PaloAltoNetworks.Cloudngfw firewalls

Bicep resource definition

The firewalls resource type can be deployed with operations that target:

Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a PaloAltoNetworks.Cloudngfw/firewalls resource, add the following Bicep to your template.

resource symbolicname 'PaloAltoNetworks.Cloudngfw/firewalls@2026-05-11-preview' = {
  identity: {
    type: 'string'
    userAssignedIdentities: {
      {customized property}: {
        clientId: 'string'
        principalId: 'string'
      }
    }
  }
  location: 'string'
  name: 'string'
  properties: {
    associatedRulestack: {
      location: 'string'
      resourceId: 'string'
      rulestackId: 'string'
    }
    dnsSettings: {
      dnsServers: [
        {
          address: 'string'
          resourceId: 'string'
        }
      ]
      enabledDnsType: 'string'
      enableDnsProxy: 'string'
    }
    firewallSku: 'string'
    frontEndSettings: [
      {
        backendConfiguration: {
          address: {
            address: 'string'
            resourceId: 'string'
          }
          port: 'string'
        }
        frontendConfiguration: {
          address: {
            address: 'string'
            resourceId: 'string'
          }
          port: 'string'
        }
        name: 'string'
        protocol: 'string'
      }
    ]
    isPanoramaManaged: 'string'
    isStrataCloudManaged: 'string'
    marketplaceDetails: {
      marketplaceSubscriptionStatus: 'string'
      offerId: 'string'
      publisherId: 'string'
    }
    networkProfile: {
      egressNatIp: [
        {
          address: 'string'
          resourceId: 'string'
        }
      ]
      enableEgressNat: 'string'
      networkType: 'string'
      privateSourceNatRulesDestination: [
        'string'
      ]
      publicIps: [
        {
          address: 'string'
          resourceId: 'string'
        }
      ]
      trustedRanges: [
        'string'
      ]
      vnetConfiguration: {
        ipOfTrustSubnetForUdr: {
          address: 'string'
          resourceId: 'string'
        }
        trustSubnet: {
          addressSpace: 'string'
          resourceId: 'string'
        }
        unTrustSubnet: {
          addressSpace: 'string'
          resourceId: 'string'
        }
        vnet: {
          addressSpace: 'string'
          resourceId: 'string'
        }
      }
      vwanConfiguration: {
        ipOfTrustSubnetForUdr: {
          address: 'string'
          resourceId: 'string'
        }
        networkVirtualApplianceId: 'string'
        trustSubnet: {
          addressSpace: 'string'
          resourceId: 'string'
        }
        unTrustSubnet: {
          addressSpace: 'string'
          resourceId: 'string'
        }
        vHub: {
          addressSpace: 'string'
          resourceId: 'string'
        }
      }
    }
    panEtag: 'string'
    panoramaConfig: {
      configString: 'string'
    }
    planData: {
      billingCycle: 'string'
      planId: 'string'
      usageType: 'string'
    }
    strataCloudManagerConfig: {
      cloudManagerName: 'string'
    }
  }
  tags: {
    {customized property}: 'string'
  }
}

Property Values

PaloAltoNetworks.Cloudngfw/firewalls

Name	Description	Value
identity	The managed service identities assigned to this resource.	AzureResourceManagerManagedIdentityProperties
location	The geo-location where the resource lives	string (required)
name	The resource name	string Constraints: Pattern = `^(?![-_])(?!.[-_]{2})(?!.[-_]$)[a-zA-Z0-9][a-zA-Z0-9-]{0,127}$` (required)
properties	The resource-specific properties for this resource.	FirewallDeploymentProperties (required)
tags	Resource tags	Dictionary of tag names and values. See Tags in templates

AzureResourceManagerManagedIdentityProperties

Name	Description	Value
type	The type of managed identity assigned to this resource.	'None' 'SystemAssigned' 'SystemAssigned,UserAssigned' 'UserAssigned' (required)
userAssignedIdentities	The identities assigned to this resource by the user.	AzureResourceManagerManagedIdentityPropertiesUserAssignedIdentities

AzureResourceManagerManagedIdentityPropertiesUserAssignedIdentities

Name	Description	Value

AzureResourceManagerUserAssignedIdentity

Name	Description	Value
clientId	The active directory client identifier for this principal.	string
principalId	The active directory identifier for this principal.	string

DNSSettings

Name	Description	Value
dnsServers	List of IPs associated with the Firewall	IPAddress[]
enabledDnsType	Enabled DNS proxy type, disabled by default	'AZURE' 'CUSTOM'
enableDnsProxy	Enable DNS proxy, disabled by default	'DISABLED' 'ENABLED'

EndpointConfiguration

Name	Description	Value
address	Address Space	IPAddress (required)
port	port ID	string (required)

FirewallDeploymentProperties

Name	Description	Value
associatedRulestack	Associated Rulestack	RulestackDetails
dnsSettings	DNS settings for Firewall	DNSSettings (required)
firewallSku	Firewall SKU type, Default will be STANDARD.	string
frontEndSettings	Frontend settings for Firewall	FrontendSetting[]
isPanoramaManaged	Panorama Managed: Default is False. Default will be CloudSec managed	'FALSE' 'TRUE'
isStrataCloudManaged	Strata Cloud Managed: Default is False. Default will be CloudSec managed	'FALSE' 'TRUE'
marketplaceDetails	Marketplace details	MarketplaceDetails (required)
networkProfile	Network settings	NetworkProfile (required)
panEtag	panEtag info	string
panoramaConfig	Panorama Configuration	PanoramaConfig
planData	Billing plan information.	PlanData (required)
strataCloudManagerConfig	Strata Cloud Manager Configuration, only applicable if Strata Cloud Manager is selected.	StrataCloudManagerConfig

FrontendSetting

Name	Description	Value
backendConfiguration	Backend configurations	EndpointConfiguration (required)
frontendConfiguration	Frontend configurations	EndpointConfiguration (required)
name	Settings name	string (required)
protocol	Protocol Type	'TCP' 'UDP' (required)

IPAddress

Name	Description	Value
address	Address value	string
resourceId	Resource Id	string

IPAddressSpace

Name	Description	Value
addressSpace	Address Space	string
resourceId	Resource Id	string

MarketplaceDetails

Name	Description	Value
marketplaceSubscriptionStatus	Marketplace Subscription Status	'FulfillmentRequested' 'NotStarted' 'PendingFulfillmentStart' 'Subscribed' 'Suspended' 'Unsubscribed'
offerId	Offer Id	string (required)
publisherId	Publisher Id	string (required)

NetworkProfile

Name	Description	Value
egressNatIp	Egress nat IP to use	IPAddress[]
enableEgressNat	Enable egress NAT, enabled by default	'DISABLED' 'ENABLED' (required)
networkType	vnet or vwan, cannot be updated	'VNET' 'VWAN' (required)
privateSourceNatRulesDestination	Array of ipv4 destination address for which source NAT is to be performed	string[]
publicIps	List of IPs associated with the Firewall	IPAddress[] (required)
trustedRanges	Non-RFC 1918 address	string[]
vnetConfiguration	Vnet configurations	VnetConfiguration
vwanConfiguration	Vwan configurations	VwanConfiguration

PanoramaConfig

Name	Description	Value
configString	Base64 encoded string representing Panorama parameters to be used by Firewall to connect to Panorama. This string is generated via azure plugin in Panorama	string (required)

PlanData

Name	Description	Value
billingCycle	different billing cycles like MONTHLY/WEEKLY	'MONTHLY' 'WEEKLY' (required)
planId	plan id as published by Liftr.PAN	string Constraints: Max length = 50 (required)
usageType	different usage type like PAYG/COMMITTED	'COMMITTED' 'PAYG'

RulestackDetails

Name	Description	Value
location	Rulestack location	string
resourceId	Resource Id	string
rulestackId	Associated rulestack Id	string

StrataCloudManagerConfig

Name	Description	Value
cloudManagerName	Strata Cloud Manager name which is intended to manage the policy for this firewall.	string (required)

TrackedResourceTags

Name	Description	Value

VnetConfiguration

Name	Description	Value
ipOfTrustSubnetForUdr	IP of trust subnet for UDR	IPAddress
trustSubnet	Trust Subnet	IPAddressSpace (required)
unTrustSubnet	Untrust Subnet	IPAddressSpace (required)
vnet	Azure Virtual Network	IPAddressSpace (required)

VwanConfiguration

Name	Description	Value
ipOfTrustSubnetForUdr	IP of trust subnet for UDR	IPAddress
networkVirtualApplianceId	Network Virtual Appliance resource ID	string
trustSubnet	Trust Subnet	IPAddressSpace
unTrustSubnet	Untrust Subnet	IPAddressSpace
vHub	vHub Address	IPAddressSpace (required)

ARM template resource definition

The firewalls resource type can be deployed with operations that target:

Resource groups - See resource group deployment commands For a list of changed properties in each API version, see change log.

Usage Examples

Resource format

To create a PaloAltoNetworks.Cloudngfw/firewalls resource, add the following JSON to your template.

{
  "type": "PaloAltoNetworks.Cloudngfw/firewalls",
  "apiVersion": "2026-05-11-preview",
  "name": "string",
  "identity": {
    "type": "string",
    "userAssignedIdentities": {
      "{customized property}": {
        "clientId": "string",
        "principalId": "string"
      }
    }
  },
  "location": "string",
  "properties": {
    "associatedRulestack": {
      "location": "string",
      "resourceId": "string",
      "rulestackId": "string"
    },
    "dnsSettings": {
      "dnsServers": [
        {
          "address": "string",
          "resourceId": "string"
        }
      ],
      "enabledDnsType": "string",
      "enableDnsProxy": "string"
    },
    "firewallSku": "string",
    "frontEndSettings": [
      {
        "backendConfiguration": {
          "address": {
            "address": "string",
            "resourceId": "string"
          },
          "port": "string"
        },
        "frontendConfiguration": {
          "address": {
            "address": "string",
            "resourceId": "string"
          },
          "port": "string"
        },
        "name": "string",
        "protocol": "string"
      }
    ],
    "isPanoramaManaged": "string",
    "isStrataCloudManaged": "string",
    "marketplaceDetails": {
      "marketplaceSubscriptionStatus": "string",
      "offerId": "string",
      "publisherId": "string"
    },
    "networkProfile": {
      "egressNatIp": [
        {
          "address": "string",
          "resourceId": "string"
        }
      ],
      "enableEgressNat": "string",
      "networkType": "string",
      "privateSourceNatRulesDestination": [ "string" ],
      "publicIps": [
        {
          "address": "string",
          "resourceId": "string"
        }
      ],
      "trustedRanges": [ "string" ],
      "vnetConfiguration": {
        "ipOfTrustSubnetForUdr": {
          "address": "string",
          "resourceId": "string"
        },
        "trustSubnet": {
          "addressSpace": "string",
          "resourceId": "string"
        },
        "unTrustSubnet": {
          "addressSpace": "string",
          "resourceId": "string"
        },
        "vnet": {
          "addressSpace": "string",
          "resourceId": "string"
        }
      },
      "vwanConfiguration": {
        "ipOfTrustSubnetForUdr": {
          "address": "string",
          "resourceId": "string"
        },
        "networkVirtualApplianceId": "string",
        "trustSubnet": {
          "addressSpace": "string",
          "resourceId": "string"
        },
        "unTrustSubnet": {
          "addressSpace": "string",
          "resourceId": "string"
        },
        "vHub": {
          "addressSpace": "string",
          "resourceId": "string"
        }
      }
    },
    "panEtag": "string",
    "panoramaConfig": {
      "configString": "string"
    },
    "planData": {
      "billingCycle": "string",
      "planId": "string",
      "usageType": "string"
    },
    "strataCloudManagerConfig": {
      "cloudManagerName": "string"
    }
  },
  "tags": {
    "{customized property}": "string"
  }
}

Property Values

PaloAltoNetworks.Cloudngfw/firewalls

Name	Description	Value
apiVersion	The api version	'2026-05-11-preview'
identity	The managed service identities assigned to this resource.	AzureResourceManagerManagedIdentityProperties
location	The geo-location where the resource lives	string (required)
name	The resource name	string Constraints: Pattern = `^(?![-_])(?!.[-_]{2})(?!.[-_]$)[a-zA-Z0-9][a-zA-Z0-9-]{0,127}$` (required)
properties	The resource-specific properties for this resource.	FirewallDeploymentProperties (required)
tags	Resource tags	Dictionary of tag names and values. See Tags in templates
type	The resource type	'PaloAltoNetworks.Cloudngfw/firewalls'

AzureResourceManagerManagedIdentityProperties

Name	Description	Value
type	The type of managed identity assigned to this resource.	'None' 'SystemAssigned' 'SystemAssigned,UserAssigned' 'UserAssigned' (required)
userAssignedIdentities	The identities assigned to this resource by the user.	AzureResourceManagerManagedIdentityPropertiesUserAssignedIdentities

AzureResourceManagerManagedIdentityPropertiesUserAssignedIdentities

Name	Description	Value

AzureResourceManagerUserAssignedIdentity

Name	Description	Value
clientId	The active directory client identifier for this principal.	string
principalId	The active directory identifier for this principal.	string

DNSSettings

Name	Description	Value
dnsServers	List of IPs associated with the Firewall	IPAddress[]
enabledDnsType	Enabled DNS proxy type, disabled by default	'AZURE' 'CUSTOM'
enableDnsProxy	Enable DNS proxy, disabled by default	'DISABLED' 'ENABLED'

EndpointConfiguration

Name	Description	Value
address	Address Space	IPAddress (required)
port	port ID	string (required)

FirewallDeploymentProperties

Name	Description	Value
associatedRulestack	Associated Rulestack	RulestackDetails
dnsSettings	DNS settings for Firewall	DNSSettings (required)
firewallSku	Firewall SKU type, Default will be STANDARD.	string
frontEndSettings	Frontend settings for Firewall	FrontendSetting[]
isPanoramaManaged	Panorama Managed: Default is False. Default will be CloudSec managed	'FALSE' 'TRUE'
isStrataCloudManaged	Strata Cloud Managed: Default is False. Default will be CloudSec managed	'FALSE' 'TRUE'
marketplaceDetails	Marketplace details	MarketplaceDetails (required)
networkProfile	Network settings	NetworkProfile (required)
panEtag	panEtag info	string
panoramaConfig	Panorama Configuration	PanoramaConfig
planData	Billing plan information.	PlanData (required)
strataCloudManagerConfig	Strata Cloud Manager Configuration, only applicable if Strata Cloud Manager is selected.	StrataCloudManagerConfig

FrontendSetting

Name	Description	Value
backendConfiguration	Backend configurations	EndpointConfiguration (required)
frontendConfiguration	Frontend configurations	EndpointConfiguration (required)
name	Settings name	string (required)
protocol	Protocol Type	'TCP' 'UDP' (required)

IPAddress

Name	Description	Value
address	Address value	string
resourceId	Resource Id	string

IPAddressSpace

Name	Description	Value
addressSpace	Address Space	string
resourceId	Resource Id	string

MarketplaceDetails

Name	Description	Value
marketplaceSubscriptionStatus	Marketplace Subscription Status	'FulfillmentRequested' 'NotStarted' 'PendingFulfillmentStart' 'Subscribed' 'Suspended' 'Unsubscribed'
offerId	Offer Id	string (required)
publisherId	Publisher Id	string (required)

NetworkProfile

Name	Description	Value
egressNatIp	Egress nat IP to use	IPAddress[]
enableEgressNat	Enable egress NAT, enabled by default	'DISABLED' 'ENABLED' (required)
networkType	vnet or vwan, cannot be updated	'VNET' 'VWAN' (required)
privateSourceNatRulesDestination	Array of ipv4 destination address for which source NAT is to be performed	string[]
publicIps	List of IPs associated with the Firewall	IPAddress[] (required)
trustedRanges	Non-RFC 1918 address	string[]
vnetConfiguration	Vnet configurations	VnetConfiguration
vwanConfiguration	Vwan configurations	VwanConfiguration

PanoramaConfig

Name	Description	Value
configString	Base64 encoded string representing Panorama parameters to be used by Firewall to connect to Panorama. This string is generated via azure plugin in Panorama	string (required)

PlanData

Name	Description	Value
billingCycle	different billing cycles like MONTHLY/WEEKLY	'MONTHLY' 'WEEKLY' (required)
planId	plan id as published by Liftr.PAN	string Constraints: Max length = 50 (required)
usageType	different usage type like PAYG/COMMITTED	'COMMITTED' 'PAYG'

RulestackDetails

Name	Description	Value
location	Rulestack location	string
resourceId	Resource Id	string
rulestackId	Associated rulestack Id	string

StrataCloudManagerConfig

Name	Description	Value
cloudManagerName	Strata Cloud Manager name which is intended to manage the policy for this firewall.	string (required)

TrackedResourceTags

Name	Description	Value

VnetConfiguration

Name	Description	Value
ipOfTrustSubnetForUdr	IP of trust subnet for UDR	IPAddress
trustSubnet	Trust Subnet	IPAddressSpace (required)
unTrustSubnet	Untrust Subnet	IPAddressSpace (required)
vnet	Azure Virtual Network	IPAddressSpace (required)

VwanConfiguration

Name	Description	Value
ipOfTrustSubnetForUdr	IP of trust subnet for UDR	IPAddress
networkVirtualApplianceId	Network Virtual Appliance resource ID	string
trustSubnet	Trust Subnet	IPAddressSpace
unTrustSubnet	Untrust Subnet	IPAddressSpace
vHub	vHub Address	IPAddressSpace (required)

Terraform (AzAPI provider) resource definition

The firewalls resource type can be deployed with operations that target:

Resource groups For a list of changed properties in each API version, see change log.

Resource format

To create a PaloAltoNetworks.Cloudngfw/firewalls resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
  type = "PaloAltoNetworks.Cloudngfw/firewalls@2026-05-11-preview"
  name = "string"
  parent_id = "string"
  identity {
    type = "string"
    identity_ids = [
      "string"
    ]
  }
  location = "string"
  tags = {
    {customized property} = "string"
  }
  body = {
    properties = {
      associatedRulestack = {
        location = "string"
        resourceId = "string"
        rulestackId = "string"
      }
      dnsSettings = {
        dnsServers = [
          {
            address = "string"
            resourceId = "string"
          }
        ]
        enabledDnsType = "string"
        enableDnsProxy = "string"
      }
      firewallSku = "string"
      frontEndSettings = [
        {
          backendConfiguration = {
            address = {
              address = "string"
              resourceId = "string"
            }
            port = "string"
          }
          frontendConfiguration = {
            address = {
              address = "string"
              resourceId = "string"
            }
            port = "string"
          }
          name = "string"
          protocol = "string"
        }
      ]
      isPanoramaManaged = "string"
      isStrataCloudManaged = "string"
      marketplaceDetails = {
        marketplaceSubscriptionStatus = "string"
        offerId = "string"
        publisherId = "string"
      }
      networkProfile = {
        egressNatIp = [
          {
            address = "string"
            resourceId = "string"
          }
        ]
        enableEgressNat = "string"
        networkType = "string"
        privateSourceNatRulesDestination = [
          "string"
        ]
        publicIps = [
          {
            address = "string"
            resourceId = "string"
          }
        ]
        trustedRanges = [
          "string"
        ]
        vnetConfiguration = {
          ipOfTrustSubnetForUdr = {
            address = "string"
            resourceId = "string"
          }
          trustSubnet = {
            addressSpace = "string"
            resourceId = "string"
          }
          unTrustSubnet = {
            addressSpace = "string"
            resourceId = "string"
          }
          vnet = {
            addressSpace = "string"
            resourceId = "string"
          }
        }
        vwanConfiguration = {
          ipOfTrustSubnetForUdr = {
            address = "string"
            resourceId = "string"
          }
          networkVirtualApplianceId = "string"
          trustSubnet = {
            addressSpace = "string"
            resourceId = "string"
          }
          unTrustSubnet = {
            addressSpace = "string"
            resourceId = "string"
          }
          vHub = {
            addressSpace = "string"
            resourceId = "string"
          }
        }
      }
      panEtag = "string"
      panoramaConfig = {
        configString = "string"
      }
      planData = {
        billingCycle = "string"
        planId = "string"
        usageType = "string"
      }
      strataCloudManagerConfig = {
        cloudManagerName = "string"
      }
    }
  }
}

Property Values

PaloAltoNetworks.Cloudngfw/firewalls

Name	Description	Value
identity	The managed service identities assigned to this resource.	AzureResourceManagerManagedIdentityProperties
location	The geo-location where the resource lives	string (required)
name	The resource name	string Constraints: Pattern = `^(?![-_])(?!.[-_]{2})(?!.[-_]$)[a-zA-Z0-9][a-zA-Z0-9-]{0,127}$` (required)
properties	The resource-specific properties for this resource.	FirewallDeploymentProperties (required)
tags	Resource tags	Dictionary of tag names and values.
type	The resource type	"PaloAltoNetworks.Cloudngfw/firewalls@2026-05-11-preview"

AzureResourceManagerManagedIdentityProperties

Name	Description	Value
type	The type of managed identity assigned to this resource.	'None' 'SystemAssigned' 'SystemAssigned,UserAssigned' 'UserAssigned' (required)
userAssignedIdentities	The identities assigned to this resource by the user.	AzureResourceManagerManagedIdentityPropertiesUserAssignedIdentities

AzureResourceManagerManagedIdentityPropertiesUserAssignedIdentities

Name	Description	Value

AzureResourceManagerUserAssignedIdentity

Name	Description	Value
clientId	The active directory client identifier for this principal.	string
principalId	The active directory identifier for this principal.	string

DNSSettings

Name	Description	Value
dnsServers	List of IPs associated with the Firewall	IPAddress[]
enabledDnsType	Enabled DNS proxy type, disabled by default	'AZURE' 'CUSTOM'
enableDnsProxy	Enable DNS proxy, disabled by default	'DISABLED' 'ENABLED'

EndpointConfiguration

Name	Description	Value
address	Address Space	IPAddress (required)
port	port ID	string (required)

FirewallDeploymentProperties

Name	Description	Value
associatedRulestack	Associated Rulestack	RulestackDetails
dnsSettings	DNS settings for Firewall	DNSSettings (required)
firewallSku	Firewall SKU type, Default will be STANDARD.	string
frontEndSettings	Frontend settings for Firewall	FrontendSetting[]
isPanoramaManaged	Panorama Managed: Default is False. Default will be CloudSec managed	'FALSE' 'TRUE'
isStrataCloudManaged	Strata Cloud Managed: Default is False. Default will be CloudSec managed	'FALSE' 'TRUE'
marketplaceDetails	Marketplace details	MarketplaceDetails (required)
networkProfile	Network settings	NetworkProfile (required)
panEtag	panEtag info	string
panoramaConfig	Panorama Configuration	PanoramaConfig
planData	Billing plan information.	PlanData (required)
strataCloudManagerConfig	Strata Cloud Manager Configuration, only applicable if Strata Cloud Manager is selected.	StrataCloudManagerConfig

FrontendSetting

Name	Description	Value
backendConfiguration	Backend configurations	EndpointConfiguration (required)
frontendConfiguration	Frontend configurations	EndpointConfiguration (required)
name	Settings name	string (required)
protocol	Protocol Type	'TCP' 'UDP' (required)

IPAddress

Name	Description	Value
address	Address value	string
resourceId	Resource Id	string

IPAddressSpace

Name	Description	Value
addressSpace	Address Space	string
resourceId	Resource Id	string

MarketplaceDetails

Name	Description	Value
marketplaceSubscriptionStatus	Marketplace Subscription Status	'FulfillmentRequested' 'NotStarted' 'PendingFulfillmentStart' 'Subscribed' 'Suspended' 'Unsubscribed'
offerId	Offer Id	string (required)
publisherId	Publisher Id	string (required)

NetworkProfile

Name	Description	Value
egressNatIp	Egress nat IP to use	IPAddress[]
enableEgressNat	Enable egress NAT, enabled by default	'DISABLED' 'ENABLED' (required)
networkType	vnet or vwan, cannot be updated	'VNET' 'VWAN' (required)
privateSourceNatRulesDestination	Array of ipv4 destination address for which source NAT is to be performed	string[]
publicIps	List of IPs associated with the Firewall	IPAddress[] (required)
trustedRanges	Non-RFC 1918 address	string[]
vnetConfiguration	Vnet configurations	VnetConfiguration
vwanConfiguration	Vwan configurations	VwanConfiguration

PanoramaConfig

Name	Description	Value
configString	Base64 encoded string representing Panorama parameters to be used by Firewall to connect to Panorama. This string is generated via azure plugin in Panorama	string (required)

PlanData

Name	Description	Value
billingCycle	different billing cycles like MONTHLY/WEEKLY	'MONTHLY' 'WEEKLY' (required)
planId	plan id as published by Liftr.PAN	string Constraints: Max length = 50 (required)
usageType	different usage type like PAYG/COMMITTED	'COMMITTED' 'PAYG'

RulestackDetails

Name	Description	Value
location	Rulestack location	string
resourceId	Resource Id	string
rulestackId	Associated rulestack Id	string

StrataCloudManagerConfig

Name	Description	Value
cloudManagerName	Strata Cloud Manager name which is intended to manage the policy for this firewall.	string (required)

TrackedResourceTags

Name	Description	Value

VnetConfiguration

Name	Description	Value
ipOfTrustSubnetForUdr	IP of trust subnet for UDR	IPAddress
trustSubnet	Trust Subnet	IPAddressSpace (required)
unTrustSubnet	Untrust Subnet	IPAddressSpace (required)
vnet	Azure Virtual Network	IPAddressSpace (required)

VwanConfiguration

Name	Description	Value
ipOfTrustSubnetForUdr	IP of trust subnet for UDR	IPAddress
networkVirtualApplianceId	Network Virtual Appliance resource ID	string
trustSubnet	Trust Subnet	IPAddressSpace
unTrustSubnet	Untrust Subnet	IPAddressSpace
vHub	vHub Address	IPAddressSpace (required)

Feedback

Was this page helpful?

Last updated on 2026-03-02

PaloAltoNetworks.Cloudngfw firewalls

Bicep resource definition

Resource format

Property Values

PaloAltoNetworks.Cloudngfw/firewalls

AzureResourceManagerManagedIdentityProperties

AzureResourceManagerManagedIdentityPropertiesUserAssignedIdentities

AzureResourceManagerUserAssignedIdentity

DNSSettings

EndpointConfiguration

FirewallDeploymentProperties

FrontendSetting

IPAddress

IPAddressSpace

MarketplaceDetails

NetworkProfile

PanoramaConfig

PlanData

RulestackDetails

StrataCloudManagerConfig

TrackedResourceTags

VnetConfiguration

VwanConfiguration

ARM template resource definition

Usage Examples

Resource format

Property Values

PaloAltoNetworks.Cloudngfw/firewalls

AzureResourceManagerManagedIdentityProperties

AzureResourceManagerManagedIdentityPropertiesUserAssignedIdentities

AzureResourceManagerUserAssignedIdentity

DNSSettings

EndpointConfiguration

FirewallDeploymentProperties

FrontendSetting

IPAddress

IPAddressSpace

MarketplaceDetails

NetworkProfile

PanoramaConfig

PlanData

RulestackDetails

StrataCloudManagerConfig

TrackedResourceTags

VnetConfiguration

VwanConfiguration

Terraform (AzAPI provider) resource definition

Resource format

Property Values

PaloAltoNetworks.Cloudngfw/firewalls

AzureResourceManagerManagedIdentityProperties

AzureResourceManagerManagedIdentityPropertiesUserAssignedIdentities

AzureResourceManagerUserAssignedIdentity

DNSSettings

EndpointConfiguration

FirewallDeploymentProperties

FrontendSetting

IPAddress

IPAddressSpace

MarketplaceDetails

NetworkProfile

PanoramaConfig

PlanData

RulestackDetails

StrataCloudManagerConfig

TrackedResourceTags

VnetConfiguration

VwanConfiguration

Feedback

Additional resources