall and FirewallPolicy with Rules and Ipgroups	This template deploys an Azure Firewall with Firewall Policy (including multiple application and network rules) referencing IP Groups in application and network rules.
Create a Firewall, FirewallPolicy with Explicit Proxy	This template creates an Azure Firewall, FirewalllPolicy with Explicit Proxy and Network Rules with IpGroups. Also, includes a Linux Jumpbox vm setup
Create a Firewall with FirewallPolicy and IpGroups	This template creates an Azure Firewall with FirewalllPolicy referencing Network Rules with IpGroups. Also, includes a Linux Jumpbox vm setup
Create an Azure Firewall with IpGroups	This template creates an Azure Firewall with Application and Network Rules referring to IP Groups. Also, includes a Linux Jumpbox vm setup
Create an Azure Firewall with Availability Zones	This template creates an Azure Firewall with Availability Zones and any number of Public IPs in a virtual network and sets up 1 sample application rule and 1 sample network rule
Create an Azure Firewall sandbox with forced tunneling	This template creates an Azure Firewall sandbox (Linux) with one firewall force tunneled through another firewall in a peered VNET
Testing environment for Azure Firewall Premium	This template creates an Azure Firewall Premium and Firewall Policy with premium features such as Intrusion Inspection Detection (IDPS), TLS inspection and Web Category filtering
Create a sandbox setup of Azure Firewall with Linux VMs	This template creates a virtual network with 3 subnets (server subnet, jumpbox subet and AzureFirewall subnet), a jumpbox VM with public IP, A server VM, UDR route to point to Azure Firewall for the Server Subnet and an Azure Firewall with 1 or more Public IP addresses, 1 sample application rule, 1 sample network rule and default private ranges
Create a sandbox setup with Firewall Policy	This template creates a virtual network with 3 subnets (server subnet, jumpbox subet and AzureFirewall subnet), a jumpbox VM with public IP, A server VM, UDR route to point to Azure Firewall for the Server Subnet and an Azure Firewall with 1 or more Public IP addresses. Also creates a Firewall policy with 1 sample application rule, 1 sample network rule and default private ranges
Create a sandbox setup of Azure Firewall with Zones	This template creates a virtual network with three subnets (server subnet, jumpbox subnet, and Azure Firewall subnet), a jumpbox VM with public IP, A server VM, UDR route to point to Azure Firewall for the ServerSubnet,an Azure Firewall with one or more Public IP addresses, one sample application rule, and one sample network rule and Azure Firewall in Availability Zones 1, 2, and 3.
Create an Azure Firewall with multiple IP public addresses	This template creates an Azure Firewall with two public IP addresses and two Windows Server 2019 servers to test.
Secured virtual hubs	This template creates a secured virtual hub using Azure Firewall to secure your cloud network traffic destined to the Internet.

Terraform (AzAPI provider) resource definition

The azureFirewalls resource type can be deployed to:

Resource groups

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Network/azureFirewalls resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.Network/azureFirewalls@2022-07-01"
  name = "string"
  location = "string"
  parent_id = "string"
  tags = {
    tagName1 = "tagValue1"
    tagName2 = "tagValue2"
  }
  body = jsonencode({
    properties = {
      additionalProperties = {}
      applicationRuleCollections = [
        {
          id = "string"
          name = "string"
          properties = {
            action = {
              type = "string"
            }
            priority = int
            rules = [
              {
                description = "string"
                fqdnTags = [
                  "string"
                ]
                name = "string"
                protocols = [
                  {
                    port = int
                    protocolType = "string"
                  }
                ]
                sourceAddresses = [
                  "string"
                ]
                sourceIpGroups = [
                  "string"
                ]
                targetFqdns = [
                  "string"
                ]
              }
            ]
          }
        }
      ]
      firewallPolicy = {
        id = "string"
      }
      hubIPAddresses = {
        privateIPAddress = "string"
        publicIPs = {
          addresses = [
            {
              address = "string"
            }
          ]
          count = int
        }
      }
      ipConfigurations = [
        {
          id = "string"
          name = "string"
          properties = {
            publicIPAddress = {
              id = "string"
            }
            subnet = {
              id = "string"
            }
          }
        }
      ]
      managementIpConfiguration = {
        id = "string"
        name = "string"
        properties = {
          publicIPAddress = {
            id = "string"
          }
          subnet = {
            id = "string"
          }
        }
      }
      natRuleCollections = [
        {
          id = "string"
          name = "string"
          properties = {
            action = {
              type = "string"
            }
            priority = int
            rules = [
              {
                description = "string"
                destinationAddresses = [
                  "string"
                ]
                destinationPorts = [
                  "string"
                ]
                name = "string"
                protocols = [
                  "string"
                ]
                sourceAddresses = [
                  "string"
                ]
                sourceIpGroups = [
                  "string"
                ]
                translatedAddress = "string"
                translatedFqdn = "string"
                translatedPort = "string"
              }
            ]
          }
        }
      ]
      networkRuleCollections = [
        {
          id = "string"
          name = "string"
          properties = {
            action = {
              type = "string"
            }
            priority = int
            rules = [
              {
                description = "string"
                destinationAddresses = [
                  "string"
                ]
                destinationFqdns = [
                  "string"
                ]
                destinationIpGroups = [
                  "string"
                ]
                destinationPorts = [
                  "string"
                ]
                name = "string"
                protocols = [
                  "string"
                ]
                sourceAddresses = [
                  "string"
                ]
                sourceIpGroups = [
                  "string"
                ]
              }
            ]
          }
        }
      ]
      sku = {
        name = "string"
        tier = "string"
      }
      threatIntelMode = "string"
      virtualHub = {
        id = "string"
      }
    }
    zones = [
      "string"
    ]
  })
}

Property values

azureFirewalls

Name	Description	Value
type	The resource type	"Microsoft.Network/azureFirewalls@2022-07-01"
name	The resource name	string (required) Character limit: 1-80 Valid characters: Alphanumerics, underscores, periods, and hyphens. Start with alphanumeric. End with alphanumeric or underscore.
location	Resource location.	string
parent_id	To deploy to a resource group, use the ID of that resource group.	string (required)
tags	Resource tags.	Dictionary of tag names and values.
properties	Properties of the azure firewall.	AzureFirewallPropertiesFormat
zones	A list of availability zones denoting where the resource needs to come from.	string[]

AzureFirewallPropertiesFormat

Name	Description	Value
additionalProperties	The additional properties used to further config this azure firewall.	object
applicationRuleCollections	Collection of application rule collections used by Azure Firewall.	AzureFirewallApplicationRuleCollection[]
firewallPolicy	The firewallPolicy associated with this azure firewall.	SubResource
hubIPAddresses	IP addresses associated with AzureFirewall.	HubIPAddresses
ipConfigurations	IP configuration of the Azure Firewall resource.	AzureFirewallIPConfiguration[]
managementIpConfiguration	IP configuration of the Azure Firewall used for management traffic.	AzureFirewallIPConfiguration
natRuleCollections	Collection of NAT rule collections used by Azure Firewall.	AzureFirewallNatRuleCollection[]
networkRuleCollections	Collection of network rule collections used by Azure Firewall.	AzureFirewallNetworkRuleCollection[]
sku	The Azure Firewall Resource SKU.	AzureFirewallSku
threatIntelMode	The operation mode for Threat Intelligence.	"Alert" "Deny" "Off"
virtualHub	The virtualHub to which the firewall belongs.	SubResource

AzureFirewallApplicationRuleCollection

Name	Description	Value
id	Resource ID.	string
name	The name of the resource that is unique within the Azure firewall. This name can be used to access the resource.	string
properties	Properties of the azure firewall application rule collection.	AzureFirewallApplicationRuleCollectionPropertiesForm...

AzureFirewallApplicationRuleCollectionPropertiesForm...

Name	Description	Value
action	The action type of a rule collection.	AzureFirewallRCAction
priority	Priority of the application rule collection resource.	int
rules	Collection of rules used by a application rule collection.	AzureFirewallApplicationRule[]

AzureFirewallRCAction

Name	Description	Value
type	The type of action.	"Allow" "Deny"

AzureFirewallApplicationRule

Name	Description	Value
description	Description of the rule.	string
fqdnTags	List of FQDN Tags for this rule.	string[]
name	Name of the application rule.	string
protocols	Array of ApplicationRuleProtocols.	AzureFirewallApplicationRuleProtocol[]
sourceAddresses	List of source IP addresses for this rule.	string[]
sourceIpGroups	List of source IpGroups for this rule.	string[]
targetFqdns	List of FQDNs for this rule.	string[]

AzureFirewallApplicationRuleProtocol

Name	Description	Value
port	Port number for the protocol, cannot be greater than 64000. This field is optional.	int
protocolType	Protocol type.	"Http" "Https" "Mssql"

SubResource

Name	Description	Value
id	Resource ID.	string

HubIPAddresses

Name	Description	Value
privateIPAddress	Private IP Address associated with azure firewall.	string
publicIPs	Public IP addresses associated with azure firewall.	HubPublicIPAddresses

HubPublicIPAddresses

Name	Description	Value
addresses	The list of Public IP addresses associated with azure firewall or IP addresses to be retained.	AzureFirewallPublicIPAddress[]
count	The number of Public IP addresses associated with azure firewall.	int

AzureFirewallPublicIPAddress

Name	Description	Value
address	Public IP Address value.	string

AzureFirewallIPConfiguration

Name	Description	Value
id	Resource ID.	string
name	Name of the resource that is unique within a resource group. This name can be used to access the resource.	string
properties	Properties of the azure firewall IP configuration.	AzureFirewallIPConfigurationPropertiesFormat

AzureFirewallIPConfigurationPropertiesFormat

Name	Description	Value
publicIPAddress	Reference to the PublicIP resource. This field is a mandatory input if subnet is not null.	SubResource
subnet	Reference to the subnet resource. This resource must be named 'AzureFirewallSubnet' or 'AzureFirewallManagementSubnet'.	SubResource

AzureFirewallNatRuleCollection

Name	Description	Value
id	Resource ID.	string
name	The name of the resource that is unique within the Azure firewall. This name can be used to access the resource.	string
properties	Properties of the azure firewall NAT rule collection.	AzureFirewallNatRuleCollectionProperties

AzureFirewallNatRuleCollectionProperties

Name	Description	Value
action	The action type of a NAT rule collection.	AzureFirewallNatRCAction
priority	Priority of the NAT rule collection resource.	int
rules	Collection of rules used by a NAT rule collection.	AzureFirewallNatRule[]

AzureFirewallNatRCAction

Name	Description	Value
type	The type of action.	"Dnat" "Snat"

AzureFirewallNatRule

Name	Description	Value
description	Description of the rule.	string
destinationAddresses	List of destination IP addresses for this rule. Supports IP ranges, prefixes, and service tags.	string[]
destinationPorts	List of destination ports.	string[]
name	Name of the NAT rule.	string
protocols	Array of AzureFirewallNetworkRuleProtocols applicable to this NAT rule.	String array containing any of: "Any" "ICMP" "TCP" "UDP"
sourceAddresses	List of source IP addresses for this rule.	string[]
sourceIpGroups	List of source IpGroups for this rule.	string[]
translatedAddress	The translated address for this NAT rule.	string
translatedFqdn	The translated FQDN for this NAT rule.	string
translatedPort	The translated port for this NAT rule.	string

AzureFirewallNetworkRuleCollection

Name	Description	Value
id	Resource ID.	string
name	The name of the resource that is unique within the Azure firewall. This name can be used to access the resource.	string
properties	Properties of the azure firewall network rule collection.	AzureFirewallNetworkRuleCollectionPropertiesFormat

AzureFirewallNetworkRuleCollectionPropertiesFormat

Name	Description	Value
action	The action type of a rule collection.	AzureFirewallRCAction
priority	Priority of the network rule collection resource.	int
rules	Collection of rules used by a network rule collection.	AzureFirewallNetworkRule[]

AzureFirewallNetworkRule

Name	Description	Value
description	Description of the rule.	string
destinationAddresses	List of destination IP addresses.	string[]
destinationFqdns	List of destination FQDNs.	string[]
destinationIpGroups	List of destination IpGroups for this rule.	string[]
destinationPorts	List of destination ports.	string[]
name	Name of the network rule.	string
protocols	Array of AzureFirewallNetworkRuleProtocols.	String array containing any of: "Any" "ICMP" "TCP" "UDP"
sourceAddresses	List of source IP addresses for this rule.	string[]
sourceIpGroups	List of source IpGroups for this rule.	string[]

AzureFirewallSku

Name	Description	Value
name	Name of an Azure Firewall SKU.	"AZFW_Hub" "AZFW_VNet"
tier	Tier of an Azure Firewall.	"Basic" "Premium" "Standard"

Microsoft.Network azureFirewalls

Bicep resource definition

Resource format

Property values

azureFirewalls

AzureFirewallPropertiesFormat

AzureFirewallApplicationRuleCollection

AzureFirewallApplicationRuleCollectionPropertiesForm...

AzureFirewallRCAction

AzureFirewallApplicationRule

AzureFirewallApplicationRuleProtocol

SubResource

HubIPAddresses

HubPublicIPAddresses

AzureFirewallPublicIPAddress

AzureFirewallIPConfiguration

AzureFirewallIPConfigurationPropertiesFormat

AzureFirewallNatRuleCollection

AzureFirewallNatRuleCollectionProperties

AzureFirewallNatRCAction

AzureFirewallNatRule

AzureFirewallNetworkRuleCollection

AzureFirewallNetworkRuleCollectionPropertiesFormat

AzureFirewallNetworkRule

AzureFirewallSku

Quickstart templates

ARM template resource definition

Resource format

Property values

azureFirewalls

AzureFirewallPropertiesFormat

AzureFirewallApplicationRuleCollection

AzureFirewallApplicationRuleCollectionPropertiesForm...

AzureFirewallRCAction

AzureFirewallApplicationRule

AzureFirewallApplicationRuleProtocol

SubResource

HubIPAddresses

HubPublicIPAddresses

AzureFirewallPublicIPAddress

AzureFirewallIPConfiguration

AzureFirewallIPConfigurationPropertiesFormat

AzureFirewallNatRuleCollection

AzureFirewallNatRuleCollectionProperties

AzureFirewallNatRCAction

AzureFirewallNatRule

AzureFirewallNetworkRuleCollection

AzureFirewallNetworkRuleCollectionPropertiesFormat

AzureFirewallNetworkRule

AzureFirewallSku

Quickstart templates

Terraform (AzAPI provider) resource definition

Resource format

Property values

azureFirewalls

AzureFirewallPropertiesFormat

AzureFirewallApplicationRuleCollection

AzureFirewallApplicationRuleCollectionPropertiesForm...

AzureFirewallRCAction

AzureFirewallApplicationRule

AzureFirewallApplicationRuleProtocol

SubResource

HubIPAddresses

HubPublicIPAddresses

AzureFirewallPublicIPAddress

AzureFirewallIPConfiguration

AzureFirewallIPConfigurationPropertiesFormat

AzureFirewallNatRuleCollection

AzureFirewallNatRuleCollectionProperties

AzureFirewallNatRCAction

AzureFirewallNatRule

AzureFirewallNetworkRuleCollection

AzureFirewallNetworkRuleCollectionPropertiesFormat

AzureFirewallNetworkRule

AzureFirewallSku

Additional resources

Additional resources