az network firewall policy

Note

This reference is part of the azure-firewall extension for the Azure CLI (version 2.15.0 or higher). The extension will automatically install the first time you run an az network firewall policy command. Learn more about extensions.

Manage and configure Azure firewall policy.

Commands

az network firewall policy create	Create an Azure firewall policy.
az network firewall policy delete	Delete an Azure firewall policy.
az network firewall policy intrusion-detection	Manage intrusion signature rules and bypass rules.
az network firewall policy intrusion-detection add	Add overrided intrusion signature or a bypass rule or private ranges list for intrusion detection.
az network firewall policy intrusion-detection list	List all intrusion detection configuration.
az network firewall policy intrusion-detection remove	Remove overrided intrusion signature or a bypass rule.
az network firewall policy list	List all Azure firewall policies.
az network firewall policy rule-collection-group	Manage and configure Azure firewall policy rule collection group.
az network firewall policy rule-collection-group collection	Manage and configure Azure firewall policy rule collections in the rule collection group.
az network firewall policy rule-collection-group collection add-filter-collection	Add a filter collection into an Azure firewall policy rule collection group.
az network firewall policy rule-collection-group collection add-nat-collection	Add a NAT collection into an Azure firewall policy rule collection group.
az network firewall policy rule-collection-group collection list	List all rule collections of an Azure firewall policy rule collection group.
az network firewall policy rule-collection-group collection remove	Remove a rule collection from an Azure firewall policy rule collection group.
az network firewall policy rule-collection-group collection rule	Manage and configure the rule of a filter collection in the rule collection group of Azure firewall policy.
az network firewall policy rule-collection-group collection rule add	Add a rule into an Azure firewall policy rule collection.
az network firewall policy rule-collection-group collection rule remove	Remove a rule from an Azure firewall policy rule collection.
az network firewall policy rule-collection-group collection rule update	Update a rule of an Azure firewall policy rule collection.
az network firewall policy rule-collection-group create	Create an Azure firewall policy rule collection group.
az network firewall policy rule-collection-group delete	Delete an Azure Firewall policy rule collection group.
az network firewall policy rule-collection-group list	List all Azure firewall policy rule collection groups.
az network firewall policy rule-collection-group show	Show an Azure firewall policy rule collection group.
az network firewall policy rule-collection-group update	Update an Azure firewall policy rule collection group.
az network firewall policy show	Show an Azure firewall policy.
az network firewall policy update	Update an Azure firewall policy.

az network firewall policy create

Create an Azure firewall policy.

az network firewall policy create --name
                                  --resource-group
                                  [--base-policy]
                                  [--cert-name]
                                  [--dns-servers]
                                  [--enable-dns-proxy {false, true}]
                                  [--fqdns]
                                  [--identity]
                                  [--idps-mode {Alert, Deny, Off}]
                                  [--ip-addresses]
                                  [--key-vault-secret-id]
                                  [--location]
                                  [--sku {Basic, Premium, Standard}]
                                  [--sql {false, true}]
                                  [--tags]
                                  [--threat-intel-mode {Alert, Deny, Off}]

Required Parameters

--name -n

The name of the Firewall Policy.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Optional Parameters

--base-policy

The name or ID of parent firewall policy from which rules are inherited.

--cert-name

Name of the CA certificate.

--dns-servers

Space-separated list of DNS server IP addresses.

--enable-dns-proxy

Enable DNS Proxy.

accepted values: false, true

--fqdns

Space-separated list of FQDNs.

--identity

Name or ID of the ManagedIdentity Resource.

--idps-mode

IDPS mode.

accepted values: Alert, Deny, Off

--ip-addresses

Space-separated list of IPv4 addresses.

--key-vault-secret-id

Secret Id of (base-64 encoded unencrypted pfx) Secret or Certificate object stored in KeyVault.

--location -l

Location. Values from: az account list-locations. You can configure the default location using az configure --defaults location=<location>.

--sku

SKU of Firewall policy.

accepted values: Basic, Premium, Standard

--sql

A flag to indicate if SQL Redirect traffic filtering is enabled.

accepted values: false, true

--tags

Space-separated tags: key[=value] [key[=value] ...]. Use "" to clear existing tags.

--threat-intel-mode

The operation mode for Threat Intelligence.

accepted values: Alert, Deny, Off

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az network firewall policy delete

Delete an Azure firewall policy.

az network firewall policy delete --name
                                  --resource-group

Required Parameters

--name -n

The name of the Firewall Policy.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az network firewall policy list

List all Azure firewall policies.

az network firewall policy list [--resource-group]

Optional Parameters

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az network firewall policy show

Show an Azure firewall policy.

az network firewall policy show --name
                                --resource-group
                                [--expand]

Required Parameters

--name -n

The name of the Firewall Policy.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Optional Parameters

--expand

Expands referenced resources. Default value is None.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az network firewall policy update

Update an Azure firewall policy.

az network firewall policy update --name
                                  --resource-group
                                  [--add]
                                  [--cert-name]
                                  [--dns-servers]
                                  [--enable-dns-proxy {false, true}]
                                  [--force-string]
                                  [--fqdns]
                                  [--identity]
                                  [--idps-mode {Alert, Deny, Off}]
                                  [--ip-addresses]
                                  [--key-vault-secret-id]
                                  [--remove]
                                  [--set]
                                  [--sku {Basic, Premium, Standard}]
                                  [--sql {false, true}]
                                  [--tags]
                                  [--threat-intel-mode {Alert, Deny, Off}]

Required Parameters

--name -n

The name of the Firewall Policy.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Optional Parameters

--add

Add an object to a list of objects by specifying a path and key value pairs. Example: --add property.listProperty <key=value, string or JSON string>.

default value: []

--cert-name

Name of the CA certificate.

--dns-servers

Space-separated list of DNS server IP addresses.

--enable-dns-proxy

Enable DNS Proxy.

accepted values: false, true

--force-string

When using 'set' or 'add', preserve string literals instead of attempting to convert to JSON.

default value: False

--fqdns

Space-separated list of FQDNs.

--identity

Name or ID of the ManagedIdentity Resource.

--idps-mode

IDPS mode.

accepted values: Alert, Deny, Off

--ip-addresses

Space-separated list of IPv4 addresses.

--key-vault-secret-id

Secret Id of (base-64 encoded unencrypted pfx) Secret or Certificate object stored in KeyVault.

--remove

Remove a property or an element from a list. Example: --remove property.list OR --remove propertyToRemove.

default value: []

--set

Update an object by specifying a property path and value to set. Example: --set property1.property2=.

default value: []

--sku

SKU of Firewall policy.

accepted values: Basic, Premium, Standard

--sql

A flag to indicate if SQL Redirect traffic filtering is enabled.

accepted values: false, true

--tags

Space-separated tags: key[=value] [key[=value] ...]. Use "" to clear existing tags.

--threat-intel-mode

The operation mode for Threat Intelligence.

accepted values: Alert, Deny, Off

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.