Creates or updates the specified Azure Firewall.
PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/azureFirewalls/{azureFirewallName}?api-version=2026-01-01
With optional parameters:
PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/azureFirewalls/{azureFirewallName}?api-version=2026-01-01&createAfcControlPlane={createAfcControlPlane}
URI Parameters
| Name |
In |
Required |
Type |
Description |
|
azureFirewallName
|
path |
True
|
string
|
The name of the Azure Firewall.
|
|
resourceGroupName
|
path |
True
|
string
minLength: 1
maxLength: 90
|
The name of the resource group. The name is case insensitive.
|
|
subscriptionId
|
path |
True
|
string
(uuid)
|
The ID of the target subscription. The value must be an UUID.
|
|
api-version
|
query |
True
|
string
minLength: 1
|
The API version to use for this operation.
|
|
createAfcControlPlane
|
query |
|
boolean
|
When set to true, creates an AFC control plane for the Azure Firewall.
|
Request Body
| Name |
Type |
Description |
|
extendedLocation
|
ExtendedLocation
|
The extended location of type local virtual network gateway.
|
|
id
|
string
|
Resource ID.
|
|
location
|
string
|
Resource location.
|
|
properties.additionalProperties
|
object
|
The additional properties used to further config this azure firewall.
|
|
properties.aiSecurityAddOn
|
boolean
|
Indicates whether the AI security add-on is enabled for the Azure Firewall.
|
|
properties.applicationRuleCollections
|
AzureFirewallApplicationRuleCollection[]
|
Collection of application rule collections used by Azure Firewall.
|
|
properties.autoscaleConfiguration
|
AzureFirewallAutoscaleConfiguration
|
Properties to provide a custom autoscale configuration to this azure firewall.
|
|
properties.firewallPolicy
|
SubResource
|
The firewallPolicy associated with this azure firewall.
|
|
properties.hubIPAddresses
|
HubIPAddresses
|
IP addresses associated with AzureFirewall.
|
|
properties.ipConfigurations
|
AzureFirewallIPConfiguration[]
|
IP configuration of the Azure Firewall resource.
|
|
properties.managementIpConfiguration
|
AzureFirewallIPConfiguration
|
IP configuration of the Azure Firewall used for management traffic.
|
|
properties.natRuleCollections
|
AzureFirewallNatRuleCollection[]
|
Collection of NAT rule collections used by Azure Firewall.
|
|
properties.networkRuleCollections
|
AzureFirewallNetworkRuleCollection[]
|
Collection of network rule collections used by Azure Firewall.
|
|
properties.sku
|
AzureFirewallSku
|
The Azure Firewall Resource SKU.
|
|
properties.threatIntelMode
|
AzureFirewallThreatIntelMode
|
The operation mode for Threat Intelligence.
|
|
properties.virtualHub
|
SubResource
|
The virtualHub to which the firewall belongs.
|
|
tags
|
object
|
Resource tags.
|
|
zones
|
string[]
|
A list of availability zones denoting where the resource needs to come from.
|
Responses
| Name |
Type |
Description |
|
200 OK
|
AzureFirewall
|
Resource 'AzureFirewall' update operation succeeded
|
|
201 Created
|
AzureFirewall
|
Resource 'AzureFirewall' create operation succeeded
Headers
- Azure-AsyncOperation: string
- Retry-After: integer
|
|
Other Status Codes
|
CloudError
|
An unexpected error response.
|
Security
azure_auth
Azure Active Directory OAuth2 Flow.
Type:
oauth2
Flow:
implicit
Authorization URL:
https://login.microsoftonline.com/common/oauth2/authorize
Scopes
| Name |
Description |
|
user_impersonation
|
impersonate your user account
|
Examples
Create Azure Firewall
Sample request
PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall?api-version=2026-01-01
{
"location": "West US",
"properties": {
"aiSecurityAddOn": true,
"applicationRuleCollections": [
{
"name": "apprulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 110,
"rules": [
{
"name": "rule1",
"description": "Deny inbound rule",
"protocols": [
{
"port": 443,
"protocolType": "Https"
}
],
"sourceAddresses": [
"216.58.216.164",
"10.0.0.0/24"
],
"targetFqdns": [
"www.test.com"
]
}
]
}
}
],
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"properties": {
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
}
}
}
],
"natRuleCollections": [
{
"name": "natrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll",
"properties": {
"action": {
"type": "Dnat"
},
"priority": 112,
"rules": [
{
"name": "DNAT-HTTPS-traffic",
"description": "D-NAT all outbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedAddress": "1.2.3.5",
"translatedPort": "8443"
},
{
"name": "DNAT-HTTP-traffic-With-FQDN",
"description": "D-NAT all inbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"80"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedFqdn": "internalhttpserver",
"translatedPort": "880"
}
]
}
}
],
"networkRuleCollections": [
{
"name": "netrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 112,
"rules": [
{
"name": "L4-traffic",
"description": "Block traffic based on source IPs and ports",
"destinationAddresses": [
"*"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"192.168.1.1-192.168.1.12",
"10.1.4.12-10.1.4.255"
]
},
{
"name": "L4-traffic-with-FQDN",
"description": "Block traffic based on source IPs and ports to amazon",
"destinationFqdns": [
"www.amazon.com"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"10.2.4.12-10.2.4.255"
]
}
]
}
}
],
"sku": {
"name": "AZFW_VNet",
"tier": "Standard"
},
"threatIntelMode": "Alert"
},
"tags": {
"key1": "value1"
},
"zones": []
}
import com.azure.core.management.SubResource;
import com.azure.resourcemanager.network.fluent.models.AzureFirewallInner;
import com.azure.resourcemanager.network.models.AzureFirewallApplicationRule;
import com.azure.resourcemanager.network.models.AzureFirewallApplicationRuleCollection;
import com.azure.resourcemanager.network.models.AzureFirewallApplicationRuleProtocol;
import com.azure.resourcemanager.network.models.AzureFirewallApplicationRuleProtocolType;
import com.azure.resourcemanager.network.models.AzureFirewallIpConfiguration;
import com.azure.resourcemanager.network.models.AzureFirewallNatRCAction;
import com.azure.resourcemanager.network.models.AzureFirewallNatRCActionType;
import com.azure.resourcemanager.network.models.AzureFirewallNatRule;
import com.azure.resourcemanager.network.models.AzureFirewallNatRuleCollection;
import com.azure.resourcemanager.network.models.AzureFirewallNetworkRule;
import com.azure.resourcemanager.network.models.AzureFirewallNetworkRuleCollection;
import com.azure.resourcemanager.network.models.AzureFirewallNetworkRuleProtocol;
import com.azure.resourcemanager.network.models.AzureFirewallRCAction;
import com.azure.resourcemanager.network.models.AzureFirewallRCActionType;
import com.azure.resourcemanager.network.models.AzureFirewallSku;
import com.azure.resourcemanager.network.models.AzureFirewallSkuName;
import com.azure.resourcemanager.network.models.AzureFirewallSkuTier;
import com.azure.resourcemanager.network.models.AzureFirewallThreatIntelMode;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;
/**
* Samples for AzureFirewalls CreateOrUpdate.
*/
public final class Main {
/*
* x-ms-original-file: 2026-01-01/AzureFirewallPut.json
*/
/**
* Sample code: Create Azure Firewall.
*
* @param manager Entry point to NetworkManager.
*/
public static void createAzureFirewall(com.azure.resourcemanager.network.NetworkManager manager) {
manager.serviceClient().getAzureFirewalls().createOrUpdate("rg1", "azurefirewall", new AzureFirewallInner()
.withLocation("West US").withTags(mapOf("key1", "fakeTokenPlaceholder")).withZones(Arrays.asList())
.withApplicationRuleCollections(Arrays.asList(new AzureFirewallApplicationRuleCollection().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll")
.withName("apprulecoll").withPriority(110)
.withAction(new AzureFirewallRCAction().withType(AzureFirewallRCActionType.DENY))
.withRules(Arrays
.asList(new AzureFirewallApplicationRule().withName("rule1").withDescription("Deny inbound rule")
.withSourceAddresses(Arrays.asList("216.58.216.164", "10.0.0.0/24"))
.withProtocols(Arrays.asList(new AzureFirewallApplicationRuleProtocol()
.withProtocolType(AzureFirewallApplicationRuleProtocolType.HTTPS).withPort(443)))
.withTargetFqdns(Arrays.asList("www.test.com"))))))
.withNatRuleCollections(Arrays.asList(new AzureFirewallNatRuleCollection().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll")
.withName("natrulecoll").withPriority(112)
.withAction(new AzureFirewallNatRCAction().withType(AzureFirewallNatRCActionType.DNAT))
.withRules(Arrays.asList(
new AzureFirewallNatRule().withName("DNAT-HTTPS-traffic")
.withDescription("D-NAT all outbound web traffic for inspection")
.withSourceAddresses(Arrays.asList("*")).withDestinationAddresses(Arrays.asList("1.2.3.4"))
.withDestinationPorts(Arrays.asList("443"))
.withProtocols(Arrays.asList(AzureFirewallNetworkRuleProtocol.TCP))
.withTranslatedAddress("1.2.3.5").withTranslatedPort("8443"),
new AzureFirewallNatRule().withName("DNAT-HTTP-traffic-With-FQDN")
.withDescription("D-NAT all inbound web traffic for inspection")
.withSourceAddresses(Arrays.asList("*")).withDestinationAddresses(Arrays.asList("1.2.3.4"))
.withDestinationPorts(Arrays.asList("80"))
.withProtocols(Arrays.asList(AzureFirewallNetworkRuleProtocol.TCP)).withTranslatedPort("880")
.withTranslatedFqdn("internalhttpserver")))))
.withNetworkRuleCollections(Arrays.asList(new AzureFirewallNetworkRuleCollection().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll")
.withName("netrulecoll").withPriority(112)
.withAction(
new AzureFirewallRCAction().withType(AzureFirewallRCActionType.DENY))
.withRules(Arrays.asList(
new AzureFirewallNetworkRule().withName("L4-traffic")
.withDescription("Block traffic based on source IPs and ports")
.withProtocols(Arrays.asList(AzureFirewallNetworkRuleProtocol.TCP))
.withSourceAddresses(Arrays.asList("192.168.1.1-192.168.1.12", "10.1.4.12-10.1.4.255"))
.withDestinationAddresses(Arrays.asList("*"))
.withDestinationPorts(Arrays.asList("443-444", "8443")),
new AzureFirewallNetworkRule().withName("L4-traffic-with-FQDN")
.withDescription("Block traffic based on source IPs and ports to amazon")
.withProtocols(Arrays.asList(AzureFirewallNetworkRuleProtocol.TCP))
.withSourceAddresses(Arrays.asList("10.2.4.12-10.2.4.255"))
.withDestinationPorts(Arrays.asList("443-444", "8443"))
.withDestinationFqdns(Arrays.asList("www.amazon.com"))))))
.withIpConfigurations(Arrays.asList(new AzureFirewallIpConfiguration()
.withName("azureFirewallIpConfiguration")
.withSubnet(new SubResource().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"))
.withPublicIpAddress(new SubResource().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"))))
.withThreatIntelMode(AzureFirewallThreatIntelMode.ALERT)
.withSku(
new AzureFirewallSku().withName(AzureFirewallSkuName.AZFW_VNET).withTier(AzureFirewallSkuTier.STANDARD))
.withAiSecurityAddOn(true), null, com.azure.core.util.Context.NONE);
}
// Use "Map.of" if available
@SuppressWarnings("unchecked")
private static <T> Map<String, T> mapOf(Object... inputs) {
Map<String, T> map = new HashMap<>();
for (int i = 0; i < inputs.length; i += 2) {
String key = (String) inputs[i];
T value = (T) inputs[i + 1];
map.put(key, value);
}
return map;
}
}
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
from azure.identity import DefaultAzureCredential
from azure.mgmt.network import NetworkManagementClient
"""
# PREREQUISITES
pip install azure-identity
pip install azure-mgmt-network
# USAGE
python azure_firewall_put.py
Before run the sample, please set the values of the client ID, tenant ID and client secret
of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""
def main():
client = NetworkManagementClient(
credential=DefaultAzureCredential(),
subscription_id="SUBSCRIPTION_ID",
)
response = client.azure_firewalls.begin_create_or_update(
resource_group_name="rg1",
azure_firewall_name="azurefirewall",
parameters={
"location": "West US",
"properties": {
"aiSecurityAddOn": True,
"applicationRuleCollections": [
{
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll",
"name": "apprulecoll",
"properties": {
"action": {"type": "Deny"},
"priority": 110,
"rules": [
{
"description": "Deny inbound rule",
"name": "rule1",
"protocols": [{"port": 443, "protocolType": "Https"}],
"sourceAddresses": ["216.58.216.164", "10.0.0.0/24"],
"targetFqdns": ["www.test.com"],
}
],
},
}
],
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"properties": {
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
},
},
}
],
"natRuleCollections": [
{
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll",
"name": "natrulecoll",
"properties": {
"action": {"type": "Dnat"},
"priority": 112,
"rules": [
{
"description": "D-NAT all outbound web traffic for inspection",
"destinationAddresses": ["1.2.3.4"],
"destinationPorts": ["443"],
"name": "DNAT-HTTPS-traffic",
"protocols": ["TCP"],
"sourceAddresses": ["*"],
"translatedAddress": "1.2.3.5",
"translatedPort": "8443",
},
{
"description": "D-NAT all inbound web traffic for inspection",
"destinationAddresses": ["1.2.3.4"],
"destinationPorts": ["80"],
"name": "DNAT-HTTP-traffic-With-FQDN",
"protocols": ["TCP"],
"sourceAddresses": ["*"],
"translatedFqdn": "internalhttpserver",
"translatedPort": "880",
},
],
},
}
],
"networkRuleCollections": [
{
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll",
"name": "netrulecoll",
"properties": {
"action": {"type": "Deny"},
"priority": 112,
"rules": [
{
"description": "Block traffic based on source IPs and ports",
"destinationAddresses": ["*"],
"destinationPorts": ["443-444", "8443"],
"name": "L4-traffic",
"protocols": ["TCP"],
"sourceAddresses": ["192.168.1.1-192.168.1.12", "10.1.4.12-10.1.4.255"],
},
{
"description": "Block traffic based on source IPs and ports to amazon",
"destinationFqdns": ["www.amazon.com"],
"destinationPorts": ["443-444", "8443"],
"name": "L4-traffic-with-FQDN",
"protocols": ["TCP"],
"sourceAddresses": ["10.2.4.12-10.2.4.255"],
},
],
},
}
],
"sku": {"name": "AZFW_VNet", "tier": "Standard"},
"threatIntelMode": "Alert",
},
"tags": {"key1": "value1"},
"zones": [],
},
).result()
print(response)
# x-ms-original-file: 2026-01-01/AzureFirewallPut.json
if __name__ == "__main__":
main()
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
package armnetwork_test
import (
"context"
"log"
"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v12"
)
// Generated from example definition: 2026-01-01/AzureFirewallPut.json
func ExampleAzureFirewallsClient_BeginCreateOrUpdate_createAzureFirewall() {
cred, err := azidentity.NewDefaultAzureCredential(nil)
if err != nil {
log.Fatalf("failed to obtain a credential: %v", err)
}
ctx := context.Background()
clientFactory, err := armnetwork.NewClientFactory("00000000-0000-0000-0000-000000000000", cred, nil)
if err != nil {
log.Fatalf("failed to create client: %v", err)
}
poller, err := clientFactory.NewAzureFirewallsClient().BeginCreateOrUpdate(ctx, "rg1", "azurefirewall", armnetwork.AzureFirewall{
Location: to.Ptr("West US"),
Properties: &armnetwork.AzureFirewallPropertiesFormat{
AiSecurityAddOn: to.Ptr(true),
ApplicationRuleCollections: []*armnetwork.AzureFirewallApplicationRuleCollection{
{
Name: to.Ptr("apprulecoll"),
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll"),
Properties: &armnetwork.AzureFirewallApplicationRuleCollectionPropertiesFormat{
Action: &armnetwork.AzureFirewallRCAction{
Type: to.Ptr(armnetwork.AzureFirewallRCActionTypeDeny),
},
Priority: to.Ptr[int32](110),
Rules: []*armnetwork.AzureFirewallApplicationRule{
{
Name: to.Ptr("rule1"),
Description: to.Ptr("Deny inbound rule"),
Protocols: []*armnetwork.AzureFirewallApplicationRuleProtocol{
{
Port: to.Ptr[int32](443),
ProtocolType: to.Ptr(armnetwork.AzureFirewallApplicationRuleProtocolTypeHTTPS),
},
},
SourceAddresses: []*string{
to.Ptr("216.58.216.164"),
to.Ptr("10.0.0.0/24"),
},
TargetFqdns: []*string{
to.Ptr("www.test.com"),
},
},
},
},
},
},
IPConfigurations: []*armnetwork.AzureFirewallIPConfiguration{
{
Name: to.Ptr("azureFirewallIpConfiguration"),
Properties: &armnetwork.AzureFirewallIPConfigurationPropertiesFormat{
PublicIPAddress: &armnetwork.SubResource{
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"),
},
Subnet: &armnetwork.SubResource{
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"),
},
},
},
},
NatRuleCollections: []*armnetwork.AzureFirewallNatRuleCollection{
{
Name: to.Ptr("natrulecoll"),
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll"),
Properties: &armnetwork.AzureFirewallNatRuleCollectionProperties{
Action: &armnetwork.AzureFirewallNatRCAction{
Type: to.Ptr(armnetwork.AzureFirewallNatRCActionTypeDnat),
},
Priority: to.Ptr[int32](112),
Rules: []*armnetwork.AzureFirewallNatRule{
{
Name: to.Ptr("DNAT-HTTPS-traffic"),
Description: to.Ptr("D-NAT all outbound web traffic for inspection"),
DestinationAddresses: []*string{
to.Ptr("1.2.3.4"),
},
DestinationPorts: []*string{
to.Ptr("443"),
},
Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
},
SourceAddresses: []*string{
to.Ptr("*"),
},
TranslatedAddress: to.Ptr("1.2.3.5"),
TranslatedPort: to.Ptr("8443"),
},
{
Name: to.Ptr("DNAT-HTTP-traffic-With-FQDN"),
Description: to.Ptr("D-NAT all inbound web traffic for inspection"),
DestinationAddresses: []*string{
to.Ptr("1.2.3.4"),
},
DestinationPorts: []*string{
to.Ptr("80"),
},
Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
},
SourceAddresses: []*string{
to.Ptr("*"),
},
TranslatedFqdn: to.Ptr("internalhttpserver"),
TranslatedPort: to.Ptr("880"),
},
},
},
},
},
NetworkRuleCollections: []*armnetwork.AzureFirewallNetworkRuleCollection{
{
Name: to.Ptr("netrulecoll"),
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll"),
Properties: &armnetwork.AzureFirewallNetworkRuleCollectionPropertiesFormat{
Action: &armnetwork.AzureFirewallRCAction{
Type: to.Ptr(armnetwork.AzureFirewallRCActionTypeDeny),
},
Priority: to.Ptr[int32](112),
Rules: []*armnetwork.AzureFirewallNetworkRule{
{
Name: to.Ptr("L4-traffic"),
Description: to.Ptr("Block traffic based on source IPs and ports"),
DestinationAddresses: []*string{
to.Ptr("*"),
},
DestinationPorts: []*string{
to.Ptr("443-444"),
to.Ptr("8443"),
},
Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
},
SourceAddresses: []*string{
to.Ptr("192.168.1.1-192.168.1.12"),
to.Ptr("10.1.4.12-10.1.4.255"),
},
},
{
Name: to.Ptr("L4-traffic-with-FQDN"),
Description: to.Ptr("Block traffic based on source IPs and ports to amazon"),
DestinationFqdns: []*string{
to.Ptr("www.amazon.com"),
},
DestinationPorts: []*string{
to.Ptr("443-444"),
to.Ptr("8443"),
},
Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
},
SourceAddresses: []*string{
to.Ptr("10.2.4.12-10.2.4.255"),
},
},
},
},
},
},
SKU: &armnetwork.AzureFirewallSKU{
Name: to.Ptr(armnetwork.AzureFirewallSKUNameAZFWVnet),
Tier: to.Ptr(armnetwork.AzureFirewallSKUTierStandard),
},
ThreatIntelMode: to.Ptr(armnetwork.AzureFirewallThreatIntelModeAlert),
},
Tags: map[string]*string{
"key1": to.Ptr("value1"),
},
Zones: []*string{},
}, nil)
if err != nil {
log.Fatalf("failed to finish the request: %v", err)
}
res, err := poller.PollUntilDone(ctx, nil)
if err != nil {
log.Fatalf("failed to poll the result: %v", err)
}
// You could use response here. We use blank identifier for just demo purposes.
_ = res
// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
// res = armnetwork.AzureFirewallsClientCreateOrUpdateResponse{
// AzureFirewall: armnetwork.AzureFirewall{
// Name: to.Ptr("azurefirewall"),
// Type: to.Ptr("Microsoft.Network/azureFirewalls"),
// Etag: to.Ptr("w/\\00000000-0000-0000-0000-000000000000\\"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall"),
// Location: to.Ptr("West US"),
// Properties: &armnetwork.AzureFirewallPropertiesFormat{
// AdditionalProperties: map[string]*string{
// },
// AiSecurityAddOn: to.Ptr(true),
// ApplicationRuleCollections: []*armnetwork.AzureFirewallApplicationRuleCollection{
// {
// Name: to.Ptr("apprulecoll"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll"),
// Properties: &armnetwork.AzureFirewallApplicationRuleCollectionPropertiesFormat{
// Action: &armnetwork.AzureFirewallRCAction{
// Type: to.Ptr(armnetwork.AzureFirewallRCActionTypeDeny),
// },
// Priority: to.Ptr[int32](110),
// Rules: []*armnetwork.AzureFirewallApplicationRule{
// {
// Name: to.Ptr("rule1"),
// Description: to.Ptr("Deny inbound rule"),
// Protocols: []*armnetwork.AzureFirewallApplicationRuleProtocol{
// {
// Port: to.Ptr[int32](443),
// ProtocolType: to.Ptr(armnetwork.AzureFirewallApplicationRuleProtocolTypeHTTPS),
// },
// },
// SourceAddresses: []*string{
// to.Ptr("216.58.216.164"),
// to.Ptr("10.0.0.0/24"),
// },
// TargetFqdns: []*string{
// to.Ptr("www.test.com"),
// },
// },
// },
// },
// },
// },
// IPConfigurations: []*armnetwork.AzureFirewallIPConfiguration{
// {
// Name: to.Ptr("azureFirewallIpConfiguration"),
// Etag: to.Ptr("w/\\00000000-0000-0000-0000-000000000000\\"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/ipConfigurations/azureFirewallIpConfiguration"),
// Properties: &armnetwork.AzureFirewallIPConfigurationPropertiesFormat{
// PrivateIPAddress: to.Ptr("10.0.0.0"),
// ProvisioningState: to.Ptr(armnetwork.ProvisioningStateSucceeded),
// PublicIPAddress: &armnetwork.SubResource{
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"),
// },
// Subnet: &armnetwork.SubResource{
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"),
// },
// },
// },
// },
// IPGroups: []*armnetwork.AzureFirewallIPGroups{
// },
// NatRuleCollections: []*armnetwork.AzureFirewallNatRuleCollection{
// {
// Name: to.Ptr("natrulecoll"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll"),
// Properties: &armnetwork.AzureFirewallNatRuleCollectionProperties{
// Action: &armnetwork.AzureFirewallNatRCAction{
// Type: to.Ptr(armnetwork.AzureFirewallNatRCActionTypeDnat),
// },
// Priority: to.Ptr[int32](112),
// Rules: []*armnetwork.AzureFirewallNatRule{
// {
// Name: to.Ptr("DNAT-HTTPS-traffic"),
// Description: to.Ptr("D-NAT all outbound web traffic for inspection"),
// DestinationAddresses: []*string{
// to.Ptr("1.2.3.4"),
// },
// DestinationPorts: []*string{
// to.Ptr("443"),
// },
// Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
// to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
// },
// SourceAddresses: []*string{
// to.Ptr("*"),
// },
// TranslatedAddress: to.Ptr("1.2.3.5"),
// TranslatedPort: to.Ptr("8443"),
// },
// {
// Name: to.Ptr("DNAT-HTTP-traffic-With-FQDN"),
// Description: to.Ptr("D-NAT all inbound web traffic for inspection"),
// DestinationAddresses: []*string{
// to.Ptr("1.2.3.4"),
// },
// DestinationPorts: []*string{
// to.Ptr("80"),
// },
// Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
// to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
// },
// SourceAddresses: []*string{
// to.Ptr("*"),
// },
// TranslatedFqdn: to.Ptr("internalhttpserver"),
// TranslatedPort: to.Ptr("880"),
// },
// },
// },
// },
// },
// NetworkRuleCollections: []*armnetwork.AzureFirewallNetworkRuleCollection{
// {
// Name: to.Ptr("netrulecoll"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll"),
// Properties: &armnetwork.AzureFirewallNetworkRuleCollectionPropertiesFormat{
// Action: &armnetwork.AzureFirewallRCAction{
// Type: to.Ptr(armnetwork.AzureFirewallRCActionTypeDeny),
// },
// Priority: to.Ptr[int32](112),
// Rules: []*armnetwork.AzureFirewallNetworkRule{
// {
// Name: to.Ptr("L4-traffic"),
// Description: to.Ptr("Block traffic based on source IPs and ports"),
// DestinationAddresses: []*string{
// to.Ptr("*"),
// },
// DestinationPorts: []*string{
// to.Ptr("443-444"),
// to.Ptr("8443"),
// },
// Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
// to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
// },
// SourceAddresses: []*string{
// to.Ptr("192.168.1.1-192.168.1.12"),
// to.Ptr("10.1.4.12-10.1.4.255"),
// },
// },
// {
// Name: to.Ptr("L4-traffic-with-FQDN"),
// Description: to.Ptr("Block traffic based on source IPs and ports to amazon"),
// DestinationFqdns: []*string{
// to.Ptr("www.amazon.com"),
// },
// DestinationPorts: []*string{
// to.Ptr("443-444"),
// to.Ptr("8443"),
// },
// Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
// to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
// },
// SourceAddresses: []*string{
// to.Ptr("10.2.4.12-10.2.4.255"),
// },
// },
// },
// },
// },
// },
// ProvisioningState: to.Ptr(armnetwork.ProvisioningStateSucceeded),
// SKU: &armnetwork.AzureFirewallSKU{
// Name: to.Ptr(armnetwork.AzureFirewallSKUNameAZFWVnet),
// Tier: to.Ptr(armnetwork.AzureFirewallSKUTierStandard),
// },
// ThreatIntelMode: to.Ptr(armnetwork.AzureFirewallThreatIntelModeAlert),
// },
// Tags: map[string]*string{
// "key1": to.Ptr("value1"),
// },
// Zones: []*string{
// },
// },
// }
}
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
const { NetworkManagementClient } = require("@azure/arm-network");
const { DefaultAzureCredential } = require("@azure/identity");
/**
* This sample demonstrates how to creates or updates the specified Azure Firewall.
*
* @summary creates or updates the specified Azure Firewall.
* x-ms-original-file: 2026-01-01/AzureFirewallPut.json
*/
async function createAzureFirewall() {
const credential = new DefaultAzureCredential();
const subscriptionId = "00000000-0000-0000-0000-000000000000";
const client = new NetworkManagementClient(credential, subscriptionId);
const result = await client.azureFirewalls.createOrUpdate("rg1", "azurefirewall", {
location: "West US",
aiSecurityAddOn: true,
applicationRuleCollections: [
{
name: "apprulecoll",
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll",
action: { type: "Deny" },
priority: 110,
rules: [
{
name: "rule1",
description: "Deny inbound rule",
protocols: [{ port: 443, protocolType: "Https" }],
sourceAddresses: ["216.58.216.164", "10.0.0.0/24"],
targetFqdns: ["www.test.com"],
},
],
},
],
ipConfigurations: [
{
name: "azureFirewallIpConfiguration",
publicIPAddress: {
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName",
},
subnet: {
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet",
},
},
],
natRuleCollections: [
{
name: "natrulecoll",
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll",
action: { type: "Dnat" },
priority: 112,
rules: [
{
name: "DNAT-HTTPS-traffic",
description: "D-NAT all outbound web traffic for inspection",
destinationAddresses: ["1.2.3.4"],
destinationPorts: ["443"],
protocols: ["TCP"],
sourceAddresses: ["*"],
translatedAddress: "1.2.3.5",
translatedPort: "8443",
},
{
name: "DNAT-HTTP-traffic-With-FQDN",
description: "D-NAT all inbound web traffic for inspection",
destinationAddresses: ["1.2.3.4"],
destinationPorts: ["80"],
protocols: ["TCP"],
sourceAddresses: ["*"],
translatedFqdn: "internalhttpserver",
translatedPort: "880",
},
],
},
],
networkRuleCollections: [
{
name: "netrulecoll",
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll",
action: { type: "Deny" },
priority: 112,
rules: [
{
name: "L4-traffic",
description: "Block traffic based on source IPs and ports",
destinationAddresses: ["*"],
destinationPorts: ["443-444", "8443"],
protocols: ["TCP"],
sourceAddresses: ["192.168.1.1-192.168.1.12", "10.1.4.12-10.1.4.255"],
},
{
name: "L4-traffic-with-FQDN",
description: "Block traffic based on source IPs and ports to amazon",
destinationFqdns: ["www.amazon.com"],
destinationPorts: ["443-444", "8443"],
protocols: ["TCP"],
sourceAddresses: ["10.2.4.12-10.2.4.255"],
},
],
},
],
sku: { name: "AZFW_VNet", tier: "Standard" },
threatIntelMode: "Alert",
tags: { key1: "value1" },
zones: [],
});
console.log(result);
}
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
Sample response
{
"name": "azurefirewall",
"type": "Microsoft.Network/azureFirewalls",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall",
"location": "West US",
"properties": {
"additionalProperties": {},
"aiSecurityAddOn": true,
"applicationRuleCollections": [
{
"name": "apprulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 110,
"rules": [
{
"name": "rule1",
"description": "Deny inbound rule",
"protocols": [
{
"port": 443,
"protocolType": "Https"
}
],
"sourceAddresses": [
"216.58.216.164",
"10.0.0.0/24"
],
"targetFqdns": [
"www.test.com"
]
}
]
}
}
],
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/ipConfigurations/azureFirewallIpConfiguration",
"properties": {
"privateIPAddress": "10.0.0.0",
"provisioningState": "Succeeded",
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
}
}
}
],
"ipGroups": [],
"natRuleCollections": [
{
"name": "natrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll",
"properties": {
"action": {
"type": "Dnat"
},
"priority": 112,
"rules": [
{
"name": "DNAT-HTTPS-traffic",
"description": "D-NAT all outbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedAddress": "1.2.3.5",
"translatedPort": "8443"
},
{
"name": "DNAT-HTTP-traffic-With-FQDN",
"description": "D-NAT all inbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"80"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedFqdn": "internalhttpserver",
"translatedPort": "880"
}
]
}
}
],
"networkRuleCollections": [
{
"name": "netrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 112,
"rules": [
{
"name": "L4-traffic",
"description": "Block traffic based on source IPs and ports",
"destinationAddresses": [
"*"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"192.168.1.1-192.168.1.12",
"10.1.4.12-10.1.4.255"
]
},
{
"name": "L4-traffic-with-FQDN",
"description": "Block traffic based on source IPs and ports to amazon",
"destinationFqdns": [
"www.amazon.com"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"10.2.4.12-10.2.4.255"
]
}
]
}
}
],
"provisioningState": "Succeeded",
"sku": {
"name": "AZFW_VNet",
"tier": "Standard"
},
"threatIntelMode": "Alert"
},
"tags": {
"key1": "value1"
},
"zones": []
}
{
"name": "azurefirewall",
"type": "Microsoft.Network/azureFirewalls",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall",
"location": "West US",
"properties": {
"additionalProperties": {},
"aiSecurityAddOn": true,
"applicationRuleCollections": [
{
"name": "apprulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 110,
"rules": [
{
"name": "rule1",
"description": "Deny inbound rule",
"protocols": [
{
"port": 443,
"protocolType": "Https"
}
],
"sourceAddresses": [
"216.58.216.164",
"10.0.0.0/24"
],
"targetFqdns": [
"www.test.com"
]
}
]
}
}
],
"autoscaleConfiguration": {
"maxCapacity": 8,
"minCapacity": 8
},
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/ipConfigurations/azureFirewallIpConfiguration",
"properties": {
"privateIPAddress": "10.0.0.0",
"provisioningState": "Succeeded",
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
}
}
}
],
"natRuleCollections": [
{
"name": "natrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll",
"properties": {
"action": {
"type": "Dnat"
},
"priority": 112,
"rules": [
{
"name": "DNAT-HTTPS-traffic",
"description": "D-NAT all outbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedAddress": "1.2.3.5",
"translatedPort": "8443"
},
{
"name": "DNAT-HTTP-traffic-With-FQDN",
"description": "D-NAT all inbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"80"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedFqdn": "internalhttpserver",
"translatedPort": "880"
}
]
}
}
],
"networkRuleCollections": [
{
"name": "netrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 112,
"rules": [
{
"name": "L4-traffic",
"description": "Block traffic based on source IPs and ports",
"destinationAddresses": [
"*"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"192.168.1.1-192.168.1.12",
"10.1.4.12-10.1.4.255"
]
},
{
"name": "L4-traffic-with-FQDN",
"description": "Block traffic based on source IPs and ports to amazon",
"destinationFqdns": [
"www.amazon.com"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"10.2.4.12-10.2.4.255"
]
}
]
}
}
],
"provisioningState": "Succeeded",
"sku": {
"name": "AZFW_VNet",
"tier": "Standard"
},
"threatIntelMode": "Alert"
},
"tags": {
"key1": "value1"
},
"zones": []
}
Create Azure Firewall in virtual Hub
Sample request
PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall?api-version=2026-01-01
{
"location": "West US",
"properties": {
"firewallPolicy": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/firewallPolicies/policy1"
},
"hubIPAddresses": {
"publicIPs": {
"addresses": [],
"count": 1
}
},
"sku": {
"name": "AZFW_Hub",
"tier": "Standard"
},
"threatIntelMode": "Alert",
"virtualHub": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualHubs/hub1"
}
},
"tags": {
"key1": "value1"
},
"zones": []
}
import com.azure.core.management.SubResource;
import com.azure.resourcemanager.network.fluent.models.AzureFirewallInner;
import com.azure.resourcemanager.network.models.AzureFirewallSku;
import com.azure.resourcemanager.network.models.AzureFirewallSkuName;
import com.azure.resourcemanager.network.models.AzureFirewallSkuTier;
import com.azure.resourcemanager.network.models.AzureFirewallThreatIntelMode;
import com.azure.resourcemanager.network.models.HubIpAddresses;
import com.azure.resourcemanager.network.models.HubPublicIpAddresses;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;
/**
* Samples for AzureFirewalls CreateOrUpdate.
*/
public final class Main {
/*
* x-ms-original-file: 2026-01-01/AzureFirewallPutInHub.json
*/
/**
* Sample code: Create Azure Firewall in virtual Hub.
*
* @param manager Entry point to NetworkManager.
*/
public static void createAzureFirewallInVirtualHub(com.azure.resourcemanager.network.NetworkManager manager) {
manager.serviceClient().getAzureFirewalls().createOrUpdate("rg1", "azurefirewall", new AzureFirewallInner()
.withLocation("West US").withTags(mapOf("key1", "fakeTokenPlaceholder")).withZones(Arrays.asList())
.withThreatIntelMode(AzureFirewallThreatIntelMode.ALERT)
.withVirtualHub(new SubResource().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualHubs/hub1"))
.withFirewallPolicy(new SubResource().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/firewallPolicies/policy1"))
.withHubIPAddresses(new HubIpAddresses()
.withPublicIPs(new HubPublicIpAddresses().withAddresses(Arrays.asList()).withCount(1)))
.withSku(
new AzureFirewallSku().withName(AzureFirewallSkuName.AZFW_HUB).withTier(AzureFirewallSkuTier.STANDARD)),
null, com.azure.core.util.Context.NONE);
}
// Use "Map.of" if available
@SuppressWarnings("unchecked")
private static <T> Map<String, T> mapOf(Object... inputs) {
Map<String, T> map = new HashMap<>();
for (int i = 0; i < inputs.length; i += 2) {
String key = (String) inputs[i];
T value = (T) inputs[i + 1];
map.put(key, value);
}
return map;
}
}
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
from azure.identity import DefaultAzureCredential
from azure.mgmt.network import NetworkManagementClient
"""
# PREREQUISITES
pip install azure-identity
pip install azure-mgmt-network
# USAGE
python azure_firewall_put_in_hub.py
Before run the sample, please set the values of the client ID, tenant ID and client secret
of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""
def main():
client = NetworkManagementClient(
credential=DefaultAzureCredential(),
subscription_id="SUBSCRIPTION_ID",
)
response = client.azure_firewalls.begin_create_or_update(
resource_group_name="rg1",
azure_firewall_name="azurefirewall",
parameters={
"location": "West US",
"properties": {
"firewallPolicy": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/firewallPolicies/policy1"
},
"hubIPAddresses": {"publicIPs": {"addresses": [], "count": 1}},
"sku": {"name": "AZFW_Hub", "tier": "Standard"},
"threatIntelMode": "Alert",
"virtualHub": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualHubs/hub1"
},
},
"tags": {"key1": "value1"},
"zones": [],
},
).result()
print(response)
# x-ms-original-file: 2026-01-01/AzureFirewallPutInHub.json
if __name__ == "__main__":
main()
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
package armnetwork_test
import (
"context"
"log"
"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v12"
)
// Generated from example definition: 2026-01-01/AzureFirewallPutInHub.json
func ExampleAzureFirewallsClient_BeginCreateOrUpdate_createAzureFirewallInVirtualHub() {
cred, err := azidentity.NewDefaultAzureCredential(nil)
if err != nil {
log.Fatalf("failed to obtain a credential: %v", err)
}
ctx := context.Background()
clientFactory, err := armnetwork.NewClientFactory("00000000-0000-0000-0000-000000000000", cred, nil)
if err != nil {
log.Fatalf("failed to create client: %v", err)
}
poller, err := clientFactory.NewAzureFirewallsClient().BeginCreateOrUpdate(ctx, "rg1", "azurefirewall", armnetwork.AzureFirewall{
Location: to.Ptr("West US"),
Properties: &armnetwork.AzureFirewallPropertiesFormat{
FirewallPolicy: &armnetwork.SubResource{
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/firewallPolicies/policy1"),
},
HubIPAddresses: &armnetwork.HubIPAddresses{
PublicIPs: &armnetwork.HubPublicIPAddresses{
Addresses: []*armnetwork.AzureFirewallPublicIPAddress{},
Count: to.Ptr[int32](1),
},
},
SKU: &armnetwork.AzureFirewallSKU{
Name: to.Ptr(armnetwork.AzureFirewallSKUNameAZFWHub),
Tier: to.Ptr(armnetwork.AzureFirewallSKUTierStandard),
},
ThreatIntelMode: to.Ptr(armnetwork.AzureFirewallThreatIntelModeAlert),
VirtualHub: &armnetwork.SubResource{
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualHubs/hub1"),
},
},
Tags: map[string]*string{
"key1": to.Ptr("value1"),
},
Zones: []*string{},
}, nil)
if err != nil {
log.Fatalf("failed to finish the request: %v", err)
}
res, err := poller.PollUntilDone(ctx, nil)
if err != nil {
log.Fatalf("failed to poll the result: %v", err)
}
// You could use response here. We use blank identifier for just demo purposes.
_ = res
// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
// res = armnetwork.AzureFirewallsClientCreateOrUpdateResponse{
// AzureFirewall: armnetwork.AzureFirewall{
// Name: to.Ptr("azurefirewall"),
// Type: to.Ptr("Microsoft.Network/azureFirewalls"),
// Etag: to.Ptr("w/\\00000000-0000-0000-0000-000000000000\\"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall"),
// Location: to.Ptr("West US"),
// Properties: &armnetwork.AzureFirewallPropertiesFormat{
// AdditionalProperties: map[string]*string{
// },
// FirewallPolicy: &armnetwork.SubResource{
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/firewallPolicies/policy1"),
// },
// HubIPAddresses: &armnetwork.HubIPAddresses{
// PrivateIPAddress: to.Ptr("10.0.0.0"),
// PublicIPs: &armnetwork.HubPublicIPAddresses{
// Addresses: []*armnetwork.AzureFirewallPublicIPAddress{
// {
// Address: to.Ptr("13.73.240.12"),
// },
// },
// Count: to.Ptr[int32](1),
// },
// },
// ProvisioningState: to.Ptr(armnetwork.ProvisioningStateSucceeded),
// SKU: &armnetwork.AzureFirewallSKU{
// Name: to.Ptr(armnetwork.AzureFirewallSKUNameAZFWHub),
// Tier: to.Ptr(armnetwork.AzureFirewallSKUTierStandard),
// },
// ThreatIntelMode: to.Ptr(armnetwork.AzureFirewallThreatIntelModeAlert),
// VirtualHub: &armnetwork.SubResource{
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualHubs/hub1"),
// },
// },
// Tags: map[string]*string{
// "key1": to.Ptr("value1"),
// },
// Zones: []*string{
// },
// },
// }
}
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
const { NetworkManagementClient } = require("@azure/arm-network");
const { DefaultAzureCredential } = require("@azure/identity");
/**
* This sample demonstrates how to creates or updates the specified Azure Firewall.
*
* @summary creates or updates the specified Azure Firewall.
* x-ms-original-file: 2026-01-01/AzureFirewallPutInHub.json
*/
async function createAzureFirewallInVirtualHub() {
const credential = new DefaultAzureCredential();
const subscriptionId = "00000000-0000-0000-0000-000000000000";
const client = new NetworkManagementClient(credential, subscriptionId);
const result = await client.azureFirewalls.createOrUpdate("rg1", "azurefirewall", {
location: "West US",
firewallPolicy: {
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/firewallPolicies/policy1",
},
hubIPAddresses: { publicIPs: { addresses: [], count: 1 } },
sku: { name: "AZFW_Hub", tier: "Standard" },
threatIntelMode: "Alert",
virtualHub: {
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualHubs/hub1",
},
tags: { key1: "value1" },
zones: [],
});
console.log(result);
}
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
Sample response
{
"name": "azurefirewall",
"type": "Microsoft.Network/azureFirewalls",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall",
"location": "West US",
"properties": {
"additionalProperties": {},
"firewallPolicy": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/firewallPolicies/policy1"
},
"hubIPAddresses": {
"privateIPAddress": "10.0.0.0",
"publicIPs": {
"addresses": [
{
"address": "13.73.240.12"
}
],
"count": 1
}
},
"provisioningState": "Succeeded",
"sku": {
"name": "AZFW_Hub",
"tier": "Standard"
},
"threatIntelMode": "Alert",
"virtualHub": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualHubs/hub1"
}
},
"tags": {
"key1": "value1"
},
"zones": []
}
{
"name": "azurefirewall",
"type": "Microsoft.Network/azureFirewalls",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall",
"location": "West US",
"properties": {
"additionalProperties": {},
"firewallPolicy": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/firewallPolicies/policy1"
},
"hubIPAddresses": {
"privateIPAddress": "10.0.0.0",
"publicIPs": {
"addresses": [
{
"address": "13.73.240.12"
}
],
"count": 1
}
},
"ipGroups": [],
"provisioningState": "Succeeded",
"sku": {
"name": "AZFW_Hub",
"tier": "Standard"
},
"threatIntelMode": "Alert",
"virtualHub": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualHubs/hub1"
}
},
"tags": {
"key1": "value1"
},
"zones": []
}
Create Azure Firewall With Additional Properties
Sample request
PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall?api-version=2026-01-01
{
"location": "West US",
"properties": {
"additionalProperties": {
"key1": "value1",
"key2": "value2"
},
"applicationRuleCollections": [
{
"name": "apprulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 110,
"rules": [
{
"name": "rule1",
"description": "Deny inbound rule",
"protocols": [
{
"port": 443,
"protocolType": "Https"
}
],
"sourceAddresses": [
"216.58.216.164",
"10.0.0.0/24"
],
"targetFqdns": [
"www.test.com"
]
}
]
}
}
],
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"properties": {
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
}
}
}
],
"natRuleCollections": [
{
"name": "natrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll",
"properties": {
"action": {
"type": "Dnat"
},
"priority": 112,
"rules": [
{
"name": "DNAT-HTTPS-traffic",
"description": "D-NAT all outbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedAddress": "1.2.3.5",
"translatedPort": "8443"
},
{
"name": "DNAT-HTTP-traffic-With-FQDN",
"description": "D-NAT all inbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"80"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedFqdn": "internalhttpserver",
"translatedPort": "880"
}
]
}
}
],
"networkRuleCollections": [
{
"name": "netrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 112,
"rules": [
{
"name": "L4-traffic",
"description": "Block traffic based on source IPs and ports",
"destinationAddresses": [
"*"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"192.168.1.1-192.168.1.12",
"10.1.4.12-10.1.4.255"
]
},
{
"name": "L4-traffic-with-FQDN",
"description": "Block traffic based on source IPs and ports to amazon",
"destinationFqdns": [
"www.amazon.com"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"10.2.4.12-10.2.4.255"
]
}
]
}
}
],
"sku": {
"name": "AZFW_VNet",
"tier": "Standard"
},
"threatIntelMode": "Alert"
},
"tags": {
"key1": "value1"
},
"zones": []
}
import com.azure.core.management.SubResource;
import com.azure.resourcemanager.network.fluent.models.AzureFirewallInner;
import com.azure.resourcemanager.network.models.AzureFirewallApplicationRule;
import com.azure.resourcemanager.network.models.AzureFirewallApplicationRuleCollection;
import com.azure.resourcemanager.network.models.AzureFirewallApplicationRuleProtocol;
import com.azure.resourcemanager.network.models.AzureFirewallApplicationRuleProtocolType;
import com.azure.resourcemanager.network.models.AzureFirewallIpConfiguration;
import com.azure.resourcemanager.network.models.AzureFirewallNatRCAction;
import com.azure.resourcemanager.network.models.AzureFirewallNatRCActionType;
import com.azure.resourcemanager.network.models.AzureFirewallNatRule;
import com.azure.resourcemanager.network.models.AzureFirewallNatRuleCollection;
import com.azure.resourcemanager.network.models.AzureFirewallNetworkRule;
import com.azure.resourcemanager.network.models.AzureFirewallNetworkRuleCollection;
import com.azure.resourcemanager.network.models.AzureFirewallNetworkRuleProtocol;
import com.azure.resourcemanager.network.models.AzureFirewallRCAction;
import com.azure.resourcemanager.network.models.AzureFirewallRCActionType;
import com.azure.resourcemanager.network.models.AzureFirewallSku;
import com.azure.resourcemanager.network.models.AzureFirewallSkuName;
import com.azure.resourcemanager.network.models.AzureFirewallSkuTier;
import com.azure.resourcemanager.network.models.AzureFirewallThreatIntelMode;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;
/**
* Samples for AzureFirewalls CreateOrUpdate.
*/
public final class Main {
/*
* x-ms-original-file: 2026-01-01/AzureFirewallPutWithAdditionalProperties.json
*/
/**
* Sample code: Create Azure Firewall With Additional Properties.
*
* @param manager Entry point to NetworkManager.
*/
public static void
createAzureFirewallWithAdditionalProperties(com.azure.resourcemanager.network.NetworkManager manager) {
manager.serviceClient().getAzureFirewalls().createOrUpdate("rg1", "azurefirewall", new AzureFirewallInner()
.withLocation("West US").withTags(mapOf("key1", "fakeTokenPlaceholder")).withZones(Arrays.asList())
.withApplicationRuleCollections(Arrays.asList(new AzureFirewallApplicationRuleCollection().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll")
.withName("apprulecoll").withPriority(110)
.withAction(new AzureFirewallRCAction().withType(AzureFirewallRCActionType.DENY))
.withRules(Arrays
.asList(new AzureFirewallApplicationRule().withName("rule1").withDescription("Deny inbound rule")
.withSourceAddresses(Arrays.asList("216.58.216.164", "10.0.0.0/24"))
.withProtocols(Arrays.asList(new AzureFirewallApplicationRuleProtocol()
.withProtocolType(AzureFirewallApplicationRuleProtocolType.HTTPS).withPort(443)))
.withTargetFqdns(Arrays.asList("www.test.com"))))))
.withNatRuleCollections(Arrays.asList(new AzureFirewallNatRuleCollection().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll")
.withName("natrulecoll").withPriority(112)
.withAction(new AzureFirewallNatRCAction().withType(AzureFirewallNatRCActionType.DNAT))
.withRules(Arrays.asList(
new AzureFirewallNatRule().withName("DNAT-HTTPS-traffic")
.withDescription("D-NAT all outbound web traffic for inspection")
.withSourceAddresses(Arrays.asList("*")).withDestinationAddresses(Arrays.asList("1.2.3.4"))
.withDestinationPorts(Arrays.asList("443"))
.withProtocols(Arrays.asList(AzureFirewallNetworkRuleProtocol.TCP))
.withTranslatedAddress("1.2.3.5").withTranslatedPort("8443"),
new AzureFirewallNatRule().withName("DNAT-HTTP-traffic-With-FQDN")
.withDescription("D-NAT all inbound web traffic for inspection")
.withSourceAddresses(Arrays.asList("*")).withDestinationAddresses(Arrays.asList("1.2.3.4"))
.withDestinationPorts(Arrays.asList("80"))
.withProtocols(Arrays.asList(AzureFirewallNetworkRuleProtocol.TCP)).withTranslatedPort("880")
.withTranslatedFqdn("internalhttpserver")))))
.withNetworkRuleCollections(Arrays.asList(new AzureFirewallNetworkRuleCollection().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll")
.withName("netrulecoll").withPriority(112)
.withAction(
new AzureFirewallRCAction().withType(AzureFirewallRCActionType.DENY))
.withRules(Arrays.asList(
new AzureFirewallNetworkRule().withName("L4-traffic")
.withDescription("Block traffic based on source IPs and ports")
.withProtocols(Arrays.asList(AzureFirewallNetworkRuleProtocol.TCP))
.withSourceAddresses(Arrays.asList("192.168.1.1-192.168.1.12", "10.1.4.12-10.1.4.255"))
.withDestinationAddresses(Arrays.asList("*"))
.withDestinationPorts(Arrays.asList("443-444", "8443")),
new AzureFirewallNetworkRule().withName("L4-traffic-with-FQDN")
.withDescription("Block traffic based on source IPs and ports to amazon")
.withProtocols(Arrays.asList(AzureFirewallNetworkRuleProtocol.TCP))
.withSourceAddresses(Arrays.asList("10.2.4.12-10.2.4.255"))
.withDestinationPorts(Arrays.asList("443-444", "8443"))
.withDestinationFqdns(Arrays.asList("www.amazon.com"))))))
.withIpConfigurations(Arrays.asList(new AzureFirewallIpConfiguration()
.withName("azureFirewallIpConfiguration")
.withSubnet(new SubResource().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"))
.withPublicIpAddress(new SubResource().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"))))
.withThreatIntelMode(AzureFirewallThreatIntelMode.ALERT)
.withSku(
new AzureFirewallSku().withName(AzureFirewallSkuName.AZFW_VNET).withTier(AzureFirewallSkuTier.STANDARD))
.withAdditionalProperties(mapOf("key1", "fakeTokenPlaceholder", "key2", "fakeTokenPlaceholder")), null,
com.azure.core.util.Context.NONE);
}
// Use "Map.of" if available
@SuppressWarnings("unchecked")
private static <T> Map<String, T> mapOf(Object... inputs) {
Map<String, T> map = new HashMap<>();
for (int i = 0; i < inputs.length; i += 2) {
String key = (String) inputs[i];
T value = (T) inputs[i + 1];
map.put(key, value);
}
return map;
}
}
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
from azure.identity import DefaultAzureCredential
from azure.mgmt.network import NetworkManagementClient
"""
# PREREQUISITES
pip install azure-identity
pip install azure-mgmt-network
# USAGE
python azure_firewall_put_with_additional_properties.py
Before run the sample, please set the values of the client ID, tenant ID and client secret
of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""
def main():
client = NetworkManagementClient(
credential=DefaultAzureCredential(),
subscription_id="SUBSCRIPTION_ID",
)
response = client.azure_firewalls.begin_create_or_update(
resource_group_name="rg1",
azure_firewall_name="azurefirewall",
parameters={
"location": "West US",
"properties": {
"additionalProperties": {"key1": "value1", "key2": "value2"},
"applicationRuleCollections": [
{
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll",
"name": "apprulecoll",
"properties": {
"action": {"type": "Deny"},
"priority": 110,
"rules": [
{
"description": "Deny inbound rule",
"name": "rule1",
"protocols": [{"port": 443, "protocolType": "Https"}],
"sourceAddresses": ["216.58.216.164", "10.0.0.0/24"],
"targetFqdns": ["www.test.com"],
}
],
},
}
],
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"properties": {
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
},
},
}
],
"natRuleCollections": [
{
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll",
"name": "natrulecoll",
"properties": {
"action": {"type": "Dnat"},
"priority": 112,
"rules": [
{
"description": "D-NAT all outbound web traffic for inspection",
"destinationAddresses": ["1.2.3.4"],
"destinationPorts": ["443"],
"name": "DNAT-HTTPS-traffic",
"protocols": ["TCP"],
"sourceAddresses": ["*"],
"translatedAddress": "1.2.3.5",
"translatedPort": "8443",
},
{
"description": "D-NAT all inbound web traffic for inspection",
"destinationAddresses": ["1.2.3.4"],
"destinationPorts": ["80"],
"name": "DNAT-HTTP-traffic-With-FQDN",
"protocols": ["TCP"],
"sourceAddresses": ["*"],
"translatedFqdn": "internalhttpserver",
"translatedPort": "880",
},
],
},
}
],
"networkRuleCollections": [
{
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll",
"name": "netrulecoll",
"properties": {
"action": {"type": "Deny"},
"priority": 112,
"rules": [
{
"description": "Block traffic based on source IPs and ports",
"destinationAddresses": ["*"],
"destinationPorts": ["443-444", "8443"],
"name": "L4-traffic",
"protocols": ["TCP"],
"sourceAddresses": ["192.168.1.1-192.168.1.12", "10.1.4.12-10.1.4.255"],
},
{
"description": "Block traffic based on source IPs and ports to amazon",
"destinationFqdns": ["www.amazon.com"],
"destinationPorts": ["443-444", "8443"],
"name": "L4-traffic-with-FQDN",
"protocols": ["TCP"],
"sourceAddresses": ["10.2.4.12-10.2.4.255"],
},
],
},
}
],
"sku": {"name": "AZFW_VNet", "tier": "Standard"},
"threatIntelMode": "Alert",
},
"tags": {"key1": "value1"},
"zones": [],
},
).result()
print(response)
# x-ms-original-file: 2026-01-01/AzureFirewallPutWithAdditionalProperties.json
if __name__ == "__main__":
main()
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
package armnetwork_test
import (
"context"
"log"
"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v12"
)
// Generated from example definition: 2026-01-01/AzureFirewallPutWithAdditionalProperties.json
func ExampleAzureFirewallsClient_BeginCreateOrUpdate_createAzureFirewallWithAdditionalProperties() {
cred, err := azidentity.NewDefaultAzureCredential(nil)
if err != nil {
log.Fatalf("failed to obtain a credential: %v", err)
}
ctx := context.Background()
clientFactory, err := armnetwork.NewClientFactory("00000000-0000-0000-0000-000000000000", cred, nil)
if err != nil {
log.Fatalf("failed to create client: %v", err)
}
poller, err := clientFactory.NewAzureFirewallsClient().BeginCreateOrUpdate(ctx, "rg1", "azurefirewall", armnetwork.AzureFirewall{
Location: to.Ptr("West US"),
Properties: &armnetwork.AzureFirewallPropertiesFormat{
AdditionalProperties: map[string]*string{
"key1": to.Ptr("value1"),
"key2": to.Ptr("value2"),
},
ApplicationRuleCollections: []*armnetwork.AzureFirewallApplicationRuleCollection{
{
Name: to.Ptr("apprulecoll"),
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll"),
Properties: &armnetwork.AzureFirewallApplicationRuleCollectionPropertiesFormat{
Action: &armnetwork.AzureFirewallRCAction{
Type: to.Ptr(armnetwork.AzureFirewallRCActionTypeDeny),
},
Priority: to.Ptr[int32](110),
Rules: []*armnetwork.AzureFirewallApplicationRule{
{
Name: to.Ptr("rule1"),
Description: to.Ptr("Deny inbound rule"),
Protocols: []*armnetwork.AzureFirewallApplicationRuleProtocol{
{
Port: to.Ptr[int32](443),
ProtocolType: to.Ptr(armnetwork.AzureFirewallApplicationRuleProtocolTypeHTTPS),
},
},
SourceAddresses: []*string{
to.Ptr("216.58.216.164"),
to.Ptr("10.0.0.0/24"),
},
TargetFqdns: []*string{
to.Ptr("www.test.com"),
},
},
},
},
},
},
IPConfigurations: []*armnetwork.AzureFirewallIPConfiguration{
{
Name: to.Ptr("azureFirewallIpConfiguration"),
Properties: &armnetwork.AzureFirewallIPConfigurationPropertiesFormat{
PublicIPAddress: &armnetwork.SubResource{
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"),
},
Subnet: &armnetwork.SubResource{
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"),
},
},
},
},
NatRuleCollections: []*armnetwork.AzureFirewallNatRuleCollection{
{
Name: to.Ptr("natrulecoll"),
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll"),
Properties: &armnetwork.AzureFirewallNatRuleCollectionProperties{
Action: &armnetwork.AzureFirewallNatRCAction{
Type: to.Ptr(armnetwork.AzureFirewallNatRCActionTypeDnat),
},
Priority: to.Ptr[int32](112),
Rules: []*armnetwork.AzureFirewallNatRule{
{
Name: to.Ptr("DNAT-HTTPS-traffic"),
Description: to.Ptr("D-NAT all outbound web traffic for inspection"),
DestinationAddresses: []*string{
to.Ptr("1.2.3.4"),
},
DestinationPorts: []*string{
to.Ptr("443"),
},
Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
},
SourceAddresses: []*string{
to.Ptr("*"),
},
TranslatedAddress: to.Ptr("1.2.3.5"),
TranslatedPort: to.Ptr("8443"),
},
{
Name: to.Ptr("DNAT-HTTP-traffic-With-FQDN"),
Description: to.Ptr("D-NAT all inbound web traffic for inspection"),
DestinationAddresses: []*string{
to.Ptr("1.2.3.4"),
},
DestinationPorts: []*string{
to.Ptr("80"),
},
Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
},
SourceAddresses: []*string{
to.Ptr("*"),
},
TranslatedFqdn: to.Ptr("internalhttpserver"),
TranslatedPort: to.Ptr("880"),
},
},
},
},
},
NetworkRuleCollections: []*armnetwork.AzureFirewallNetworkRuleCollection{
{
Name: to.Ptr("netrulecoll"),
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll"),
Properties: &armnetwork.AzureFirewallNetworkRuleCollectionPropertiesFormat{
Action: &armnetwork.AzureFirewallRCAction{
Type: to.Ptr(armnetwork.AzureFirewallRCActionTypeDeny),
},
Priority: to.Ptr[int32](112),
Rules: []*armnetwork.AzureFirewallNetworkRule{
{
Name: to.Ptr("L4-traffic"),
Description: to.Ptr("Block traffic based on source IPs and ports"),
DestinationAddresses: []*string{
to.Ptr("*"),
},
DestinationPorts: []*string{
to.Ptr("443-444"),
to.Ptr("8443"),
},
Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
},
SourceAddresses: []*string{
to.Ptr("192.168.1.1-192.168.1.12"),
to.Ptr("10.1.4.12-10.1.4.255"),
},
},
{
Name: to.Ptr("L4-traffic-with-FQDN"),
Description: to.Ptr("Block traffic based on source IPs and ports to amazon"),
DestinationFqdns: []*string{
to.Ptr("www.amazon.com"),
},
DestinationPorts: []*string{
to.Ptr("443-444"),
to.Ptr("8443"),
},
Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
},
SourceAddresses: []*string{
to.Ptr("10.2.4.12-10.2.4.255"),
},
},
},
},
},
},
SKU: &armnetwork.AzureFirewallSKU{
Name: to.Ptr(armnetwork.AzureFirewallSKUNameAZFWVnet),
Tier: to.Ptr(armnetwork.AzureFirewallSKUTierStandard),
},
ThreatIntelMode: to.Ptr(armnetwork.AzureFirewallThreatIntelModeAlert),
},
Tags: map[string]*string{
"key1": to.Ptr("value1"),
},
Zones: []*string{},
}, nil)
if err != nil {
log.Fatalf("failed to finish the request: %v", err)
}
res, err := poller.PollUntilDone(ctx, nil)
if err != nil {
log.Fatalf("failed to poll the result: %v", err)
}
// You could use response here. We use blank identifier for just demo purposes.
_ = res
// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
// res = armnetwork.AzureFirewallsClientCreateOrUpdateResponse{
// AzureFirewall: armnetwork.AzureFirewall{
// Name: to.Ptr("azurefirewall"),
// Type: to.Ptr("Microsoft.Network/azureFirewalls"),
// Etag: to.Ptr("w/\\00000000-0000-0000-0000-000000000000\\"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall"),
// Location: to.Ptr("West US"),
// Properties: &armnetwork.AzureFirewallPropertiesFormat{
// AdditionalProperties: map[string]*string{
// "key1": to.Ptr("value1"),
// "key2": to.Ptr("value2"),
// },
// ApplicationRuleCollections: []*armnetwork.AzureFirewallApplicationRuleCollection{
// {
// Name: to.Ptr("apprulecoll"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll"),
// Properties: &armnetwork.AzureFirewallApplicationRuleCollectionPropertiesFormat{
// Action: &armnetwork.AzureFirewallRCAction{
// Type: to.Ptr(armnetwork.AzureFirewallRCActionTypeDeny),
// },
// Priority: to.Ptr[int32](110),
// Rules: []*armnetwork.AzureFirewallApplicationRule{
// {
// Name: to.Ptr("rule1"),
// Description: to.Ptr("Deny inbound rule"),
// Protocols: []*armnetwork.AzureFirewallApplicationRuleProtocol{
// {
// Port: to.Ptr[int32](443),
// ProtocolType: to.Ptr(armnetwork.AzureFirewallApplicationRuleProtocolTypeHTTPS),
// },
// },
// SourceAddresses: []*string{
// to.Ptr("216.58.216.164"),
// to.Ptr("10.0.0.0/24"),
// },
// TargetFqdns: []*string{
// to.Ptr("www.test.com"),
// },
// },
// },
// },
// },
// },
// IPConfigurations: []*armnetwork.AzureFirewallIPConfiguration{
// {
// Name: to.Ptr("azureFirewallIpConfiguration"),
// Etag: to.Ptr("w/\\00000000-0000-0000-0000-000000000000\\"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/ipConfigurations/azureFirewallIpConfiguration"),
// Properties: &armnetwork.AzureFirewallIPConfigurationPropertiesFormat{
// PrivateIPAddress: to.Ptr("10.0.0.0"),
// ProvisioningState: to.Ptr(armnetwork.ProvisioningStateSucceeded),
// PublicIPAddress: &armnetwork.SubResource{
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"),
// },
// Subnet: &armnetwork.SubResource{
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"),
// },
// },
// },
// },
// NatRuleCollections: []*armnetwork.AzureFirewallNatRuleCollection{
// {
// Name: to.Ptr("natrulecoll"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll"),
// Properties: &armnetwork.AzureFirewallNatRuleCollectionProperties{
// Action: &armnetwork.AzureFirewallNatRCAction{
// Type: to.Ptr(armnetwork.AzureFirewallNatRCActionTypeDnat),
// },
// Priority: to.Ptr[int32](112),
// Rules: []*armnetwork.AzureFirewallNatRule{
// {
// Name: to.Ptr("DNAT-HTTPS-traffic"),
// Description: to.Ptr("D-NAT all outbound web traffic for inspection"),
// DestinationAddresses: []*string{
// to.Ptr("1.2.3.4"),
// },
// DestinationPorts: []*string{
// to.Ptr("443"),
// },
// Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
// to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
// },
// SourceAddresses: []*string{
// to.Ptr("*"),
// },
// TranslatedAddress: to.Ptr("1.2.3.5"),
// TranslatedPort: to.Ptr("8443"),
// },
// {
// Name: to.Ptr("DNAT-HTTP-traffic-With-FQDN"),
// Description: to.Ptr("D-NAT all inbound web traffic for inspection"),
// DestinationAddresses: []*string{
// to.Ptr("1.2.3.4"),
// },
// DestinationPorts: []*string{
// to.Ptr("80"),
// },
// Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
// to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
// },
// SourceAddresses: []*string{
// to.Ptr("*"),
// },
// TranslatedFqdn: to.Ptr("internalhttpserver"),
// TranslatedPort: to.Ptr("880"),
// },
// },
// },
// },
// },
// NetworkRuleCollections: []*armnetwork.AzureFirewallNetworkRuleCollection{
// {
// Name: to.Ptr("netrulecoll"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll"),
// Properties: &armnetwork.AzureFirewallNetworkRuleCollectionPropertiesFormat{
// Action: &armnetwork.AzureFirewallRCAction{
// Type: to.Ptr(armnetwork.AzureFirewallRCActionTypeDeny),
// },
// Priority: to.Ptr[int32](112),
// Rules: []*armnetwork.AzureFirewallNetworkRule{
// {
// Name: to.Ptr("L4-traffic"),
// Description: to.Ptr("Block traffic based on source IPs and ports"),
// DestinationAddresses: []*string{
// to.Ptr("*"),
// },
// DestinationPorts: []*string{
// to.Ptr("443-444"),
// to.Ptr("8443"),
// },
// Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
// to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
// },
// SourceAddresses: []*string{
// to.Ptr("192.168.1.1-192.168.1.12"),
// to.Ptr("10.1.4.12-10.1.4.255"),
// },
// },
// {
// Name: to.Ptr("L4-traffic-with-FQDN"),
// Description: to.Ptr("Block traffic based on source IPs and ports to amazon"),
// DestinationFqdns: []*string{
// to.Ptr("www.amazon.com"),
// },
// DestinationPorts: []*string{
// to.Ptr("443-444"),
// to.Ptr("8443"),
// },
// Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
// to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
// },
// SourceAddresses: []*string{
// to.Ptr("10.2.4.12-10.2.4.255"),
// },
// },
// },
// },
// },
// },
// ProvisioningState: to.Ptr(armnetwork.ProvisioningStateSucceeded),
// SKU: &armnetwork.AzureFirewallSKU{
// Name: to.Ptr(armnetwork.AzureFirewallSKUNameAZFWVnet),
// Tier: to.Ptr(armnetwork.AzureFirewallSKUTierStandard),
// },
// ThreatIntelMode: to.Ptr(armnetwork.AzureFirewallThreatIntelModeAlert),
// },
// Tags: map[string]*string{
// "key1": to.Ptr("value1"),
// },
// Zones: []*string{
// },
// },
// }
}
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
const { NetworkManagementClient } = require("@azure/arm-network");
const { DefaultAzureCredential } = require("@azure/identity");
/**
* This sample demonstrates how to creates or updates the specified Azure Firewall.
*
* @summary creates or updates the specified Azure Firewall.
* x-ms-original-file: 2026-01-01/AzureFirewallPutWithAdditionalProperties.json
*/
async function createAzureFirewallWithAdditionalProperties() {
const credential = new DefaultAzureCredential();
const subscriptionId = "00000000-0000-0000-0000-000000000000";
const client = new NetworkManagementClient(credential, subscriptionId);
const result = await client.azureFirewalls.createOrUpdate("rg1", "azurefirewall", {
location: "West US",
additionalProperties: { key1: "value1", key2: "value2" },
applicationRuleCollections: [
{
name: "apprulecoll",
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll",
action: { type: "Deny" },
priority: 110,
rules: [
{
name: "rule1",
description: "Deny inbound rule",
protocols: [{ port: 443, protocolType: "Https" }],
sourceAddresses: ["216.58.216.164", "10.0.0.0/24"],
targetFqdns: ["www.test.com"],
},
],
},
],
ipConfigurations: [
{
name: "azureFirewallIpConfiguration",
publicIPAddress: {
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName",
},
subnet: {
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet",
},
},
],
natRuleCollections: [
{
name: "natrulecoll",
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll",
action: { type: "Dnat" },
priority: 112,
rules: [
{
name: "DNAT-HTTPS-traffic",
description: "D-NAT all outbound web traffic for inspection",
destinationAddresses: ["1.2.3.4"],
destinationPorts: ["443"],
protocols: ["TCP"],
sourceAddresses: ["*"],
translatedAddress: "1.2.3.5",
translatedPort: "8443",
},
{
name: "DNAT-HTTP-traffic-With-FQDN",
description: "D-NAT all inbound web traffic for inspection",
destinationAddresses: ["1.2.3.4"],
destinationPorts: ["80"],
protocols: ["TCP"],
sourceAddresses: ["*"],
translatedFqdn: "internalhttpserver",
translatedPort: "880",
},
],
},
],
networkRuleCollections: [
{
name: "netrulecoll",
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll",
action: { type: "Deny" },
priority: 112,
rules: [
{
name: "L4-traffic",
description: "Block traffic based on source IPs and ports",
destinationAddresses: ["*"],
destinationPorts: ["443-444", "8443"],
protocols: ["TCP"],
sourceAddresses: ["192.168.1.1-192.168.1.12", "10.1.4.12-10.1.4.255"],
},
{
name: "L4-traffic-with-FQDN",
description: "Block traffic based on source IPs and ports to amazon",
destinationFqdns: ["www.amazon.com"],
destinationPorts: ["443-444", "8443"],
protocols: ["TCP"],
sourceAddresses: ["10.2.4.12-10.2.4.255"],
},
],
},
],
sku: { name: "AZFW_VNet", tier: "Standard" },
threatIntelMode: "Alert",
tags: { key1: "value1" },
zones: [],
});
console.log(result);
}
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
Sample response
{
"name": "azurefirewall",
"type": "Microsoft.Network/azureFirewalls",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall",
"location": "West US",
"properties": {
"additionalProperties": {
"key1": "value1",
"key2": "value2"
},
"applicationRuleCollections": [
{
"name": "apprulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 110,
"rules": [
{
"name": "rule1",
"description": "Deny inbound rule",
"protocols": [
{
"port": 443,
"protocolType": "Https"
}
],
"sourceAddresses": [
"216.58.216.164",
"10.0.0.0/24"
],
"targetFqdns": [
"www.test.com"
]
}
]
}
}
],
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/ipConfigurations/azureFirewallIpConfiguration",
"properties": {
"privateIPAddress": "10.0.0.0",
"provisioningState": "Succeeded",
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
}
}
}
],
"natRuleCollections": [
{
"name": "natrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll",
"properties": {
"action": {
"type": "Dnat"
},
"priority": 112,
"rules": [
{
"name": "DNAT-HTTPS-traffic",
"description": "D-NAT all outbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedAddress": "1.2.3.5",
"translatedPort": "8443"
},
{
"name": "DNAT-HTTP-traffic-With-FQDN",
"description": "D-NAT all inbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"80"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedFqdn": "internalhttpserver",
"translatedPort": "880"
}
]
}
}
],
"networkRuleCollections": [
{
"name": "netrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 112,
"rules": [
{
"name": "L4-traffic",
"description": "Block traffic based on source IPs and ports",
"destinationAddresses": [
"*"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"192.168.1.1-192.168.1.12",
"10.1.4.12-10.1.4.255"
]
},
{
"name": "L4-traffic-with-FQDN",
"description": "Block traffic based on source IPs and ports to amazon",
"destinationFqdns": [
"www.amazon.com"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"10.2.4.12-10.2.4.255"
]
}
]
}
}
],
"provisioningState": "Succeeded",
"sku": {
"name": "AZFW_VNet",
"tier": "Standard"
},
"threatIntelMode": "Alert"
},
"tags": {
"key1": "value1"
},
"zones": []
}
{
"name": "azurefirewall",
"type": "Microsoft.Network/azureFirewalls",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall",
"location": "West US",
"properties": {
"additionalProperties": {
"key1": "value1",
"key2": "value2"
},
"applicationRuleCollections": [
{
"name": "apprulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 110,
"rules": [
{
"name": "rule1",
"description": "Deny inbound rule",
"protocols": [
{
"port": 443,
"protocolType": "Https"
}
],
"sourceAddresses": [
"216.58.216.164",
"10.0.0.0/24"
],
"targetFqdns": [
"www.test.com"
]
}
]
}
}
],
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/ipConfigurations/azureFirewallIpConfiguration",
"properties": {
"privateIPAddress": "10.0.0.0",
"provisioningState": "Succeeded",
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
}
}
}
],
"natRuleCollections": [
{
"name": "natrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll",
"properties": {
"action": {
"type": "Dnat"
},
"priority": 112,
"rules": [
{
"name": "DNAT-HTTPS-traffic",
"description": "D-NAT all outbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedAddress": "1.2.3.5",
"translatedPort": "8443"
},
{
"name": "DNAT-HTTP-traffic-With-FQDN",
"description": "D-NAT all inbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"80"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedFqdn": "internalhttpserver",
"translatedPort": "880"
}
]
}
}
],
"networkRuleCollections": [
{
"name": "netrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 112,
"rules": [
{
"name": "L4-traffic",
"description": "Block traffic based on source IPs and ports",
"destinationAddresses": [
"*"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"192.168.1.1-192.168.1.12",
"10.1.4.12-10.1.4.255"
]
},
{
"name": "L4-traffic-with-FQDN",
"description": "Block traffic based on source IPs and ports to amazon",
"destinationFqdns": [
"www.amazon.com"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"10.2.4.12-10.2.4.255"
]
}
]
}
}
],
"provisioningState": "Succeeded",
"sku": {
"name": "AZFW_VNet",
"tier": "Standard"
},
"threatIntelMode": "Alert"
},
"tags": {
"key1": "value1"
},
"zones": []
}
Create Azure Firewall With AFC Control Plane
Sample request
PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall?api-version=2026-01-01&createAfcControlPlane=True
{
"location": "West US",
"properties": {
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"properties": {
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
}
}
}
],
"sku": {
"name": "AZFW_VNet",
"tier": "Standard"
},
"threatIntelMode": "Alert"
},
"tags": {
"key1": "value1"
},
"zones": []
}
import com.azure.core.management.SubResource;
import com.azure.resourcemanager.network.fluent.models.AzureFirewallInner;
import com.azure.resourcemanager.network.models.AzureFirewallIpConfiguration;
import com.azure.resourcemanager.network.models.AzureFirewallSku;
import com.azure.resourcemanager.network.models.AzureFirewallSkuName;
import com.azure.resourcemanager.network.models.AzureFirewallSkuTier;
import com.azure.resourcemanager.network.models.AzureFirewallThreatIntelMode;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;
/**
* Samples for AzureFirewalls CreateOrUpdate.
*/
public final class Main {
/*
* x-ms-original-file: 2026-01-01/AzureFirewallPutWithAfcConfiguration.json
*/
/**
* Sample code: Create Azure Firewall With AFC Control Plane.
*
* @param manager Entry point to NetworkManager.
*/
public static void
createAzureFirewallWithAFCControlPlane(com.azure.resourcemanager.network.NetworkManager manager) {
manager.serviceClient().getAzureFirewalls().createOrUpdate("rg1", "azurefirewall", new AzureFirewallInner()
.withLocation("West US").withTags(mapOf("key1", "fakeTokenPlaceholder")).withZones(Arrays.asList())
.withIpConfigurations(Arrays.asList(new AzureFirewallIpConfiguration()
.withName("azureFirewallIpConfiguration")
.withSubnet(new SubResource().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"))
.withPublicIpAddress(new SubResource().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"))))
.withThreatIntelMode(AzureFirewallThreatIntelMode.ALERT).withSku(new AzureFirewallSku()
.withName(AzureFirewallSkuName.AZFW_VNET).withTier(AzureFirewallSkuTier.STANDARD)),
true, com.azure.core.util.Context.NONE);
}
// Use "Map.of" if available
@SuppressWarnings("unchecked")
private static <T> Map<String, T> mapOf(Object... inputs) {
Map<String, T> map = new HashMap<>();
for (int i = 0; i < inputs.length; i += 2) {
String key = (String) inputs[i];
T value = (T) inputs[i + 1];
map.put(key, value);
}
return map;
}
}
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
from azure.identity import DefaultAzureCredential
from azure.mgmt.network import NetworkManagementClient
"""
# PREREQUISITES
pip install azure-identity
pip install azure-mgmt-network
# USAGE
python azure_firewall_put_with_afc_configuration.py
Before run the sample, please set the values of the client ID, tenant ID and client secret
of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""
def main():
client = NetworkManagementClient(
credential=DefaultAzureCredential(),
subscription_id="SUBSCRIPTION_ID",
)
response = client.azure_firewalls.begin_create_or_update(
resource_group_name="rg1",
azure_firewall_name="azurefirewall",
parameters={
"location": "West US",
"properties": {
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"properties": {
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
},
},
}
],
"sku": {"name": "AZFW_VNet", "tier": "Standard"},
"threatIntelMode": "Alert",
},
"tags": {"key1": "value1"},
"zones": [],
},
).result()
print(response)
# x-ms-original-file: 2026-01-01/AzureFirewallPutWithAfcConfiguration.json
if __name__ == "__main__":
main()
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
package armnetwork_test
import (
"context"
"log"
"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v12"
)
// Generated from example definition: 2026-01-01/AzureFirewallPutWithAfcConfiguration.json
func ExampleAzureFirewallsClient_BeginCreateOrUpdate_createAzureFirewallWithAfcControlPlane() {
cred, err := azidentity.NewDefaultAzureCredential(nil)
if err != nil {
log.Fatalf("failed to obtain a credential: %v", err)
}
ctx := context.Background()
clientFactory, err := armnetwork.NewClientFactory("00000000-0000-0000-0000-000000000000", cred, nil)
if err != nil {
log.Fatalf("failed to create client: %v", err)
}
poller, err := clientFactory.NewAzureFirewallsClient().BeginCreateOrUpdate(ctx, "rg1", "azurefirewall", armnetwork.AzureFirewall{
Location: to.Ptr("West US"),
Properties: &armnetwork.AzureFirewallPropertiesFormat{
IPConfigurations: []*armnetwork.AzureFirewallIPConfiguration{
{
Name: to.Ptr("azureFirewallIpConfiguration"),
Properties: &armnetwork.AzureFirewallIPConfigurationPropertiesFormat{
PublicIPAddress: &armnetwork.SubResource{
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"),
},
Subnet: &armnetwork.SubResource{
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"),
},
},
},
},
SKU: &armnetwork.AzureFirewallSKU{
Name: to.Ptr(armnetwork.AzureFirewallSKUNameAZFWVnet),
Tier: to.Ptr(armnetwork.AzureFirewallSKUTierStandard),
},
ThreatIntelMode: to.Ptr(armnetwork.AzureFirewallThreatIntelModeAlert),
},
Tags: map[string]*string{
"key1": to.Ptr("value1"),
},
Zones: []*string{},
}, &armnetwork.AzureFirewallsClientBeginCreateOrUpdateOptions{
CreateAfcControlPlane: to.Ptr(true)})
if err != nil {
log.Fatalf("failed to finish the request: %v", err)
}
res, err := poller.PollUntilDone(ctx, nil)
if err != nil {
log.Fatalf("failed to poll the result: %v", err)
}
// You could use response here. We use blank identifier for just demo purposes.
_ = res
// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
// res = armnetwork.AzureFirewallsClientCreateOrUpdateResponse{
// AzureFirewall: armnetwork.AzureFirewall{
// Name: to.Ptr("azurefirewall"),
// Type: to.Ptr("Microsoft.Network/azureFirewalls"),
// Etag: to.Ptr("w/\\00000000-0000-0000-0000-000000000000\\"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall"),
// Location: to.Ptr("West US"),
// Properties: &armnetwork.AzureFirewallPropertiesFormat{
// IPConfigurations: []*armnetwork.AzureFirewallIPConfiguration{
// {
// Name: to.Ptr("azureFirewallIpConfiguration"),
// Etag: to.Ptr("w/\\00000000-0000-0000-0000-000000000000\\"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/ipConfigurations/azureFirewallIpConfiguration"),
// Properties: &armnetwork.AzureFirewallIPConfigurationPropertiesFormat{
// PrivateIPAddress: to.Ptr("10.0.0.0"),
// ProvisioningState: to.Ptr(armnetwork.ProvisioningStateSucceeded),
// PublicIPAddress: &armnetwork.SubResource{
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"),
// },
// Subnet: &armnetwork.SubResource{
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"),
// },
// },
// },
// },
// ProvisioningState: to.Ptr(armnetwork.ProvisioningStateSucceeded),
// SKU: &armnetwork.AzureFirewallSKU{
// Name: to.Ptr(armnetwork.AzureFirewallSKUNameAZFWVnet),
// Tier: to.Ptr(armnetwork.AzureFirewallSKUTierStandard),
// },
// ThreatIntelMode: to.Ptr(armnetwork.AzureFirewallThreatIntelModeAlert),
// AfcConfiguration: &armnetwork.AfcConfiguration{
// ServiceEndpoint: to.Ptr("5e73bbe79102451d968d1cac9b5dbd41.afc.azure.com"),
// },
// },
// Tags: map[string]*string{
// "key1": to.Ptr("value1"),
// },
// Zones: []*string{
// },
// },
// }
}
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
const { NetworkManagementClient } = require("@azure/arm-network");
const { DefaultAzureCredential } = require("@azure/identity");
/**
* This sample demonstrates how to creates or updates the specified Azure Firewall.
*
* @summary creates or updates the specified Azure Firewall.
* x-ms-original-file: 2026-01-01/AzureFirewallPutWithAfcConfiguration.json
*/
async function createAzureFirewallWithAFCControlPlane() {
const credential = new DefaultAzureCredential();
const subscriptionId = "00000000-0000-0000-0000-000000000000";
const client = new NetworkManagementClient(credential, subscriptionId);
const result = await client.azureFirewalls.createOrUpdate(
"rg1",
"azurefirewall",
{
location: "West US",
ipConfigurations: [
{
name: "azureFirewallIpConfiguration",
publicIPAddress: {
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName",
},
subnet: {
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet",
},
},
],
sku: { name: "AZFW_VNet", tier: "Standard" },
threatIntelMode: "Alert",
tags: { key1: "value1" },
zones: [],
},
{ createAfcControlPlane: true },
);
console.log(result);
}
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
Sample response
{
"name": "azurefirewall",
"type": "Microsoft.Network/azureFirewalls",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall",
"location": "West US",
"properties": {
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/ipConfigurations/azureFirewallIpConfiguration",
"properties": {
"privateIPAddress": "10.0.0.0",
"provisioningState": "Succeeded",
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
}
}
}
],
"provisioningState": "Succeeded",
"sku": {
"name": "AZFW_VNet",
"tier": "Standard"
},
"threatIntelMode": "Alert",
"afcConfiguration": {
"serviceEndpoint": "5e73bbe79102451d968d1cac9b5dbd41.afc.azure.com"
}
},
"tags": {
"key1": "value1"
},
"zones": []
}
{
"name": "azurefirewall",
"type": "Microsoft.Network/azureFirewalls",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall",
"location": "West US",
"properties": {
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/ipConfigurations/azureFirewallIpConfiguration",
"properties": {
"privateIPAddress": "10.0.0.0",
"provisioningState": "Succeeded",
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
}
}
}
],
"provisioningState": "Succeeded",
"sku": {
"name": "AZFW_VNet",
"tier": "Standard"
},
"threatIntelMode": "Alert",
"afcConfiguration": {
"serviceEndpoint": "5e73bbe79102451d968d1cac9b5dbd41.afc.azure.com"
}
},
"tags": {
"key1": "value1"
},
"zones": []
}
Create Azure Firewall With AI Security Add-On
Sample request
PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall?api-version=2026-01-01
{
"location": "West US",
"properties": {
"aiSecurityAddOn": true,
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"properties": {
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
}
}
}
],
"sku": {
"name": "AZFW_VNet",
"tier": "Premium"
},
"threatIntelMode": "Alert"
},
"tags": {
"key1": "value1"
},
"zones": []
}
import com.azure.core.management.SubResource;
import com.azure.resourcemanager.network.fluent.models.AzureFirewallInner;
import com.azure.resourcemanager.network.models.AzureFirewallIpConfiguration;
import com.azure.resourcemanager.network.models.AzureFirewallSku;
import com.azure.resourcemanager.network.models.AzureFirewallSkuName;
import com.azure.resourcemanager.network.models.AzureFirewallSkuTier;
import com.azure.resourcemanager.network.models.AzureFirewallThreatIntelMode;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;
/**
* Samples for AzureFirewalls CreateOrUpdate.
*/
public final class Main {
/*
* x-ms-original-file: 2026-01-01/AzureFirewallPutWithAiSecurityAddOn.json
*/
/**
* Sample code: Create Azure Firewall With AI Security Add-On.
*
* @param manager Entry point to NetworkManager.
*/
public static void
createAzureFirewallWithAISecurityAddOn(com.azure.resourcemanager.network.NetworkManager manager) {
manager.serviceClient().getAzureFirewalls().createOrUpdate("rg1", "azurefirewall", new AzureFirewallInner()
.withLocation("West US").withTags(mapOf("key1", "fakeTokenPlaceholder")).withZones(Arrays.asList())
.withIpConfigurations(Arrays.asList(new AzureFirewallIpConfiguration()
.withName("azureFirewallIpConfiguration")
.withSubnet(new SubResource().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"))
.withPublicIpAddress(new SubResource().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"))))
.withThreatIntelMode(AzureFirewallThreatIntelMode.ALERT)
.withSku(
new AzureFirewallSku().withName(AzureFirewallSkuName.AZFW_VNET).withTier(AzureFirewallSkuTier.PREMIUM))
.withAiSecurityAddOn(true), null, com.azure.core.util.Context.NONE);
}
// Use "Map.of" if available
@SuppressWarnings("unchecked")
private static <T> Map<String, T> mapOf(Object... inputs) {
Map<String, T> map = new HashMap<>();
for (int i = 0; i < inputs.length; i += 2) {
String key = (String) inputs[i];
T value = (T) inputs[i + 1];
map.put(key, value);
}
return map;
}
}
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
from azure.identity import DefaultAzureCredential
from azure.mgmt.network import NetworkManagementClient
"""
# PREREQUISITES
pip install azure-identity
pip install azure-mgmt-network
# USAGE
python azure_firewall_put_with_ai_security_add_on.py
Before run the sample, please set the values of the client ID, tenant ID and client secret
of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""
def main():
client = NetworkManagementClient(
credential=DefaultAzureCredential(),
subscription_id="SUBSCRIPTION_ID",
)
response = client.azure_firewalls.begin_create_or_update(
resource_group_name="rg1",
azure_firewall_name="azurefirewall",
parameters={
"location": "West US",
"properties": {
"aiSecurityAddOn": True,
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"properties": {
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
},
},
}
],
"sku": {"name": "AZFW_VNet", "tier": "Premium"},
"threatIntelMode": "Alert",
},
"tags": {"key1": "value1"},
"zones": [],
},
).result()
print(response)
# x-ms-original-file: 2026-01-01/AzureFirewallPutWithAiSecurityAddOn.json
if __name__ == "__main__":
main()
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
package armnetwork_test
import (
"context"
"log"
"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v12"
)
// Generated from example definition: 2026-01-01/AzureFirewallPutWithAiSecurityAddOn.json
func ExampleAzureFirewallsClient_BeginCreateOrUpdate_createAzureFirewallWithAiSecurityAddOn() {
cred, err := azidentity.NewDefaultAzureCredential(nil)
if err != nil {
log.Fatalf("failed to obtain a credential: %v", err)
}
ctx := context.Background()
clientFactory, err := armnetwork.NewClientFactory("00000000-0000-0000-0000-000000000000", cred, nil)
if err != nil {
log.Fatalf("failed to create client: %v", err)
}
poller, err := clientFactory.NewAzureFirewallsClient().BeginCreateOrUpdate(ctx, "rg1", "azurefirewall", armnetwork.AzureFirewall{
Location: to.Ptr("West US"),
Properties: &armnetwork.AzureFirewallPropertiesFormat{
AiSecurityAddOn: to.Ptr(true),
IPConfigurations: []*armnetwork.AzureFirewallIPConfiguration{
{
Name: to.Ptr("azureFirewallIpConfiguration"),
Properties: &armnetwork.AzureFirewallIPConfigurationPropertiesFormat{
PublicIPAddress: &armnetwork.SubResource{
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"),
},
Subnet: &armnetwork.SubResource{
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"),
},
},
},
},
SKU: &armnetwork.AzureFirewallSKU{
Name: to.Ptr(armnetwork.AzureFirewallSKUNameAZFWVnet),
Tier: to.Ptr(armnetwork.AzureFirewallSKUTierPremium),
},
ThreatIntelMode: to.Ptr(armnetwork.AzureFirewallThreatIntelModeAlert),
},
Tags: map[string]*string{
"key1": to.Ptr("value1"),
},
Zones: []*string{},
}, nil)
if err != nil {
log.Fatalf("failed to finish the request: %v", err)
}
res, err := poller.PollUntilDone(ctx, nil)
if err != nil {
log.Fatalf("failed to poll the result: %v", err)
}
// You could use response here. We use blank identifier for just demo purposes.
_ = res
// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
// res = armnetwork.AzureFirewallsClientCreateOrUpdateResponse{
// AzureFirewall: armnetwork.AzureFirewall{
// Name: to.Ptr("azurefirewall"),
// Type: to.Ptr("Microsoft.Network/azureFirewalls"),
// Etag: to.Ptr("w/\\00000000-0000-0000-0000-000000000000\\"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall"),
// Location: to.Ptr("West US"),
// Properties: &armnetwork.AzureFirewallPropertiesFormat{
// AiSecurityAddOn: to.Ptr(true),
// IPConfigurations: []*armnetwork.AzureFirewallIPConfiguration{
// {
// Name: to.Ptr("azureFirewallIpConfiguration"),
// Etag: to.Ptr("w/\\00000000-0000-0000-0000-000000000000\\"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/ipConfigurations/azureFirewallIpConfiguration"),
// Properties: &armnetwork.AzureFirewallIPConfigurationPropertiesFormat{
// PrivateIPAddress: to.Ptr("10.0.0.0"),
// ProvisioningState: to.Ptr(armnetwork.ProvisioningStateSucceeded),
// PublicIPAddress: &armnetwork.SubResource{
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"),
// },
// Subnet: &armnetwork.SubResource{
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"),
// },
// },
// },
// },
// ProvisioningState: to.Ptr(armnetwork.ProvisioningStateSucceeded),
// SKU: &armnetwork.AzureFirewallSKU{
// Name: to.Ptr(armnetwork.AzureFirewallSKUNameAZFWVnet),
// Tier: to.Ptr(armnetwork.AzureFirewallSKUTierPremium),
// },
// ThreatIntelMode: to.Ptr(armnetwork.AzureFirewallThreatIntelModeAlert),
// },
// Tags: map[string]*string{
// "key1": to.Ptr("value1"),
// },
// Zones: []*string{
// },
// },
// }
}
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
const { NetworkManagementClient } = require("@azure/arm-network");
const { DefaultAzureCredential } = require("@azure/identity");
/**
* This sample demonstrates how to creates or updates the specified Azure Firewall.
*
* @summary creates or updates the specified Azure Firewall.
* x-ms-original-file: 2026-01-01/AzureFirewallPutWithAiSecurityAddOn.json
*/
async function createAzureFirewallWithAISecurityAddOn() {
const credential = new DefaultAzureCredential();
const subscriptionId = "00000000-0000-0000-0000-000000000000";
const client = new NetworkManagementClient(credential, subscriptionId);
const result = await client.azureFirewalls.createOrUpdate("rg1", "azurefirewall", {
location: "West US",
aiSecurityAddOn: true,
ipConfigurations: [
{
name: "azureFirewallIpConfiguration",
publicIPAddress: {
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName",
},
subnet: {
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet",
},
},
],
sku: { name: "AZFW_VNet", tier: "Premium" },
threatIntelMode: "Alert",
tags: { key1: "value1" },
zones: [],
});
console.log(result);
}
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
Sample response
{
"name": "azurefirewall",
"type": "Microsoft.Network/azureFirewalls",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall",
"location": "West US",
"properties": {
"aiSecurityAddOn": true,
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/ipConfigurations/azureFirewallIpConfiguration",
"properties": {
"privateIPAddress": "10.0.0.0",
"provisioningState": "Succeeded",
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
}
}
}
],
"provisioningState": "Succeeded",
"sku": {
"name": "AZFW_VNet",
"tier": "Premium"
},
"threatIntelMode": "Alert"
},
"tags": {
"key1": "value1"
},
"zones": []
}
Azure-AsyncOperation: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/locations/westus/operations/00000000-0000-0000-0000-000000000000?api-version=2026-01-01
Retry-After: 10
{
"name": "azurefirewall",
"type": "Microsoft.Network/azureFirewalls",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall",
"location": "West US",
"properties": {
"aiSecurityAddOn": true,
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/ipConfigurations/azureFirewallIpConfiguration",
"properties": {
"privateIPAddress": "10.0.0.0",
"provisioningState": "Succeeded",
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
}
}
}
],
"provisioningState": "Succeeded",
"sku": {
"name": "AZFW_VNet",
"tier": "Premium"
},
"threatIntelMode": "Alert"
},
"tags": {
"key1": "value1"
},
"zones": []
}
Create Azure Firewall With IpGroups
Sample request
PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall?api-version=2026-01-01
{
"location": "West US",
"properties": {
"applicationRuleCollections": [
{
"name": "apprulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 110,
"rules": [
{
"name": "rule1",
"description": "Deny inbound rule",
"protocols": [
{
"port": 443,
"protocolType": "Https"
}
],
"sourceAddresses": [
"216.58.216.164",
"10.0.0.0/24"
],
"targetFqdns": [
"www.test.com"
]
}
]
}
}
],
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"properties": {
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
}
}
}
],
"natRuleCollections": [
{
"name": "natrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll",
"properties": {
"action": {
"type": "Dnat"
},
"priority": 112,
"rules": [
{
"name": "DNAT-HTTPS-traffic",
"description": "D-NAT all outbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedAddress": "1.2.3.5",
"translatedPort": "8443"
},
{
"name": "DNAT-HTTP-traffic-With-FQDN",
"description": "D-NAT all inbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"80"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedFqdn": "internalhttpserver",
"translatedPort": "880"
}
]
}
}
],
"networkRuleCollections": [
{
"name": "netrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 112,
"rules": [
{
"name": "L4-traffic",
"description": "Block traffic based on source IPs and ports",
"destinationAddresses": [
"*"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"192.168.1.1-192.168.1.12",
"10.1.4.12-10.1.4.255"
]
},
{
"name": "L4-traffic-with-FQDN",
"description": "Block traffic based on source IPs and ports to amazon",
"destinationFqdns": [
"www.amazon.com"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"10.2.4.12-10.2.4.255"
]
}
]
}
}
],
"sku": {
"name": "AZFW_VNet",
"tier": "Standard"
},
"threatIntelMode": "Alert"
},
"tags": {
"key1": "value1"
},
"zones": []
}
import com.azure.core.management.SubResource;
import com.azure.resourcemanager.network.fluent.models.AzureFirewallInner;
import com.azure.resourcemanager.network.models.AzureFirewallApplicationRule;
import com.azure.resourcemanager.network.models.AzureFirewallApplicationRuleCollection;
import com.azure.resourcemanager.network.models.AzureFirewallApplicationRuleProtocol;
import com.azure.resourcemanager.network.models.AzureFirewallApplicationRuleProtocolType;
import com.azure.resourcemanager.network.models.AzureFirewallIpConfiguration;
import com.azure.resourcemanager.network.models.AzureFirewallNatRCAction;
import com.azure.resourcemanager.network.models.AzureFirewallNatRCActionType;
import com.azure.resourcemanager.network.models.AzureFirewallNatRule;
import com.azure.resourcemanager.network.models.AzureFirewallNatRuleCollection;
import com.azure.resourcemanager.network.models.AzureFirewallNetworkRule;
import com.azure.resourcemanager.network.models.AzureFirewallNetworkRuleCollection;
import com.azure.resourcemanager.network.models.AzureFirewallNetworkRuleProtocol;
import com.azure.resourcemanager.network.models.AzureFirewallRCAction;
import com.azure.resourcemanager.network.models.AzureFirewallRCActionType;
import com.azure.resourcemanager.network.models.AzureFirewallSku;
import com.azure.resourcemanager.network.models.AzureFirewallSkuName;
import com.azure.resourcemanager.network.models.AzureFirewallSkuTier;
import com.azure.resourcemanager.network.models.AzureFirewallThreatIntelMode;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;
/**
* Samples for AzureFirewalls CreateOrUpdate.
*/
public final class Main {
/*
* x-ms-original-file: 2026-01-01/AzureFirewallPutWithIpGroups.json
*/
/**
* Sample code: Create Azure Firewall With IpGroups.
*
* @param manager Entry point to NetworkManager.
*/
public static void createAzureFirewallWithIpGroups(com.azure.resourcemanager.network.NetworkManager manager) {
manager.serviceClient().getAzureFirewalls().createOrUpdate("rg1", "azurefirewall", new AzureFirewallInner()
.withLocation("West US").withTags(mapOf("key1", "fakeTokenPlaceholder")).withZones(Arrays.asList())
.withApplicationRuleCollections(Arrays.asList(new AzureFirewallApplicationRuleCollection().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll")
.withName("apprulecoll").withPriority(110)
.withAction(new AzureFirewallRCAction().withType(AzureFirewallRCActionType.DENY))
.withRules(Arrays
.asList(new AzureFirewallApplicationRule().withName("rule1").withDescription("Deny inbound rule")
.withSourceAddresses(Arrays.asList("216.58.216.164", "10.0.0.0/24"))
.withProtocols(Arrays.asList(new AzureFirewallApplicationRuleProtocol()
.withProtocolType(AzureFirewallApplicationRuleProtocolType.HTTPS).withPort(443)))
.withTargetFqdns(Arrays.asList("www.test.com"))))))
.withNatRuleCollections(Arrays.asList(new AzureFirewallNatRuleCollection().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll")
.withName("natrulecoll").withPriority(112)
.withAction(new AzureFirewallNatRCAction().withType(AzureFirewallNatRCActionType.DNAT))
.withRules(Arrays.asList(
new AzureFirewallNatRule().withName("DNAT-HTTPS-traffic")
.withDescription("D-NAT all outbound web traffic for inspection")
.withSourceAddresses(Arrays.asList("*")).withDestinationAddresses(Arrays.asList("1.2.3.4"))
.withDestinationPorts(Arrays.asList("443"))
.withProtocols(Arrays.asList(AzureFirewallNetworkRuleProtocol.TCP))
.withTranslatedAddress("1.2.3.5").withTranslatedPort("8443"),
new AzureFirewallNatRule().withName("DNAT-HTTP-traffic-With-FQDN")
.withDescription("D-NAT all inbound web traffic for inspection")
.withSourceAddresses(Arrays.asList("*")).withDestinationAddresses(Arrays.asList("1.2.3.4"))
.withDestinationPorts(Arrays.asList("80"))
.withProtocols(Arrays.asList(AzureFirewallNetworkRuleProtocol.TCP)).withTranslatedPort("880")
.withTranslatedFqdn("internalhttpserver")))))
.withNetworkRuleCollections(Arrays.asList(new AzureFirewallNetworkRuleCollection().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll")
.withName("netrulecoll").withPriority(112)
.withAction(
new AzureFirewallRCAction().withType(AzureFirewallRCActionType.DENY))
.withRules(Arrays.asList(
new AzureFirewallNetworkRule().withName("L4-traffic")
.withDescription("Block traffic based on source IPs and ports")
.withProtocols(Arrays.asList(AzureFirewallNetworkRuleProtocol.TCP))
.withSourceAddresses(Arrays.asList("192.168.1.1-192.168.1.12", "10.1.4.12-10.1.4.255"))
.withDestinationAddresses(Arrays.asList("*"))
.withDestinationPorts(Arrays.asList("443-444", "8443")),
new AzureFirewallNetworkRule().withName("L4-traffic-with-FQDN")
.withDescription("Block traffic based on source IPs and ports to amazon")
.withProtocols(Arrays.asList(AzureFirewallNetworkRuleProtocol.TCP))
.withSourceAddresses(Arrays.asList("10.2.4.12-10.2.4.255"))
.withDestinationPorts(Arrays.asList("443-444", "8443"))
.withDestinationFqdns(Arrays.asList("www.amazon.com"))))))
.withIpConfigurations(Arrays.asList(new AzureFirewallIpConfiguration()
.withName("azureFirewallIpConfiguration")
.withSubnet(new SubResource().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"))
.withPublicIpAddress(new SubResource().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"))))
.withThreatIntelMode(AzureFirewallThreatIntelMode.ALERT).withSku(new AzureFirewallSku()
.withName(AzureFirewallSkuName.AZFW_VNET).withTier(AzureFirewallSkuTier.STANDARD)),
null, com.azure.core.util.Context.NONE);
}
// Use "Map.of" if available
@SuppressWarnings("unchecked")
private static <T> Map<String, T> mapOf(Object... inputs) {
Map<String, T> map = new HashMap<>();
for (int i = 0; i < inputs.length; i += 2) {
String key = (String) inputs[i];
T value = (T) inputs[i + 1];
map.put(key, value);
}
return map;
}
}
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
from azure.identity import DefaultAzureCredential
from azure.mgmt.network import NetworkManagementClient
"""
# PREREQUISITES
pip install azure-identity
pip install azure-mgmt-network
# USAGE
python azure_firewall_put_with_ip_groups.py
Before run the sample, please set the values of the client ID, tenant ID and client secret
of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""
def main():
client = NetworkManagementClient(
credential=DefaultAzureCredential(),
subscription_id="SUBSCRIPTION_ID",
)
response = client.azure_firewalls.begin_create_or_update(
resource_group_name="rg1",
azure_firewall_name="azurefirewall",
parameters={
"location": "West US",
"properties": {
"applicationRuleCollections": [
{
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll",
"name": "apprulecoll",
"properties": {
"action": {"type": "Deny"},
"priority": 110,
"rules": [
{
"description": "Deny inbound rule",
"name": "rule1",
"protocols": [{"port": 443, "protocolType": "Https"}],
"sourceAddresses": ["216.58.216.164", "10.0.0.0/24"],
"targetFqdns": ["www.test.com"],
}
],
},
}
],
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"properties": {
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
},
},
}
],
"natRuleCollections": [
{
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll",
"name": "natrulecoll",
"properties": {
"action": {"type": "Dnat"},
"priority": 112,
"rules": [
{
"description": "D-NAT all outbound web traffic for inspection",
"destinationAddresses": ["1.2.3.4"],
"destinationPorts": ["443"],
"name": "DNAT-HTTPS-traffic",
"protocols": ["TCP"],
"sourceAddresses": ["*"],
"translatedAddress": "1.2.3.5",
"translatedPort": "8443",
},
{
"description": "D-NAT all inbound web traffic for inspection",
"destinationAddresses": ["1.2.3.4"],
"destinationPorts": ["80"],
"name": "DNAT-HTTP-traffic-With-FQDN",
"protocols": ["TCP"],
"sourceAddresses": ["*"],
"translatedFqdn": "internalhttpserver",
"translatedPort": "880",
},
],
},
}
],
"networkRuleCollections": [
{
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll",
"name": "netrulecoll",
"properties": {
"action": {"type": "Deny"},
"priority": 112,
"rules": [
{
"description": "Block traffic based on source IPs and ports",
"destinationAddresses": ["*"],
"destinationPorts": ["443-444", "8443"],
"name": "L4-traffic",
"protocols": ["TCP"],
"sourceAddresses": ["192.168.1.1-192.168.1.12", "10.1.4.12-10.1.4.255"],
},
{
"description": "Block traffic based on source IPs and ports to amazon",
"destinationFqdns": ["www.amazon.com"],
"destinationPorts": ["443-444", "8443"],
"name": "L4-traffic-with-FQDN",
"protocols": ["TCP"],
"sourceAddresses": ["10.2.4.12-10.2.4.255"],
},
],
},
}
],
"sku": {"name": "AZFW_VNet", "tier": "Standard"},
"threatIntelMode": "Alert",
},
"tags": {"key1": "value1"},
"zones": [],
},
).result()
print(response)
# x-ms-original-file: 2026-01-01/AzureFirewallPutWithIpGroups.json
if __name__ == "__main__":
main()
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
package armnetwork_test
import (
"context"
"log"
"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v12"
)
// Generated from example definition: 2026-01-01/AzureFirewallPutWithIpGroups.json
func ExampleAzureFirewallsClient_BeginCreateOrUpdate_createAzureFirewallWithIPGroups() {
cred, err := azidentity.NewDefaultAzureCredential(nil)
if err != nil {
log.Fatalf("failed to obtain a credential: %v", err)
}
ctx := context.Background()
clientFactory, err := armnetwork.NewClientFactory("00000000-0000-0000-0000-000000000000", cred, nil)
if err != nil {
log.Fatalf("failed to create client: %v", err)
}
poller, err := clientFactory.NewAzureFirewallsClient().BeginCreateOrUpdate(ctx, "rg1", "azurefirewall", armnetwork.AzureFirewall{
Location: to.Ptr("West US"),
Properties: &armnetwork.AzureFirewallPropertiesFormat{
ApplicationRuleCollections: []*armnetwork.AzureFirewallApplicationRuleCollection{
{
Name: to.Ptr("apprulecoll"),
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll"),
Properties: &armnetwork.AzureFirewallApplicationRuleCollectionPropertiesFormat{
Action: &armnetwork.AzureFirewallRCAction{
Type: to.Ptr(armnetwork.AzureFirewallRCActionTypeDeny),
},
Priority: to.Ptr[int32](110),
Rules: []*armnetwork.AzureFirewallApplicationRule{
{
Name: to.Ptr("rule1"),
Description: to.Ptr("Deny inbound rule"),
Protocols: []*armnetwork.AzureFirewallApplicationRuleProtocol{
{
Port: to.Ptr[int32](443),
ProtocolType: to.Ptr(armnetwork.AzureFirewallApplicationRuleProtocolTypeHTTPS),
},
},
SourceAddresses: []*string{
to.Ptr("216.58.216.164"),
to.Ptr("10.0.0.0/24"),
},
TargetFqdns: []*string{
to.Ptr("www.test.com"),
},
},
},
},
},
},
IPConfigurations: []*armnetwork.AzureFirewallIPConfiguration{
{
Name: to.Ptr("azureFirewallIpConfiguration"),
Properties: &armnetwork.AzureFirewallIPConfigurationPropertiesFormat{
PublicIPAddress: &armnetwork.SubResource{
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"),
},
Subnet: &armnetwork.SubResource{
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"),
},
},
},
},
NatRuleCollections: []*armnetwork.AzureFirewallNatRuleCollection{
{
Name: to.Ptr("natrulecoll"),
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll"),
Properties: &armnetwork.AzureFirewallNatRuleCollectionProperties{
Action: &armnetwork.AzureFirewallNatRCAction{
Type: to.Ptr(armnetwork.AzureFirewallNatRCActionTypeDnat),
},
Priority: to.Ptr[int32](112),
Rules: []*armnetwork.AzureFirewallNatRule{
{
Name: to.Ptr("DNAT-HTTPS-traffic"),
Description: to.Ptr("D-NAT all outbound web traffic for inspection"),
DestinationAddresses: []*string{
to.Ptr("1.2.3.4"),
},
DestinationPorts: []*string{
to.Ptr("443"),
},
Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
},
SourceAddresses: []*string{
to.Ptr("*"),
},
TranslatedAddress: to.Ptr("1.2.3.5"),
TranslatedPort: to.Ptr("8443"),
},
{
Name: to.Ptr("DNAT-HTTP-traffic-With-FQDN"),
Description: to.Ptr("D-NAT all inbound web traffic for inspection"),
DestinationAddresses: []*string{
to.Ptr("1.2.3.4"),
},
DestinationPorts: []*string{
to.Ptr("80"),
},
Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
},
SourceAddresses: []*string{
to.Ptr("*"),
},
TranslatedFqdn: to.Ptr("internalhttpserver"),
TranslatedPort: to.Ptr("880"),
},
},
},
},
},
NetworkRuleCollections: []*armnetwork.AzureFirewallNetworkRuleCollection{
{
Name: to.Ptr("netrulecoll"),
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll"),
Properties: &armnetwork.AzureFirewallNetworkRuleCollectionPropertiesFormat{
Action: &armnetwork.AzureFirewallRCAction{
Type: to.Ptr(armnetwork.AzureFirewallRCActionTypeDeny),
},
Priority: to.Ptr[int32](112),
Rules: []*armnetwork.AzureFirewallNetworkRule{
{
Name: to.Ptr("L4-traffic"),
Description: to.Ptr("Block traffic based on source IPs and ports"),
DestinationAddresses: []*string{
to.Ptr("*"),
},
DestinationPorts: []*string{
to.Ptr("443-444"),
to.Ptr("8443"),
},
Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
},
SourceAddresses: []*string{
to.Ptr("192.168.1.1-192.168.1.12"),
to.Ptr("10.1.4.12-10.1.4.255"),
},
},
{
Name: to.Ptr("L4-traffic-with-FQDN"),
Description: to.Ptr("Block traffic based on source IPs and ports to amazon"),
DestinationFqdns: []*string{
to.Ptr("www.amazon.com"),
},
DestinationPorts: []*string{
to.Ptr("443-444"),
to.Ptr("8443"),
},
Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
},
SourceAddresses: []*string{
to.Ptr("10.2.4.12-10.2.4.255"),
},
},
},
},
},
},
SKU: &armnetwork.AzureFirewallSKU{
Name: to.Ptr(armnetwork.AzureFirewallSKUNameAZFWVnet),
Tier: to.Ptr(armnetwork.AzureFirewallSKUTierStandard),
},
ThreatIntelMode: to.Ptr(armnetwork.AzureFirewallThreatIntelModeAlert),
},
Tags: map[string]*string{
"key1": to.Ptr("value1"),
},
Zones: []*string{},
}, nil)
if err != nil {
log.Fatalf("failed to finish the request: %v", err)
}
res, err := poller.PollUntilDone(ctx, nil)
if err != nil {
log.Fatalf("failed to poll the result: %v", err)
}
// You could use response here. We use blank identifier for just demo purposes.
_ = res
// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
// res = armnetwork.AzureFirewallsClientCreateOrUpdateResponse{
// AzureFirewall: armnetwork.AzureFirewall{
// Name: to.Ptr("azurefirewall"),
// Type: to.Ptr("Microsoft.Network/azureFirewalls"),
// Etag: to.Ptr("w/\\00000000-0000-0000-0000-000000000000\\"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall"),
// Location: to.Ptr("West US"),
// Properties: &armnetwork.AzureFirewallPropertiesFormat{
// AdditionalProperties: map[string]*string{
// },
// ApplicationRuleCollections: []*armnetwork.AzureFirewallApplicationRuleCollection{
// {
// Name: to.Ptr("apprulecoll"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll"),
// Properties: &armnetwork.AzureFirewallApplicationRuleCollectionPropertiesFormat{
// Action: &armnetwork.AzureFirewallRCAction{
// Type: to.Ptr(armnetwork.AzureFirewallRCActionTypeDeny),
// },
// Priority: to.Ptr[int32](110),
// Rules: []*armnetwork.AzureFirewallApplicationRule{
// {
// Name: to.Ptr("rule1"),
// Description: to.Ptr("Deny inbound rule"),
// Protocols: []*armnetwork.AzureFirewallApplicationRuleProtocol{
// {
// Port: to.Ptr[int32](443),
// ProtocolType: to.Ptr(armnetwork.AzureFirewallApplicationRuleProtocolTypeHTTPS),
// },
// },
// SourceAddresses: []*string{
// to.Ptr("216.58.216.164"),
// to.Ptr("10.0.0.0/24"),
// },
// TargetFqdns: []*string{
// to.Ptr("www.test.com"),
// },
// },
// },
// },
// },
// },
// IPConfigurations: []*armnetwork.AzureFirewallIPConfiguration{
// {
// Name: to.Ptr("azureFirewallIpConfiguration"),
// Etag: to.Ptr("w/\\00000000-0000-0000-0000-000000000000\\"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/ipConfigurations/azureFirewallIpConfiguration"),
// Properties: &armnetwork.AzureFirewallIPConfigurationPropertiesFormat{
// PrivateIPAddress: to.Ptr("10.0.0.0"),
// ProvisioningState: to.Ptr(armnetwork.ProvisioningStateSucceeded),
// PublicIPAddress: &armnetwork.SubResource{
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"),
// },
// Subnet: &armnetwork.SubResource{
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"),
// },
// },
// },
// },
// NatRuleCollections: []*armnetwork.AzureFirewallNatRuleCollection{
// {
// Name: to.Ptr("natrulecoll"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll"),
// Properties: &armnetwork.AzureFirewallNatRuleCollectionProperties{
// Action: &armnetwork.AzureFirewallNatRCAction{
// Type: to.Ptr(armnetwork.AzureFirewallNatRCActionTypeDnat),
// },
// Priority: to.Ptr[int32](112),
// Rules: []*armnetwork.AzureFirewallNatRule{
// {
// Name: to.Ptr("DNAT-HTTPS-traffic"),
// Description: to.Ptr("D-NAT all outbound web traffic for inspection"),
// DestinationAddresses: []*string{
// to.Ptr("1.2.3.4"),
// },
// DestinationPorts: []*string{
// to.Ptr("443"),
// },
// Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
// to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
// },
// SourceAddresses: []*string{
// to.Ptr("*"),
// },
// TranslatedAddress: to.Ptr("1.2.3.5"),
// TranslatedPort: to.Ptr("8443"),
// },
// {
// Name: to.Ptr("DNAT-HTTP-traffic-With-FQDN"),
// Description: to.Ptr("D-NAT all inbound web traffic for inspection"),
// DestinationAddresses: []*string{
// to.Ptr("1.2.3.4"),
// },
// DestinationPorts: []*string{
// to.Ptr("80"),
// },
// Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
// to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
// },
// SourceAddresses: []*string{
// to.Ptr("*"),
// },
// TranslatedFqdn: to.Ptr("internalhttpserver"),
// TranslatedPort: to.Ptr("880"),
// },
// },
// },
// },
// },
// NetworkRuleCollections: []*armnetwork.AzureFirewallNetworkRuleCollection{
// {
// Name: to.Ptr("netrulecoll"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll"),
// Properties: &armnetwork.AzureFirewallNetworkRuleCollectionPropertiesFormat{
// Action: &armnetwork.AzureFirewallRCAction{
// Type: to.Ptr(armnetwork.AzureFirewallRCActionTypeDeny),
// },
// Priority: to.Ptr[int32](112),
// Rules: []*armnetwork.AzureFirewallNetworkRule{
// {
// Name: to.Ptr("L4-traffic"),
// Description: to.Ptr("Block traffic based on source IPs and ports"),
// DestinationAddresses: []*string{
// to.Ptr("*"),
// },
// DestinationPorts: []*string{
// to.Ptr("443-444"),
// to.Ptr("8443"),
// },
// Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
// to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
// },
// SourceAddresses: []*string{
// to.Ptr("192.168.1.1-192.168.1.12"),
// to.Ptr("10.1.4.12-10.1.4.255"),
// },
// },
// {
// Name: to.Ptr("L4-traffic-with-FQDN"),
// Description: to.Ptr("Block traffic based on source IPs and ports to amazon"),
// DestinationFqdns: []*string{
// to.Ptr("www.amazon.com"),
// },
// DestinationPorts: []*string{
// to.Ptr("443-444"),
// to.Ptr("8443"),
// },
// Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
// to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
// },
// SourceAddresses: []*string{
// to.Ptr("10.2.4.12-10.2.4.255"),
// },
// },
// },
// },
// },
// },
// ProvisioningState: to.Ptr(armnetwork.ProvisioningStateSucceeded),
// SKU: &armnetwork.AzureFirewallSKU{
// Name: to.Ptr(armnetwork.AzureFirewallSKUNameAZFWVnet),
// Tier: to.Ptr(armnetwork.AzureFirewallSKUTierStandard),
// },
// ThreatIntelMode: to.Ptr(armnetwork.AzureFirewallThreatIntelModeAlert),
// },
// Tags: map[string]*string{
// "key1": to.Ptr("value1"),
// },
// Zones: []*string{
// },
// },
// }
}
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
const { NetworkManagementClient } = require("@azure/arm-network");
const { DefaultAzureCredential } = require("@azure/identity");
/**
* This sample demonstrates how to creates or updates the specified Azure Firewall.
*
* @summary creates or updates the specified Azure Firewall.
* x-ms-original-file: 2026-01-01/AzureFirewallPutWithIpGroups.json
*/
async function createAzureFirewallWithIpGroups() {
const credential = new DefaultAzureCredential();
const subscriptionId = "00000000-0000-0000-0000-000000000000";
const client = new NetworkManagementClient(credential, subscriptionId);
const result = await client.azureFirewalls.createOrUpdate("rg1", "azurefirewall", {
location: "West US",
applicationRuleCollections: [
{
name: "apprulecoll",
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll",
action: { type: "Deny" },
priority: 110,
rules: [
{
name: "rule1",
description: "Deny inbound rule",
protocols: [{ port: 443, protocolType: "Https" }],
sourceAddresses: ["216.58.216.164", "10.0.0.0/24"],
targetFqdns: ["www.test.com"],
},
],
},
],
ipConfigurations: [
{
name: "azureFirewallIpConfiguration",
publicIPAddress: {
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName",
},
subnet: {
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet",
},
},
],
natRuleCollections: [
{
name: "natrulecoll",
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll",
action: { type: "Dnat" },
priority: 112,
rules: [
{
name: "DNAT-HTTPS-traffic",
description: "D-NAT all outbound web traffic for inspection",
destinationAddresses: ["1.2.3.4"],
destinationPorts: ["443"],
protocols: ["TCP"],
sourceAddresses: ["*"],
translatedAddress: "1.2.3.5",
translatedPort: "8443",
},
{
name: "DNAT-HTTP-traffic-With-FQDN",
description: "D-NAT all inbound web traffic for inspection",
destinationAddresses: ["1.2.3.4"],
destinationPorts: ["80"],
protocols: ["TCP"],
sourceAddresses: ["*"],
translatedFqdn: "internalhttpserver",
translatedPort: "880",
},
],
},
],
networkRuleCollections: [
{
name: "netrulecoll",
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll",
action: { type: "Deny" },
priority: 112,
rules: [
{
name: "L4-traffic",
description: "Block traffic based on source IPs and ports",
destinationAddresses: ["*"],
destinationPorts: ["443-444", "8443"],
protocols: ["TCP"],
sourceAddresses: ["192.168.1.1-192.168.1.12", "10.1.4.12-10.1.4.255"],
},
{
name: "L4-traffic-with-FQDN",
description: "Block traffic based on source IPs and ports to amazon",
destinationFqdns: ["www.amazon.com"],
destinationPorts: ["443-444", "8443"],
protocols: ["TCP"],
sourceAddresses: ["10.2.4.12-10.2.4.255"],
},
],
},
],
sku: { name: "AZFW_VNet", tier: "Standard" },
threatIntelMode: "Alert",
tags: { key1: "value1" },
zones: [],
});
console.log(result);
}
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
Sample response
{
"name": "azurefirewall",
"type": "Microsoft.Network/azureFirewalls",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall",
"location": "West US",
"properties": {
"additionalProperties": {},
"applicationRuleCollections": [
{
"name": "apprulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 110,
"rules": [
{
"name": "rule1",
"description": "Deny inbound rule",
"protocols": [
{
"port": 443,
"protocolType": "Https"
}
],
"sourceAddresses": [
"216.58.216.164",
"10.0.0.0/24"
],
"targetFqdns": [
"www.test.com"
]
}
]
}
}
],
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/ipConfigurations/azureFirewallIpConfiguration",
"properties": {
"privateIPAddress": "10.0.0.0",
"provisioningState": "Succeeded",
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
}
}
}
],
"natRuleCollections": [
{
"name": "natrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll",
"properties": {
"action": {
"type": "Dnat"
},
"priority": 112,
"rules": [
{
"name": "DNAT-HTTPS-traffic",
"description": "D-NAT all outbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedAddress": "1.2.3.5",
"translatedPort": "8443"
},
{
"name": "DNAT-HTTP-traffic-With-FQDN",
"description": "D-NAT all inbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"80"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedFqdn": "internalhttpserver",
"translatedPort": "880"
}
]
}
}
],
"networkRuleCollections": [
{
"name": "netrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 112,
"rules": [
{
"name": "L4-traffic",
"description": "Block traffic based on source IPs and ports",
"destinationAddresses": [
"*"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"192.168.1.1-192.168.1.12",
"10.1.4.12-10.1.4.255"
]
},
{
"name": "L4-traffic-with-FQDN",
"description": "Block traffic based on source IPs and ports to amazon",
"destinationFqdns": [
"www.amazon.com"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"10.2.4.12-10.2.4.255"
]
}
]
}
}
],
"provisioningState": "Succeeded",
"sku": {
"name": "AZFW_VNet",
"tier": "Standard"
},
"threatIntelMode": "Alert"
},
"tags": {
"key1": "value1"
},
"zones": []
}
{
"name": "azurefirewall",
"type": "Microsoft.Network/azureFirewalls",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall",
"location": "West US",
"properties": {
"additionalProperties": {},
"applicationRuleCollections": [
{
"name": "apprulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 110,
"rules": [
{
"name": "rule1",
"description": "Deny inbound rule",
"protocols": [
{
"port": 443,
"protocolType": "Https"
}
],
"sourceIpGroups": [
"/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/resourceGroups/myResourceGroup/ipGroups/ipGroups1"
],
"targetFqdns": [
"www.test.com"
]
}
]
}
}
],
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/ipConfigurations/azureFirewallIpConfiguration",
"properties": {
"privateIPAddress": "10.0.0.0",
"provisioningState": "Succeeded",
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
}
}
}
],
"ipGroups": [
{
"changeNumber": "5",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/resourceGroups/myResourceGroup/ipGroups/ipGroups1"
},
{
"changeNumber": "4",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/resourceGroups/myResourceGroup/ipGroups/ipGroups2"
}
],
"natRuleCollections": [
{
"name": "natrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll",
"properties": {
"action": {
"type": "Dnat"
},
"priority": 112,
"rules": [
{
"name": "DNAT-HTTPS-traffic",
"description": "D-NAT all outbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"443"
],
"protocols": [
"TCP"
],
"sourceIpGroups": [
"/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/resourceGroups/myResourceGroup/ipGroups/ipGroups1"
],
"translatedAddress": "1.2.3.5",
"translatedPort": "8443"
},
{
"name": "DNAT-HTTP-traffic-With-FQDN",
"description": "D-NAT all inbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"80"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedFqdn": "internalhttpserver",
"translatedPort": "880"
}
]
}
}
],
"networkRuleCollections": [
{
"name": "netrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 112,
"rules": [
{
"name": "L4-traffic",
"description": "Block traffic based on source IPs and ports",
"destinationAddresses": [
"*"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"192.168.1.1-192.168.1.12",
"10.1.4.12-10.1.4.255"
]
},
{
"name": "L4-traffic-with-FQDN",
"description": "Block traffic based on source IPs and ports to amazon",
"destinationIpGroups": [
"/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/resourceGroups/myResourceGroup/ipGroups/ipGroups2"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"10.2.4.12-10.2.4.255"
]
}
]
}
}
],
"provisioningState": "Succeeded",
"sku": {
"name": "AZFW_VNet",
"tier": "Standard"
},
"threatIntelMode": "Alert"
},
"tags": {
"key1": "value1"
},
"zones": []
}
Create Azure Firewall With management subnet
Sample request
PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall?api-version=2026-01-01
{
"location": "West US",
"properties": {
"applicationRuleCollections": [
{
"name": "apprulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 110,
"rules": [
{
"name": "rule1",
"description": "Deny inbound rule",
"protocols": [
{
"port": 443,
"protocolType": "Https"
}
],
"sourceAddresses": [
"216.58.216.164",
"10.0.0.0/24"
],
"targetFqdns": [
"www.test.com"
]
}
]
}
}
],
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"properties": {
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
}
}
}
],
"managementIpConfiguration": {
"name": "azureFirewallMgmtIpConfiguration",
"properties": {
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/managementPipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallManagementSubnet"
}
}
},
"natRuleCollections": [
{
"name": "natrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll",
"properties": {
"action": {
"type": "Dnat"
},
"priority": 112,
"rules": [
{
"name": "DNAT-HTTPS-traffic",
"description": "D-NAT all outbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedAddress": "1.2.3.5",
"translatedPort": "8443"
},
{
"name": "DNAT-HTTP-traffic-With-FQDN",
"description": "D-NAT all inbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"80"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedFqdn": "internalhttpserver",
"translatedPort": "880"
}
]
}
}
],
"networkRuleCollections": [
{
"name": "netrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 112,
"rules": [
{
"name": "L4-traffic",
"description": "Block traffic based on source IPs and ports",
"destinationAddresses": [
"*"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"192.168.1.1-192.168.1.12",
"10.1.4.12-10.1.4.255"
]
},
{
"name": "L4-traffic-with-FQDN",
"description": "Block traffic based on source IPs and ports to amazon",
"destinationFqdns": [
"www.amazon.com"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"10.2.4.12-10.2.4.255"
]
}
]
}
}
],
"sku": {
"name": "AZFW_VNet",
"tier": "Standard"
},
"threatIntelMode": "Alert"
},
"tags": {
"key1": "value1"
},
"zones": []
}
import com.azure.core.management.SubResource;
import com.azure.resourcemanager.network.fluent.models.AzureFirewallInner;
import com.azure.resourcemanager.network.models.AzureFirewallApplicationRule;
import com.azure.resourcemanager.network.models.AzureFirewallApplicationRuleCollection;
import com.azure.resourcemanager.network.models.AzureFirewallApplicationRuleProtocol;
import com.azure.resourcemanager.network.models.AzureFirewallApplicationRuleProtocolType;
import com.azure.resourcemanager.network.models.AzureFirewallIpConfiguration;
import com.azure.resourcemanager.network.models.AzureFirewallNatRCAction;
import com.azure.resourcemanager.network.models.AzureFirewallNatRCActionType;
import com.azure.resourcemanager.network.models.AzureFirewallNatRule;
import com.azure.resourcemanager.network.models.AzureFirewallNatRuleCollection;
import com.azure.resourcemanager.network.models.AzureFirewallNetworkRule;
import com.azure.resourcemanager.network.models.AzureFirewallNetworkRuleCollection;
import com.azure.resourcemanager.network.models.AzureFirewallNetworkRuleProtocol;
import com.azure.resourcemanager.network.models.AzureFirewallRCAction;
import com.azure.resourcemanager.network.models.AzureFirewallRCActionType;
import com.azure.resourcemanager.network.models.AzureFirewallSku;
import com.azure.resourcemanager.network.models.AzureFirewallSkuName;
import com.azure.resourcemanager.network.models.AzureFirewallSkuTier;
import com.azure.resourcemanager.network.models.AzureFirewallThreatIntelMode;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;
/**
* Samples for AzureFirewalls CreateOrUpdate.
*/
public final class Main {
/*
* x-ms-original-file: 2026-01-01/AzureFirewallPutWithMgmtSubnet.json
*/
/**
* Sample code: Create Azure Firewall With management subnet.
*
* @param manager Entry point to NetworkManager.
*/
public static void
createAzureFirewallWithManagementSubnet(com.azure.resourcemanager.network.NetworkManager manager) {
manager.serviceClient().getAzureFirewalls().createOrUpdate("rg1", "azurefirewall", new AzureFirewallInner()
.withLocation("West US").withTags(mapOf("key1", "fakeTokenPlaceholder")).withZones(Arrays.asList())
.withApplicationRuleCollections(Arrays.asList(new AzureFirewallApplicationRuleCollection().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll")
.withName("apprulecoll").withPriority(110)
.withAction(new AzureFirewallRCAction().withType(AzureFirewallRCActionType.DENY))
.withRules(Arrays
.asList(new AzureFirewallApplicationRule().withName("rule1").withDescription("Deny inbound rule")
.withSourceAddresses(Arrays.asList("216.58.216.164", "10.0.0.0/24"))
.withProtocols(Arrays.asList(new AzureFirewallApplicationRuleProtocol()
.withProtocolType(AzureFirewallApplicationRuleProtocolType.HTTPS).withPort(443)))
.withTargetFqdns(Arrays.asList("www.test.com"))))))
.withNatRuleCollections(Arrays.asList(new AzureFirewallNatRuleCollection().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll")
.withName("natrulecoll").withPriority(112)
.withAction(new AzureFirewallNatRCAction().withType(AzureFirewallNatRCActionType.DNAT))
.withRules(Arrays.asList(
new AzureFirewallNatRule().withName("DNAT-HTTPS-traffic")
.withDescription("D-NAT all outbound web traffic for inspection")
.withSourceAddresses(Arrays.asList("*")).withDestinationAddresses(Arrays.asList("1.2.3.4"))
.withDestinationPorts(Arrays.asList("443"))
.withProtocols(Arrays.asList(AzureFirewallNetworkRuleProtocol.TCP))
.withTranslatedAddress("1.2.3.5").withTranslatedPort("8443"),
new AzureFirewallNatRule().withName("DNAT-HTTP-traffic-With-FQDN")
.withDescription("D-NAT all inbound web traffic for inspection")
.withSourceAddresses(Arrays.asList("*")).withDestinationAddresses(Arrays.asList("1.2.3.4"))
.withDestinationPorts(Arrays.asList("80"))
.withProtocols(Arrays.asList(AzureFirewallNetworkRuleProtocol.TCP)).withTranslatedPort("880")
.withTranslatedFqdn("internalhttpserver")))))
.withNetworkRuleCollections(Arrays.asList(new AzureFirewallNetworkRuleCollection().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll")
.withName("netrulecoll").withPriority(112)
.withAction(
new AzureFirewallRCAction().withType(AzureFirewallRCActionType.DENY))
.withRules(Arrays.asList(
new AzureFirewallNetworkRule().withName("L4-traffic")
.withDescription("Block traffic based on source IPs and ports")
.withProtocols(Arrays.asList(AzureFirewallNetworkRuleProtocol.TCP))
.withSourceAddresses(Arrays.asList("192.168.1.1-192.168.1.12", "10.1.4.12-10.1.4.255"))
.withDestinationAddresses(Arrays.asList("*"))
.withDestinationPorts(Arrays.asList("443-444", "8443")),
new AzureFirewallNetworkRule().withName("L4-traffic-with-FQDN")
.withDescription("Block traffic based on source IPs and ports to amazon")
.withProtocols(Arrays.asList(AzureFirewallNetworkRuleProtocol.TCP))
.withSourceAddresses(Arrays.asList("10.2.4.12-10.2.4.255"))
.withDestinationPorts(Arrays.asList("443-444", "8443"))
.withDestinationFqdns(Arrays.asList("www.amazon.com"))))))
.withIpConfigurations(Arrays.asList(new AzureFirewallIpConfiguration()
.withName("azureFirewallIpConfiguration")
.withSubnet(new SubResource().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"))
.withPublicIpAddress(new SubResource().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"))))
.withManagementIpConfiguration(new AzureFirewallIpConfiguration()
.withName("azureFirewallMgmtIpConfiguration")
.withSubnet(new SubResource().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallManagementSubnet"))
.withPublicIpAddress(new SubResource().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/managementPipName")))
.withThreatIntelMode(AzureFirewallThreatIntelMode.ALERT).withSku(new AzureFirewallSku()
.withName(AzureFirewallSkuName.AZFW_VNET).withTier(AzureFirewallSkuTier.STANDARD)),
null, com.azure.core.util.Context.NONE);
}
// Use "Map.of" if available
@SuppressWarnings("unchecked")
private static <T> Map<String, T> mapOf(Object... inputs) {
Map<String, T> map = new HashMap<>();
for (int i = 0; i < inputs.length; i += 2) {
String key = (String) inputs[i];
T value = (T) inputs[i + 1];
map.put(key, value);
}
return map;
}
}
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
from azure.identity import DefaultAzureCredential
from azure.mgmt.network import NetworkManagementClient
"""
# PREREQUISITES
pip install azure-identity
pip install azure-mgmt-network
# USAGE
python azure_firewall_put_with_mgmt_subnet.py
Before run the sample, please set the values of the client ID, tenant ID and client secret
of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""
def main():
client = NetworkManagementClient(
credential=DefaultAzureCredential(),
subscription_id="SUBSCRIPTION_ID",
)
response = client.azure_firewalls.begin_create_or_update(
resource_group_name="rg1",
azure_firewall_name="azurefirewall",
parameters={
"location": "West US",
"properties": {
"applicationRuleCollections": [
{
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll",
"name": "apprulecoll",
"properties": {
"action": {"type": "Deny"},
"priority": 110,
"rules": [
{
"description": "Deny inbound rule",
"name": "rule1",
"protocols": [{"port": 443, "protocolType": "Https"}],
"sourceAddresses": ["216.58.216.164", "10.0.0.0/24"],
"targetFqdns": ["www.test.com"],
}
],
},
}
],
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"properties": {
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
},
},
}
],
"managementIpConfiguration": {
"name": "azureFirewallMgmtIpConfiguration",
"properties": {
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/managementPipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallManagementSubnet"
},
},
},
"natRuleCollections": [
{
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll",
"name": "natrulecoll",
"properties": {
"action": {"type": "Dnat"},
"priority": 112,
"rules": [
{
"description": "D-NAT all outbound web traffic for inspection",
"destinationAddresses": ["1.2.3.4"],
"destinationPorts": ["443"],
"name": "DNAT-HTTPS-traffic",
"protocols": ["TCP"],
"sourceAddresses": ["*"],
"translatedAddress": "1.2.3.5",
"translatedPort": "8443",
},
{
"description": "D-NAT all inbound web traffic for inspection",
"destinationAddresses": ["1.2.3.4"],
"destinationPorts": ["80"],
"name": "DNAT-HTTP-traffic-With-FQDN",
"protocols": ["TCP"],
"sourceAddresses": ["*"],
"translatedFqdn": "internalhttpserver",
"translatedPort": "880",
},
],
},
}
],
"networkRuleCollections": [
{
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll",
"name": "netrulecoll",
"properties": {
"action": {"type": "Deny"},
"priority": 112,
"rules": [
{
"description": "Block traffic based on source IPs and ports",
"destinationAddresses": ["*"],
"destinationPorts": ["443-444", "8443"],
"name": "L4-traffic",
"protocols": ["TCP"],
"sourceAddresses": ["192.168.1.1-192.168.1.12", "10.1.4.12-10.1.4.255"],
},
{
"description": "Block traffic based on source IPs and ports to amazon",
"destinationFqdns": ["www.amazon.com"],
"destinationPorts": ["443-444", "8443"],
"name": "L4-traffic-with-FQDN",
"protocols": ["TCP"],
"sourceAddresses": ["10.2.4.12-10.2.4.255"],
},
],
},
}
],
"sku": {"name": "AZFW_VNet", "tier": "Standard"},
"threatIntelMode": "Alert",
},
"tags": {"key1": "value1"},
"zones": [],
},
).result()
print(response)
# x-ms-original-file: 2026-01-01/AzureFirewallPutWithMgmtSubnet.json
if __name__ == "__main__":
main()
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
package armnetwork_test
import (
"context"
"log"
"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v12"
)
// Generated from example definition: 2026-01-01/AzureFirewallPutWithMgmtSubnet.json
func ExampleAzureFirewallsClient_BeginCreateOrUpdate_createAzureFirewallWithManagementSubnet() {
cred, err := azidentity.NewDefaultAzureCredential(nil)
if err != nil {
log.Fatalf("failed to obtain a credential: %v", err)
}
ctx := context.Background()
clientFactory, err := armnetwork.NewClientFactory("00000000-0000-0000-0000-000000000000", cred, nil)
if err != nil {
log.Fatalf("failed to create client: %v", err)
}
poller, err := clientFactory.NewAzureFirewallsClient().BeginCreateOrUpdate(ctx, "rg1", "azurefirewall", armnetwork.AzureFirewall{
Location: to.Ptr("West US"),
Properties: &armnetwork.AzureFirewallPropertiesFormat{
ApplicationRuleCollections: []*armnetwork.AzureFirewallApplicationRuleCollection{
{
Name: to.Ptr("apprulecoll"),
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll"),
Properties: &armnetwork.AzureFirewallApplicationRuleCollectionPropertiesFormat{
Action: &armnetwork.AzureFirewallRCAction{
Type: to.Ptr(armnetwork.AzureFirewallRCActionTypeDeny),
},
Priority: to.Ptr[int32](110),
Rules: []*armnetwork.AzureFirewallApplicationRule{
{
Name: to.Ptr("rule1"),
Description: to.Ptr("Deny inbound rule"),
Protocols: []*armnetwork.AzureFirewallApplicationRuleProtocol{
{
Port: to.Ptr[int32](443),
ProtocolType: to.Ptr(armnetwork.AzureFirewallApplicationRuleProtocolTypeHTTPS),
},
},
SourceAddresses: []*string{
to.Ptr("216.58.216.164"),
to.Ptr("10.0.0.0/24"),
},
TargetFqdns: []*string{
to.Ptr("www.test.com"),
},
},
},
},
},
},
IPConfigurations: []*armnetwork.AzureFirewallIPConfiguration{
{
Name: to.Ptr("azureFirewallIpConfiguration"),
Properties: &armnetwork.AzureFirewallIPConfigurationPropertiesFormat{
PublicIPAddress: &armnetwork.SubResource{
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"),
},
Subnet: &armnetwork.SubResource{
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"),
},
},
},
},
ManagementIPConfiguration: &armnetwork.AzureFirewallIPConfiguration{
Name: to.Ptr("azureFirewallMgmtIpConfiguration"),
Properties: &armnetwork.AzureFirewallIPConfigurationPropertiesFormat{
PublicIPAddress: &armnetwork.SubResource{
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/managementPipName"),
},
Subnet: &armnetwork.SubResource{
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallManagementSubnet"),
},
},
},
NatRuleCollections: []*armnetwork.AzureFirewallNatRuleCollection{
{
Name: to.Ptr("natrulecoll"),
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll"),
Properties: &armnetwork.AzureFirewallNatRuleCollectionProperties{
Action: &armnetwork.AzureFirewallNatRCAction{
Type: to.Ptr(armnetwork.AzureFirewallNatRCActionTypeDnat),
},
Priority: to.Ptr[int32](112),
Rules: []*armnetwork.AzureFirewallNatRule{
{
Name: to.Ptr("DNAT-HTTPS-traffic"),
Description: to.Ptr("D-NAT all outbound web traffic for inspection"),
DestinationAddresses: []*string{
to.Ptr("1.2.3.4"),
},
DestinationPorts: []*string{
to.Ptr("443"),
},
Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
},
SourceAddresses: []*string{
to.Ptr("*"),
},
TranslatedAddress: to.Ptr("1.2.3.5"),
TranslatedPort: to.Ptr("8443"),
},
{
Name: to.Ptr("DNAT-HTTP-traffic-With-FQDN"),
Description: to.Ptr("D-NAT all inbound web traffic for inspection"),
DestinationAddresses: []*string{
to.Ptr("1.2.3.4"),
},
DestinationPorts: []*string{
to.Ptr("80"),
},
Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
},
SourceAddresses: []*string{
to.Ptr("*"),
},
TranslatedFqdn: to.Ptr("internalhttpserver"),
TranslatedPort: to.Ptr("880"),
},
},
},
},
},
NetworkRuleCollections: []*armnetwork.AzureFirewallNetworkRuleCollection{
{
Name: to.Ptr("netrulecoll"),
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll"),
Properties: &armnetwork.AzureFirewallNetworkRuleCollectionPropertiesFormat{
Action: &armnetwork.AzureFirewallRCAction{
Type: to.Ptr(armnetwork.AzureFirewallRCActionTypeDeny),
},
Priority: to.Ptr[int32](112),
Rules: []*armnetwork.AzureFirewallNetworkRule{
{
Name: to.Ptr("L4-traffic"),
Description: to.Ptr("Block traffic based on source IPs and ports"),
DestinationAddresses: []*string{
to.Ptr("*"),
},
DestinationPorts: []*string{
to.Ptr("443-444"),
to.Ptr("8443"),
},
Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
},
SourceAddresses: []*string{
to.Ptr("192.168.1.1-192.168.1.12"),
to.Ptr("10.1.4.12-10.1.4.255"),
},
},
{
Name: to.Ptr("L4-traffic-with-FQDN"),
Description: to.Ptr("Block traffic based on source IPs and ports to amazon"),
DestinationFqdns: []*string{
to.Ptr("www.amazon.com"),
},
DestinationPorts: []*string{
to.Ptr("443-444"),
to.Ptr("8443"),
},
Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
},
SourceAddresses: []*string{
to.Ptr("10.2.4.12-10.2.4.255"),
},
},
},
},
},
},
SKU: &armnetwork.AzureFirewallSKU{
Name: to.Ptr(armnetwork.AzureFirewallSKUNameAZFWVnet),
Tier: to.Ptr(armnetwork.AzureFirewallSKUTierStandard),
},
ThreatIntelMode: to.Ptr(armnetwork.AzureFirewallThreatIntelModeAlert),
},
Tags: map[string]*string{
"key1": to.Ptr("value1"),
},
Zones: []*string{},
}, nil)
if err != nil {
log.Fatalf("failed to finish the request: %v", err)
}
res, err := poller.PollUntilDone(ctx, nil)
if err != nil {
log.Fatalf("failed to poll the result: %v", err)
}
// You could use response here. We use blank identifier for just demo purposes.
_ = res
// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
// res = armnetwork.AzureFirewallsClientCreateOrUpdateResponse{
// AzureFirewall: armnetwork.AzureFirewall{
// Name: to.Ptr("azurefirewall"),
// Type: to.Ptr("Microsoft.Network/azureFirewalls"),
// Etag: to.Ptr("w/\\00000000-0000-0000-0000-000000000000\\"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall"),
// Location: to.Ptr("West US"),
// Properties: &armnetwork.AzureFirewallPropertiesFormat{
// AdditionalProperties: map[string]*string{
// },
// ApplicationRuleCollections: []*armnetwork.AzureFirewallApplicationRuleCollection{
// {
// Name: to.Ptr("apprulecoll"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll"),
// Properties: &armnetwork.AzureFirewallApplicationRuleCollectionPropertiesFormat{
// Action: &armnetwork.AzureFirewallRCAction{
// Type: to.Ptr(armnetwork.AzureFirewallRCActionTypeDeny),
// },
// Priority: to.Ptr[int32](110),
// Rules: []*armnetwork.AzureFirewallApplicationRule{
// {
// Name: to.Ptr("rule1"),
// Description: to.Ptr("Deny inbound rule"),
// Protocols: []*armnetwork.AzureFirewallApplicationRuleProtocol{
// {
// Port: to.Ptr[int32](443),
// ProtocolType: to.Ptr(armnetwork.AzureFirewallApplicationRuleProtocolTypeHTTPS),
// },
// },
// SourceAddresses: []*string{
// to.Ptr("216.58.216.164"),
// to.Ptr("10.0.0.0/24"),
// },
// TargetFqdns: []*string{
// to.Ptr("www.test.com"),
// },
// },
// },
// },
// },
// },
// IPConfigurations: []*armnetwork.AzureFirewallIPConfiguration{
// {
// Name: to.Ptr("azureFirewallIpConfiguration"),
// Etag: to.Ptr("w/\\00000000-0000-0000-0000-000000000000\\"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/ipConfigurations/azureFirewallIpConfiguration"),
// Properties: &armnetwork.AzureFirewallIPConfigurationPropertiesFormat{
// PrivateIPAddress: to.Ptr("10.0.0.0"),
// ProvisioningState: to.Ptr(armnetwork.ProvisioningStateSucceeded),
// PublicIPAddress: &armnetwork.SubResource{
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"),
// },
// Subnet: &armnetwork.SubResource{
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"),
// },
// },
// },
// },
// NatRuleCollections: []*armnetwork.AzureFirewallNatRuleCollection{
// {
// Name: to.Ptr("natrulecoll"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll"),
// Properties: &armnetwork.AzureFirewallNatRuleCollectionProperties{
// Action: &armnetwork.AzureFirewallNatRCAction{
// Type: to.Ptr(armnetwork.AzureFirewallNatRCActionTypeDnat),
// },
// Priority: to.Ptr[int32](112),
// Rules: []*armnetwork.AzureFirewallNatRule{
// {
// Name: to.Ptr("DNAT-HTTPS-traffic"),
// Description: to.Ptr("D-NAT all outbound web traffic for inspection"),
// DestinationAddresses: []*string{
// to.Ptr("1.2.3.4"),
// },
// DestinationPorts: []*string{
// to.Ptr("443"),
// },
// Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
// to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
// },
// SourceAddresses: []*string{
// to.Ptr("*"),
// },
// TranslatedAddress: to.Ptr("1.2.3.5"),
// TranslatedPort: to.Ptr("8443"),
// },
// {
// Name: to.Ptr("DNAT-HTTP-traffic-With-FQDN"),
// Description: to.Ptr("D-NAT all inbound web traffic for inspection"),
// DestinationAddresses: []*string{
// to.Ptr("1.2.3.4"),
// },
// DestinationPorts: []*string{
// to.Ptr("80"),
// },
// Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
// to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
// },
// SourceAddresses: []*string{
// to.Ptr("*"),
// },
// TranslatedFqdn: to.Ptr("internalhttpserver"),
// TranslatedPort: to.Ptr("880"),
// },
// },
// },
// },
// },
// NetworkRuleCollections: []*armnetwork.AzureFirewallNetworkRuleCollection{
// {
// Name: to.Ptr("netrulecoll"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll"),
// Properties: &armnetwork.AzureFirewallNetworkRuleCollectionPropertiesFormat{
// Action: &armnetwork.AzureFirewallRCAction{
// Type: to.Ptr(armnetwork.AzureFirewallRCActionTypeDeny),
// },
// Priority: to.Ptr[int32](112),
// Rules: []*armnetwork.AzureFirewallNetworkRule{
// {
// Name: to.Ptr("L4-traffic"),
// Description: to.Ptr("Block traffic based on source IPs and ports"),
// DestinationAddresses: []*string{
// to.Ptr("*"),
// },
// DestinationPorts: []*string{
// to.Ptr("443-444"),
// to.Ptr("8443"),
// },
// Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
// to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
// },
// SourceAddresses: []*string{
// to.Ptr("192.168.1.1-192.168.1.12"),
// to.Ptr("10.1.4.12-10.1.4.255"),
// },
// },
// {
// Name: to.Ptr("L4-traffic-with-FQDN"),
// Description: to.Ptr("Block traffic based on source IPs and ports to amazon"),
// DestinationFqdns: []*string{
// to.Ptr("www.amazon.com"),
// },
// DestinationPorts: []*string{
// to.Ptr("443-444"),
// to.Ptr("8443"),
// },
// Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
// to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
// },
// SourceAddresses: []*string{
// to.Ptr("10.2.4.12-10.2.4.255"),
// },
// },
// },
// },
// },
// },
// ProvisioningState: to.Ptr(armnetwork.ProvisioningStateSucceeded),
// SKU: &armnetwork.AzureFirewallSKU{
// Name: to.Ptr(armnetwork.AzureFirewallSKUNameAZFWVnet),
// Tier: to.Ptr(armnetwork.AzureFirewallSKUTierStandard),
// },
// ThreatIntelMode: to.Ptr(armnetwork.AzureFirewallThreatIntelModeAlert),
// },
// Tags: map[string]*string{
// "key1": to.Ptr("value1"),
// },
// Zones: []*string{
// },
// },
// }
}
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
const { NetworkManagementClient } = require("@azure/arm-network");
const { DefaultAzureCredential } = require("@azure/identity");
/**
* This sample demonstrates how to creates or updates the specified Azure Firewall.
*
* @summary creates or updates the specified Azure Firewall.
* x-ms-original-file: 2026-01-01/AzureFirewallPutWithMgmtSubnet.json
*/
async function createAzureFirewallWithManagementSubnet() {
const credential = new DefaultAzureCredential();
const subscriptionId = "00000000-0000-0000-0000-000000000000";
const client = new NetworkManagementClient(credential, subscriptionId);
const result = await client.azureFirewalls.createOrUpdate("rg1", "azurefirewall", {
location: "West US",
applicationRuleCollections: [
{
name: "apprulecoll",
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll",
action: { type: "Deny" },
priority: 110,
rules: [
{
name: "rule1",
description: "Deny inbound rule",
protocols: [{ port: 443, protocolType: "Https" }],
sourceAddresses: ["216.58.216.164", "10.0.0.0/24"],
targetFqdns: ["www.test.com"],
},
],
},
],
ipConfigurations: [
{
name: "azureFirewallIpConfiguration",
publicIPAddress: {
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName",
},
subnet: {
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet",
},
},
],
managementIpConfiguration: {
name: "azureFirewallMgmtIpConfiguration",
publicIPAddress: {
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/managementPipName",
},
subnet: {
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallManagementSubnet",
},
},
natRuleCollections: [
{
name: "natrulecoll",
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll",
action: { type: "Dnat" },
priority: 112,
rules: [
{
name: "DNAT-HTTPS-traffic",
description: "D-NAT all outbound web traffic for inspection",
destinationAddresses: ["1.2.3.4"],
destinationPorts: ["443"],
protocols: ["TCP"],
sourceAddresses: ["*"],
translatedAddress: "1.2.3.5",
translatedPort: "8443",
},
{
name: "DNAT-HTTP-traffic-With-FQDN",
description: "D-NAT all inbound web traffic for inspection",
destinationAddresses: ["1.2.3.4"],
destinationPorts: ["80"],
protocols: ["TCP"],
sourceAddresses: ["*"],
translatedFqdn: "internalhttpserver",
translatedPort: "880",
},
],
},
],
networkRuleCollections: [
{
name: "netrulecoll",
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll",
action: { type: "Deny" },
priority: 112,
rules: [
{
name: "L4-traffic",
description: "Block traffic based on source IPs and ports",
destinationAddresses: ["*"],
destinationPorts: ["443-444", "8443"],
protocols: ["TCP"],
sourceAddresses: ["192.168.1.1-192.168.1.12", "10.1.4.12-10.1.4.255"],
},
{
name: "L4-traffic-with-FQDN",
description: "Block traffic based on source IPs and ports to amazon",
destinationFqdns: ["www.amazon.com"],
destinationPorts: ["443-444", "8443"],
protocols: ["TCP"],
sourceAddresses: ["10.2.4.12-10.2.4.255"],
},
],
},
],
sku: { name: "AZFW_VNet", tier: "Standard" },
threatIntelMode: "Alert",
tags: { key1: "value1" },
zones: [],
});
console.log(result);
}
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
Sample response
{
"name": "azurefirewall",
"type": "Microsoft.Network/azureFirewalls",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall",
"location": "West US",
"properties": {
"additionalProperties": {},
"applicationRuleCollections": [
{
"name": "apprulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 110,
"rules": [
{
"name": "rule1",
"description": "Deny inbound rule",
"protocols": [
{
"port": 443,
"protocolType": "Https"
}
],
"sourceAddresses": [
"216.58.216.164",
"10.0.0.0/24"
],
"targetFqdns": [
"www.test.com"
]
}
]
}
}
],
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/ipConfigurations/azureFirewallIpConfiguration",
"properties": {
"privateIPAddress": "10.0.0.0",
"provisioningState": "Succeeded",
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
}
}
}
],
"natRuleCollections": [
{
"name": "natrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll",
"properties": {
"action": {
"type": "Dnat"
},
"priority": 112,
"rules": [
{
"name": "DNAT-HTTPS-traffic",
"description": "D-NAT all outbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedAddress": "1.2.3.5",
"translatedPort": "8443"
},
{
"name": "DNAT-HTTP-traffic-With-FQDN",
"description": "D-NAT all inbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"80"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedFqdn": "internalhttpserver",
"translatedPort": "880"
}
]
}
}
],
"networkRuleCollections": [
{
"name": "netrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 112,
"rules": [
{
"name": "L4-traffic",
"description": "Block traffic based on source IPs and ports",
"destinationAddresses": [
"*"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"192.168.1.1-192.168.1.12",
"10.1.4.12-10.1.4.255"
]
},
{
"name": "L4-traffic-with-FQDN",
"description": "Block traffic based on source IPs and ports to amazon",
"destinationFqdns": [
"www.amazon.com"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"10.2.4.12-10.2.4.255"
]
}
]
}
}
],
"provisioningState": "Succeeded",
"sku": {
"name": "AZFW_VNet",
"tier": "Standard"
},
"threatIntelMode": "Alert"
},
"tags": {
"key1": "value1"
},
"zones": []
}
{
"name": "azurefirewall",
"type": "Microsoft.Network/azureFirewalls",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall",
"location": "West US",
"properties": {
"additionalProperties": {},
"applicationRuleCollections": [
{
"name": "apprulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 110,
"rules": [
{
"name": "rule1",
"description": "Deny inbound rule",
"protocols": [
{
"port": 443,
"protocolType": "Https"
}
],
"sourceAddresses": [
"216.58.216.164",
"10.0.0.0/24"
],
"targetFqdns": [
"www.test.com"
]
}
]
}
}
],
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/ipConfigurations/azureFirewallIpConfiguration",
"properties": {
"privateIPAddress": "10.0.0.0",
"provisioningState": "Succeeded",
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
}
}
}
],
"natRuleCollections": [
{
"name": "natrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll",
"properties": {
"action": {
"type": "Dnat"
},
"priority": 112,
"rules": [
{
"name": "DNAT-HTTPS-traffic",
"description": "D-NAT all outbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedAddress": "1.2.3.5",
"translatedPort": "8443"
},
{
"name": "DNAT-HTTP-traffic-With-FQDN",
"description": "D-NAT all inbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"80"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedFqdn": "internalhttpserver",
"translatedPort": "880"
}
]
}
}
],
"networkRuleCollections": [
{
"name": "netrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 112,
"rules": [
{
"name": "L4-traffic",
"description": "Block traffic based on source IPs and ports",
"destinationAddresses": [
"*"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"192.168.1.1-192.168.1.12",
"10.1.4.12-10.1.4.255"
]
},
{
"name": "L4-traffic-with-FQDN",
"description": "Block traffic based on source IPs and ports to amazon",
"destinationFqdns": [
"www.amazon.com"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"10.2.4.12-10.2.4.255"
]
}
]
}
}
],
"provisioningState": "Succeeded",
"sku": {
"name": "AZFW_VNet",
"tier": "Standard"
},
"threatIntelMode": "Alert"
},
"tags": {
"key1": "value1"
},
"zones": []
}
Create Azure Firewall With Zones
Sample request
PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall?api-version=2026-01-01
{
"location": "West US 2",
"properties": {
"applicationRuleCollections": [
{
"name": "apprulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 110,
"rules": [
{
"name": "rule1",
"description": "Deny inbound rule",
"protocols": [
{
"port": 443,
"protocolType": "Https"
}
],
"sourceAddresses": [
"216.58.216.164",
"10.0.0.0/24"
],
"targetFqdns": [
"www.test.com"
]
}
]
}
}
],
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"properties": {
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
}
}
}
],
"natRuleCollections": [
{
"name": "natrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll",
"properties": {
"action": {
"type": "Dnat"
},
"priority": 112,
"rules": [
{
"name": "DNAT-HTTPS-traffic",
"description": "D-NAT all outbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedAddress": "1.2.3.5",
"translatedPort": "8443"
},
{
"name": "DNAT-HTTP-traffic-With-FQDN",
"description": "D-NAT all inbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"80"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedFqdn": "internalhttpserver",
"translatedPort": "880"
}
]
}
}
],
"networkRuleCollections": [
{
"name": "netrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 112,
"rules": [
{
"name": "L4-traffic",
"description": "Block traffic based on source IPs and ports",
"destinationAddresses": [
"*"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"192.168.1.1-192.168.1.12",
"10.1.4.12-10.1.4.255"
]
},
{
"name": "L4-traffic-with-FQDN",
"description": "Block traffic based on source IPs and ports to amazon",
"destinationFqdns": [
"www.amazon.com"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"10.2.4.12-10.2.4.255"
]
}
]
}
}
],
"sku": {
"name": "AZFW_VNet",
"tier": "Standard"
},
"threatIntelMode": "Alert"
},
"tags": {
"key1": "value1"
},
"zones": [
"1",
"2",
"3"
]
}
import com.azure.core.management.SubResource;
import com.azure.resourcemanager.network.fluent.models.AzureFirewallInner;
import com.azure.resourcemanager.network.models.AzureFirewallApplicationRule;
import com.azure.resourcemanager.network.models.AzureFirewallApplicationRuleCollection;
import com.azure.resourcemanager.network.models.AzureFirewallApplicationRuleProtocol;
import com.azure.resourcemanager.network.models.AzureFirewallApplicationRuleProtocolType;
import com.azure.resourcemanager.network.models.AzureFirewallIpConfiguration;
import com.azure.resourcemanager.network.models.AzureFirewallNatRCAction;
import com.azure.resourcemanager.network.models.AzureFirewallNatRCActionType;
import com.azure.resourcemanager.network.models.AzureFirewallNatRule;
import com.azure.resourcemanager.network.models.AzureFirewallNatRuleCollection;
import com.azure.resourcemanager.network.models.AzureFirewallNetworkRule;
import com.azure.resourcemanager.network.models.AzureFirewallNetworkRuleCollection;
import com.azure.resourcemanager.network.models.AzureFirewallNetworkRuleProtocol;
import com.azure.resourcemanager.network.models.AzureFirewallRCAction;
import com.azure.resourcemanager.network.models.AzureFirewallRCActionType;
import com.azure.resourcemanager.network.models.AzureFirewallSku;
import com.azure.resourcemanager.network.models.AzureFirewallSkuName;
import com.azure.resourcemanager.network.models.AzureFirewallSkuTier;
import com.azure.resourcemanager.network.models.AzureFirewallThreatIntelMode;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;
/**
* Samples for AzureFirewalls CreateOrUpdate.
*/
public final class Main {
/*
* x-ms-original-file: 2026-01-01/AzureFirewallPutWithZones.json
*/
/**
* Sample code: Create Azure Firewall With Zones.
*
* @param manager Entry point to NetworkManager.
*/
public static void createAzureFirewallWithZones(com.azure.resourcemanager.network.NetworkManager manager) {
manager.serviceClient().getAzureFirewalls().createOrUpdate("rg1", "azurefirewall", new AzureFirewallInner()
.withLocation("West US 2").withTags(mapOf("key1", "fakeTokenPlaceholder"))
.withZones(Arrays.asList("1", "2", "3"))
.withApplicationRuleCollections(Arrays.asList(new AzureFirewallApplicationRuleCollection().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll")
.withName("apprulecoll").withPriority(110)
.withAction(new AzureFirewallRCAction().withType(AzureFirewallRCActionType.DENY))
.withRules(Arrays
.asList(new AzureFirewallApplicationRule().withName("rule1").withDescription("Deny inbound rule")
.withSourceAddresses(Arrays.asList("216.58.216.164", "10.0.0.0/24"))
.withProtocols(Arrays.asList(new AzureFirewallApplicationRuleProtocol()
.withProtocolType(AzureFirewallApplicationRuleProtocolType.HTTPS).withPort(443)))
.withTargetFqdns(Arrays.asList("www.test.com"))))))
.withNatRuleCollections(Arrays.asList(new AzureFirewallNatRuleCollection().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll")
.withName("natrulecoll").withPriority(112)
.withAction(new AzureFirewallNatRCAction().withType(AzureFirewallNatRCActionType.DNAT))
.withRules(Arrays.asList(
new AzureFirewallNatRule().withName("DNAT-HTTPS-traffic")
.withDescription("D-NAT all outbound web traffic for inspection")
.withSourceAddresses(Arrays.asList("*")).withDestinationAddresses(Arrays.asList("1.2.3.4"))
.withDestinationPorts(Arrays.asList("443"))
.withProtocols(Arrays.asList(AzureFirewallNetworkRuleProtocol.TCP))
.withTranslatedAddress("1.2.3.5").withTranslatedPort("8443"),
new AzureFirewallNatRule().withName("DNAT-HTTP-traffic-With-FQDN")
.withDescription("D-NAT all inbound web traffic for inspection")
.withSourceAddresses(Arrays.asList("*")).withDestinationAddresses(Arrays.asList("1.2.3.4"))
.withDestinationPorts(Arrays.asList("80"))
.withProtocols(Arrays.asList(AzureFirewallNetworkRuleProtocol.TCP)).withTranslatedPort("880")
.withTranslatedFqdn("internalhttpserver")))))
.withNetworkRuleCollections(Arrays.asList(new AzureFirewallNetworkRuleCollection().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll")
.withName("netrulecoll").withPriority(112)
.withAction(
new AzureFirewallRCAction().withType(AzureFirewallRCActionType.DENY))
.withRules(Arrays.asList(
new AzureFirewallNetworkRule().withName("L4-traffic")
.withDescription("Block traffic based on source IPs and ports")
.withProtocols(Arrays.asList(AzureFirewallNetworkRuleProtocol.TCP))
.withSourceAddresses(Arrays.asList("192.168.1.1-192.168.1.12", "10.1.4.12-10.1.4.255"))
.withDestinationAddresses(Arrays.asList("*"))
.withDestinationPorts(Arrays.asList("443-444", "8443")),
new AzureFirewallNetworkRule().withName("L4-traffic-with-FQDN")
.withDescription("Block traffic based on source IPs and ports to amazon")
.withProtocols(Arrays.asList(AzureFirewallNetworkRuleProtocol.TCP))
.withSourceAddresses(Arrays.asList("10.2.4.12-10.2.4.255"))
.withDestinationPorts(Arrays.asList("443-444", "8443"))
.withDestinationFqdns(Arrays.asList("www.amazon.com"))))))
.withIpConfigurations(Arrays.asList(new AzureFirewallIpConfiguration()
.withName("azureFirewallIpConfiguration")
.withSubnet(new SubResource().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"))
.withPublicIpAddress(new SubResource().withId(
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"))))
.withThreatIntelMode(AzureFirewallThreatIntelMode.ALERT).withSku(new AzureFirewallSku()
.withName(AzureFirewallSkuName.AZFW_VNET).withTier(AzureFirewallSkuTier.STANDARD)),
null, com.azure.core.util.Context.NONE);
}
// Use "Map.of" if available
@SuppressWarnings("unchecked")
private static <T> Map<String, T> mapOf(Object... inputs) {
Map<String, T> map = new HashMap<>();
for (int i = 0; i < inputs.length; i += 2) {
String key = (String) inputs[i];
T value = (T) inputs[i + 1];
map.put(key, value);
}
return map;
}
}
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
from azure.identity import DefaultAzureCredential
from azure.mgmt.network import NetworkManagementClient
"""
# PREREQUISITES
pip install azure-identity
pip install azure-mgmt-network
# USAGE
python azure_firewall_put_with_zones.py
Before run the sample, please set the values of the client ID, tenant ID and client secret
of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""
def main():
client = NetworkManagementClient(
credential=DefaultAzureCredential(),
subscription_id="SUBSCRIPTION_ID",
)
response = client.azure_firewalls.begin_create_or_update(
resource_group_name="rg1",
azure_firewall_name="azurefirewall",
parameters={
"location": "West US 2",
"properties": {
"applicationRuleCollections": [
{
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll",
"name": "apprulecoll",
"properties": {
"action": {"type": "Deny"},
"priority": 110,
"rules": [
{
"description": "Deny inbound rule",
"name": "rule1",
"protocols": [{"port": 443, "protocolType": "Https"}],
"sourceAddresses": ["216.58.216.164", "10.0.0.0/24"],
"targetFqdns": ["www.test.com"],
}
],
},
}
],
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"properties": {
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
},
},
}
],
"natRuleCollections": [
{
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll",
"name": "natrulecoll",
"properties": {
"action": {"type": "Dnat"},
"priority": 112,
"rules": [
{
"description": "D-NAT all outbound web traffic for inspection",
"destinationAddresses": ["1.2.3.4"],
"destinationPorts": ["443"],
"name": "DNAT-HTTPS-traffic",
"protocols": ["TCP"],
"sourceAddresses": ["*"],
"translatedAddress": "1.2.3.5",
"translatedPort": "8443",
},
{
"description": "D-NAT all inbound web traffic for inspection",
"destinationAddresses": ["1.2.3.4"],
"destinationPorts": ["80"],
"name": "DNAT-HTTP-traffic-With-FQDN",
"protocols": ["TCP"],
"sourceAddresses": ["*"],
"translatedFqdn": "internalhttpserver",
"translatedPort": "880",
},
],
},
}
],
"networkRuleCollections": [
{
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll",
"name": "netrulecoll",
"properties": {
"action": {"type": "Deny"},
"priority": 112,
"rules": [
{
"description": "Block traffic based on source IPs and ports",
"destinationAddresses": ["*"],
"destinationPorts": ["443-444", "8443"],
"name": "L4-traffic",
"protocols": ["TCP"],
"sourceAddresses": ["192.168.1.1-192.168.1.12", "10.1.4.12-10.1.4.255"],
},
{
"description": "Block traffic based on source IPs and ports to amazon",
"destinationFqdns": ["www.amazon.com"],
"destinationPorts": ["443-444", "8443"],
"name": "L4-traffic-with-FQDN",
"protocols": ["TCP"],
"sourceAddresses": ["10.2.4.12-10.2.4.255"],
},
],
},
}
],
"sku": {"name": "AZFW_VNet", "tier": "Standard"},
"threatIntelMode": "Alert",
},
"tags": {"key1": "value1"},
"zones": ["1", "2", "3"],
},
).result()
print(response)
# x-ms-original-file: 2026-01-01/AzureFirewallPutWithZones.json
if __name__ == "__main__":
main()
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
package armnetwork_test
import (
"context"
"log"
"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v12"
)
// Generated from example definition: 2026-01-01/AzureFirewallPutWithZones.json
func ExampleAzureFirewallsClient_BeginCreateOrUpdate_createAzureFirewallWithZones() {
cred, err := azidentity.NewDefaultAzureCredential(nil)
if err != nil {
log.Fatalf("failed to obtain a credential: %v", err)
}
ctx := context.Background()
clientFactory, err := armnetwork.NewClientFactory("00000000-0000-0000-0000-000000000000", cred, nil)
if err != nil {
log.Fatalf("failed to create client: %v", err)
}
poller, err := clientFactory.NewAzureFirewallsClient().BeginCreateOrUpdate(ctx, "rg1", "azurefirewall", armnetwork.AzureFirewall{
Location: to.Ptr("West US 2"),
Properties: &armnetwork.AzureFirewallPropertiesFormat{
ApplicationRuleCollections: []*armnetwork.AzureFirewallApplicationRuleCollection{
{
Name: to.Ptr("apprulecoll"),
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll"),
Properties: &armnetwork.AzureFirewallApplicationRuleCollectionPropertiesFormat{
Action: &armnetwork.AzureFirewallRCAction{
Type: to.Ptr(armnetwork.AzureFirewallRCActionTypeDeny),
},
Priority: to.Ptr[int32](110),
Rules: []*armnetwork.AzureFirewallApplicationRule{
{
Name: to.Ptr("rule1"),
Description: to.Ptr("Deny inbound rule"),
Protocols: []*armnetwork.AzureFirewallApplicationRuleProtocol{
{
Port: to.Ptr[int32](443),
ProtocolType: to.Ptr(armnetwork.AzureFirewallApplicationRuleProtocolTypeHTTPS),
},
},
SourceAddresses: []*string{
to.Ptr("216.58.216.164"),
to.Ptr("10.0.0.0/24"),
},
TargetFqdns: []*string{
to.Ptr("www.test.com"),
},
},
},
},
},
},
IPConfigurations: []*armnetwork.AzureFirewallIPConfiguration{
{
Name: to.Ptr("azureFirewallIpConfiguration"),
Properties: &armnetwork.AzureFirewallIPConfigurationPropertiesFormat{
PublicIPAddress: &armnetwork.SubResource{
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"),
},
Subnet: &armnetwork.SubResource{
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"),
},
},
},
},
NatRuleCollections: []*armnetwork.AzureFirewallNatRuleCollection{
{
Name: to.Ptr("natrulecoll"),
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll"),
Properties: &armnetwork.AzureFirewallNatRuleCollectionProperties{
Action: &armnetwork.AzureFirewallNatRCAction{
Type: to.Ptr(armnetwork.AzureFirewallNatRCActionTypeDnat),
},
Priority: to.Ptr[int32](112),
Rules: []*armnetwork.AzureFirewallNatRule{
{
Name: to.Ptr("DNAT-HTTPS-traffic"),
Description: to.Ptr("D-NAT all outbound web traffic for inspection"),
DestinationAddresses: []*string{
to.Ptr("1.2.3.4"),
},
DestinationPorts: []*string{
to.Ptr("443"),
},
Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
},
SourceAddresses: []*string{
to.Ptr("*"),
},
TranslatedAddress: to.Ptr("1.2.3.5"),
TranslatedPort: to.Ptr("8443"),
},
{
Name: to.Ptr("DNAT-HTTP-traffic-With-FQDN"),
Description: to.Ptr("D-NAT all inbound web traffic for inspection"),
DestinationAddresses: []*string{
to.Ptr("1.2.3.4"),
},
DestinationPorts: []*string{
to.Ptr("80"),
},
Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
},
SourceAddresses: []*string{
to.Ptr("*"),
},
TranslatedFqdn: to.Ptr("internalhttpserver"),
TranslatedPort: to.Ptr("880"),
},
},
},
},
},
NetworkRuleCollections: []*armnetwork.AzureFirewallNetworkRuleCollection{
{
Name: to.Ptr("netrulecoll"),
ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll"),
Properties: &armnetwork.AzureFirewallNetworkRuleCollectionPropertiesFormat{
Action: &armnetwork.AzureFirewallRCAction{
Type: to.Ptr(armnetwork.AzureFirewallRCActionTypeDeny),
},
Priority: to.Ptr[int32](112),
Rules: []*armnetwork.AzureFirewallNetworkRule{
{
Name: to.Ptr("L4-traffic"),
Description: to.Ptr("Block traffic based on source IPs and ports"),
DestinationAddresses: []*string{
to.Ptr("*"),
},
DestinationPorts: []*string{
to.Ptr("443-444"),
to.Ptr("8443"),
},
Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
},
SourceAddresses: []*string{
to.Ptr("192.168.1.1-192.168.1.12"),
to.Ptr("10.1.4.12-10.1.4.255"),
},
},
{
Name: to.Ptr("L4-traffic-with-FQDN"),
Description: to.Ptr("Block traffic based on source IPs and ports to amazon"),
DestinationFqdns: []*string{
to.Ptr("www.amazon.com"),
},
DestinationPorts: []*string{
to.Ptr("443-444"),
to.Ptr("8443"),
},
Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
},
SourceAddresses: []*string{
to.Ptr("10.2.4.12-10.2.4.255"),
},
},
},
},
},
},
SKU: &armnetwork.AzureFirewallSKU{
Name: to.Ptr(armnetwork.AzureFirewallSKUNameAZFWVnet),
Tier: to.Ptr(armnetwork.AzureFirewallSKUTierStandard),
},
ThreatIntelMode: to.Ptr(armnetwork.AzureFirewallThreatIntelModeAlert),
},
Tags: map[string]*string{
"key1": to.Ptr("value1"),
},
Zones: []*string{
to.Ptr("1"),
to.Ptr("2"),
to.Ptr("3"),
},
}, nil)
if err != nil {
log.Fatalf("failed to finish the request: %v", err)
}
res, err := poller.PollUntilDone(ctx, nil)
if err != nil {
log.Fatalf("failed to poll the result: %v", err)
}
// You could use response here. We use blank identifier for just demo purposes.
_ = res
// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
// res = armnetwork.AzureFirewallsClientCreateOrUpdateResponse{
// AzureFirewall: armnetwork.AzureFirewall{
// Name: to.Ptr("azurefirewall"),
// Type: to.Ptr("Microsoft.Network/azureFirewalls"),
// Etag: to.Ptr("w/\\00000000-0000-0000-0000-000000000000\\"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall"),
// Location: to.Ptr("West US 2"),
// Properties: &armnetwork.AzureFirewallPropertiesFormat{
// AdditionalProperties: map[string]*string{
// },
// ApplicationRuleCollections: []*armnetwork.AzureFirewallApplicationRuleCollection{
// {
// Name: to.Ptr("apprulecoll"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll"),
// Properties: &armnetwork.AzureFirewallApplicationRuleCollectionPropertiesFormat{
// Action: &armnetwork.AzureFirewallRCAction{
// Type: to.Ptr(armnetwork.AzureFirewallRCActionTypeDeny),
// },
// Priority: to.Ptr[int32](110),
// Rules: []*armnetwork.AzureFirewallApplicationRule{
// {
// Name: to.Ptr("rule1"),
// Description: to.Ptr("Deny inbound rule"),
// Protocols: []*armnetwork.AzureFirewallApplicationRuleProtocol{
// {
// Port: to.Ptr[int32](443),
// ProtocolType: to.Ptr(armnetwork.AzureFirewallApplicationRuleProtocolTypeHTTPS),
// },
// },
// SourceAddresses: []*string{
// to.Ptr("216.58.216.164"),
// to.Ptr("10.0.0.0/24"),
// },
// TargetFqdns: []*string{
// to.Ptr("www.test.com"),
// },
// },
// },
// },
// },
// },
// IPConfigurations: []*armnetwork.AzureFirewallIPConfiguration{
// {
// Name: to.Ptr("azureFirewallIpConfiguration"),
// Etag: to.Ptr("w/\\00000000-0000-0000-0000-000000000000\\"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/ipConfigurations/azureFirewallIpConfiguration"),
// Properties: &armnetwork.AzureFirewallIPConfigurationPropertiesFormat{
// PrivateIPAddress: to.Ptr("10.0.0.0"),
// ProvisioningState: to.Ptr(armnetwork.ProvisioningStateSucceeded),
// PublicIPAddress: &armnetwork.SubResource{
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"),
// },
// Subnet: &armnetwork.SubResource{
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"),
// },
// },
// },
// },
// IPGroups: []*armnetwork.AzureFirewallIPGroups{
// },
// NatRuleCollections: []*armnetwork.AzureFirewallNatRuleCollection{
// {
// Name: to.Ptr("natrulecoll"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll"),
// Properties: &armnetwork.AzureFirewallNatRuleCollectionProperties{
// Action: &armnetwork.AzureFirewallNatRCAction{
// Type: to.Ptr(armnetwork.AzureFirewallNatRCActionTypeDnat),
// },
// Priority: to.Ptr[int32](112),
// Rules: []*armnetwork.AzureFirewallNatRule{
// {
// Name: to.Ptr("DNAT-HTTPS-traffic"),
// Description: to.Ptr("D-NAT all outbound web traffic for inspection"),
// DestinationAddresses: []*string{
// to.Ptr("1.2.3.4"),
// },
// DestinationPorts: []*string{
// to.Ptr("443"),
// },
// Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
// to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
// },
// SourceAddresses: []*string{
// to.Ptr("*"),
// },
// TranslatedAddress: to.Ptr("1.2.3.5"),
// TranslatedPort: to.Ptr("8443"),
// },
// {
// Name: to.Ptr("DNAT-HTTP-traffic-With-FQDN"),
// Description: to.Ptr("D-NAT all inbound web traffic for inspection"),
// DestinationAddresses: []*string{
// to.Ptr("1.2.3.4"),
// },
// DestinationPorts: []*string{
// to.Ptr("80"),
// },
// Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
// to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
// },
// SourceAddresses: []*string{
// to.Ptr("*"),
// },
// TranslatedFqdn: to.Ptr("internalhttpserver"),
// TranslatedPort: to.Ptr("880"),
// },
// },
// },
// },
// },
// NetworkRuleCollections: []*armnetwork.AzureFirewallNetworkRuleCollection{
// {
// Name: to.Ptr("netrulecoll"),
// ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll"),
// Properties: &armnetwork.AzureFirewallNetworkRuleCollectionPropertiesFormat{
// Action: &armnetwork.AzureFirewallRCAction{
// Type: to.Ptr(armnetwork.AzureFirewallRCActionTypeDeny),
// },
// Priority: to.Ptr[int32](112),
// Rules: []*armnetwork.AzureFirewallNetworkRule{
// {
// Name: to.Ptr("L4-traffic"),
// Description: to.Ptr("Block traffic based on source IPs and ports"),
// DestinationAddresses: []*string{
// to.Ptr("*"),
// },
// DestinationPorts: []*string{
// to.Ptr("443-444"),
// to.Ptr("8443"),
// },
// Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
// to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
// },
// SourceAddresses: []*string{
// to.Ptr("192.168.1.1-192.168.1.12"),
// to.Ptr("10.1.4.12-10.1.4.255"),
// },
// },
// {
// Name: to.Ptr("L4-traffic-with-FQDN"),
// Description: to.Ptr("Block traffic based on source IPs and ports to amazon"),
// DestinationFqdns: []*string{
// to.Ptr("www.amazon.com"),
// },
// DestinationPorts: []*string{
// to.Ptr("443-444"),
// to.Ptr("8443"),
// },
// Protocols: []*armnetwork.AzureFirewallNetworkRuleProtocol{
// to.Ptr(armnetwork.AzureFirewallNetworkRuleProtocolTCP),
// },
// SourceAddresses: []*string{
// to.Ptr("10.2.4.12-10.2.4.255"),
// },
// },
// },
// },
// },
// },
// ProvisioningState: to.Ptr(armnetwork.ProvisioningStateSucceeded),
// SKU: &armnetwork.AzureFirewallSKU{
// Name: to.Ptr(armnetwork.AzureFirewallSKUNameAZFWVnet),
// Tier: to.Ptr(armnetwork.AzureFirewallSKUTierStandard),
// },
// ThreatIntelMode: to.Ptr(armnetwork.AzureFirewallThreatIntelModeAlert),
// },
// Tags: map[string]*string{
// "key1": to.Ptr("value1"),
// },
// Zones: []*string{
// to.Ptr("1"),
// to.Ptr("2"),
// to.Ptr("3"),
// },
// },
// }
}
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
const { NetworkManagementClient } = require("@azure/arm-network");
const { DefaultAzureCredential } = require("@azure/identity");
/**
* This sample demonstrates how to creates or updates the specified Azure Firewall.
*
* @summary creates or updates the specified Azure Firewall.
* x-ms-original-file: 2026-01-01/AzureFirewallPutWithZones.json
*/
async function createAzureFirewallWithZones() {
const credential = new DefaultAzureCredential();
const subscriptionId = "00000000-0000-0000-0000-000000000000";
const client = new NetworkManagementClient(credential, subscriptionId);
const result = await client.azureFirewalls.createOrUpdate("rg1", "azurefirewall", {
location: "West US 2",
applicationRuleCollections: [
{
name: "apprulecoll",
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll",
action: { type: "Deny" },
priority: 110,
rules: [
{
name: "rule1",
description: "Deny inbound rule",
protocols: [{ port: 443, protocolType: "Https" }],
sourceAddresses: ["216.58.216.164", "10.0.0.0/24"],
targetFqdns: ["www.test.com"],
},
],
},
],
ipConfigurations: [
{
name: "azureFirewallIpConfiguration",
publicIPAddress: {
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName",
},
subnet: {
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet",
},
},
],
natRuleCollections: [
{
name: "natrulecoll",
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll",
action: { type: "Dnat" },
priority: 112,
rules: [
{
name: "DNAT-HTTPS-traffic",
description: "D-NAT all outbound web traffic for inspection",
destinationAddresses: ["1.2.3.4"],
destinationPorts: ["443"],
protocols: ["TCP"],
sourceAddresses: ["*"],
translatedAddress: "1.2.3.5",
translatedPort: "8443",
},
{
name: "DNAT-HTTP-traffic-With-FQDN",
description: "D-NAT all inbound web traffic for inspection",
destinationAddresses: ["1.2.3.4"],
destinationPorts: ["80"],
protocols: ["TCP"],
sourceAddresses: ["*"],
translatedFqdn: "internalhttpserver",
translatedPort: "880",
},
],
},
],
networkRuleCollections: [
{
name: "netrulecoll",
id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll",
action: { type: "Deny" },
priority: 112,
rules: [
{
name: "L4-traffic",
description: "Block traffic based on source IPs and ports",
destinationAddresses: ["*"],
destinationPorts: ["443-444", "8443"],
protocols: ["TCP"],
sourceAddresses: ["192.168.1.1-192.168.1.12", "10.1.4.12-10.1.4.255"],
},
{
name: "L4-traffic-with-FQDN",
description: "Block traffic based on source IPs and ports to amazon",
destinationFqdns: ["www.amazon.com"],
destinationPorts: ["443-444", "8443"],
protocols: ["TCP"],
sourceAddresses: ["10.2.4.12-10.2.4.255"],
},
],
},
],
sku: { name: "AZFW_VNet", tier: "Standard" },
threatIntelMode: "Alert",
tags: { key1: "value1" },
zones: ["1", "2", "3"],
});
console.log(result);
}
To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue
Sample response
{
"name": "azurefirewall",
"type": "Microsoft.Network/azureFirewalls",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall",
"location": "West US 2",
"properties": {
"additionalProperties": {},
"applicationRuleCollections": [
{
"name": "apprulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 110,
"rules": [
{
"name": "rule1",
"description": "Deny inbound rule",
"protocols": [
{
"port": 443,
"protocolType": "Https"
}
],
"sourceAddresses": [
"216.58.216.164",
"10.0.0.0/24"
],
"targetFqdns": [
"www.test.com"
]
}
]
}
}
],
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/ipConfigurations/azureFirewallIpConfiguration",
"properties": {
"privateIPAddress": "10.0.0.0",
"provisioningState": "Succeeded",
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
}
}
}
],
"ipGroups": [],
"natRuleCollections": [
{
"name": "natrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll",
"properties": {
"action": {
"type": "Dnat"
},
"priority": 112,
"rules": [
{
"name": "DNAT-HTTPS-traffic",
"description": "D-NAT all outbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedAddress": "1.2.3.5",
"translatedPort": "8443"
},
{
"name": "DNAT-HTTP-traffic-With-FQDN",
"description": "D-NAT all inbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"80"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedFqdn": "internalhttpserver",
"translatedPort": "880"
}
]
}
}
],
"networkRuleCollections": [
{
"name": "netrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 112,
"rules": [
{
"name": "L4-traffic",
"description": "Block traffic based on source IPs and ports",
"destinationAddresses": [
"*"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"192.168.1.1-192.168.1.12",
"10.1.4.12-10.1.4.255"
]
},
{
"name": "L4-traffic-with-FQDN",
"description": "Block traffic based on source IPs and ports to amazon",
"destinationFqdns": [
"www.amazon.com"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"10.2.4.12-10.2.4.255"
]
}
]
}
}
],
"provisioningState": "Succeeded",
"sku": {
"name": "AZFW_VNet",
"tier": "Standard"
},
"threatIntelMode": "Alert"
},
"tags": {
"key1": "value1"
},
"zones": [
"1",
"2",
"3"
]
}
{
"name": "azurefirewall",
"type": "Microsoft.Network/azureFirewalls",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall",
"location": "West US 2",
"properties": {
"additionalProperties": {},
"applicationRuleCollections": [
{
"name": "apprulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/applicationRuleCollections/apprulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 110,
"rules": [
{
"name": "rule1",
"description": "Deny inbound rule",
"protocols": [
{
"port": 443,
"protocolType": "Https"
}
],
"sourceAddresses": [
"216.58.216.164",
"10.0.0.0/24"
],
"targetFqdns": [
"www.test.com"
]
}
]
}
}
],
"ipConfigurations": [
{
"name": "azureFirewallIpConfiguration",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/ipConfigurations/azureFirewallIpConfiguration",
"properties": {
"privateIPAddress": "10.0.0.0",
"provisioningState": "Succeeded",
"publicIPAddress": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
},
"subnet": {
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/AzureFirewallSubnet"
}
}
}
],
"natRuleCollections": [
{
"name": "natrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/natRuleCollections/natrulecoll",
"properties": {
"action": {
"type": "Dnat"
},
"priority": 112,
"rules": [
{
"name": "DNAT-HTTPS-traffic",
"description": "D-NAT all outbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedAddress": "1.2.3.5",
"translatedPort": "8443"
},
{
"name": "DNAT-HTTP-traffic-With-FQDN",
"description": "D-NAT all inbound web traffic for inspection",
"destinationAddresses": [
"1.2.3.4"
],
"destinationPorts": [
"80"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"*"
],
"translatedFqdn": "internalhttpserver",
"translatedPort": "880"
}
]
}
}
],
"networkRuleCollections": [
{
"name": "netrulecoll",
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/azureFirewalls/azurefirewall/networkRuleCollections/netrulecoll",
"properties": {
"action": {
"type": "Deny"
},
"priority": 112,
"rules": [
{
"name": "L4-traffic",
"description": "Block traffic based on source IPs and ports",
"destinationAddresses": [
"*"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"192.168.1.1-192.168.1.12",
"10.1.4.12-10.1.4.255"
]
},
{
"name": "L4-traffic-with-FQDN",
"description": "Block traffic based on source IPs and ports to amazon",
"destinationFqdns": [
"www.amazon.com"
],
"destinationPorts": [
"443-444",
"8443"
],
"protocols": [
"TCP"
],
"sourceAddresses": [
"10.2.4.12-10.2.4.255"
]
}
]
}
}
],
"provisioningState": "Succeeded",
"sku": {
"name": "AZFW_VNet",
"tier": "Standard"
},
"threatIntelMode": "Alert"
},
"tags": {
"key1": "value1"
},
"zones": [
"1",
"2",
"3"
]
}
Definitions
AfcConfiguration
Object
AFC configuration for the Azure Firewall.
| Name |
Type |
Description |
|
serviceEndpoint
|
string
|
The endpoint URL of the AFC control plane associated with this Azure Firewall.
|
AzureFirewall
Object
Azure Firewall resource.
| Name |
Type |
Description |
|
etag
|
string
|
A unique read-only string that changes whenever the resource is updated.
|
|
extendedLocation
|
ExtendedLocation
|
The extended location of type local virtual network gateway.
|
|
id
|
string
|
Resource ID.
|
|
location
|
string
|
Resource location.
|
|
name
|
string
|
Resource name.
|
|
properties.additionalProperties
|
object
|
The additional properties used to further config this azure firewall.
|
|
properties.afcConfiguration
|
AfcConfiguration
|
AFC configuration for the Azure Firewall.
|
|
properties.aiSecurityAddOn
|
boolean
|
Indicates whether the AI security add-on is enabled for the Azure Firewall.
|
|
properties.applicationRuleCollections
|
AzureFirewallApplicationRuleCollection[]
|
Collection of application rule collections used by Azure Firewall.
|
|
properties.autoscaleConfiguration
|
AzureFirewallAutoscaleConfiguration
|
Properties to provide a custom autoscale configuration to this azure firewall.
|
|
properties.firewallPolicy
|
SubResource
|
The firewallPolicy associated with this azure firewall.
|
|
properties.hubIPAddresses
|
HubIPAddresses
|
IP addresses associated with AzureFirewall.
|
|
properties.ipConfigurations
|
AzureFirewallIPConfiguration[]
|
IP configuration of the Azure Firewall resource.
|
|
properties.ipGroups
|
AzureFirewallIpGroups[]
|
IpGroups associated with AzureFirewall.
|
|
properties.managementIpConfiguration
|
AzureFirewallIPConfiguration
|
IP configuration of the Azure Firewall used for management traffic.
|
|
properties.natRuleCollections
|
AzureFirewallNatRuleCollection[]
|
Collection of NAT rule collections used by Azure Firewall.
|
|
properties.networkRuleCollections
|
AzureFirewallNetworkRuleCollection[]
|
Collection of network rule collections used by Azure Firewall.
|
|
properties.provisioningState
|
ProvisioningState
|
The provisioning state of the Azure firewall resource.
|
|
properties.sku
|
AzureFirewallSku
|
The Azure Firewall Resource SKU.
|
|
properties.threatIntelMode
|
AzureFirewallThreatIntelMode
|
The operation mode for Threat Intelligence.
|
|
properties.virtualHub
|
SubResource
|
The virtualHub to which the firewall belongs.
|
|
tags
|
object
|
Resource tags.
|
|
type
|
string
|
Resource type.
|
|
zones
|
string[]
|
A list of availability zones denoting where the resource needs to come from.
|
AzureFirewallApplicationRule
Object
Properties of an application rule.
| Name |
Type |
Description |
|
description
|
string
|
Description of the rule.
|
|
fqdnTags
|
string[]
|
List of FQDN Tags for this rule.
|
|
name
|
string
|
Name of the application rule.
|
|
protocols
|
AzureFirewallApplicationRuleProtocol[]
|
Array of ApplicationRuleProtocols.
|
|
sourceAddresses
|
string[]
|
List of source IP addresses for this rule.
|
|
sourceIpGroups
|
string[]
|
List of source IpGroups for this rule.
|
|
targetFqdns
|
string[]
|
List of FQDNs for this rule.
|
AzureFirewallApplicationRuleCollection
Object
Application rule collection resource.
| Name |
Type |
Description |
|
etag
|
string
|
A unique read-only string that changes whenever the resource is updated.
|
|
id
|
string
|
Resource ID.
|
|
name
|
string
|
The name of the resource that is unique within the Azure firewall. This name can be used to access the resource.
|
|
properties.action
|
AzureFirewallRCAction
|
The action type of a rule collection.
|
|
properties.priority
|
integer
(int32)
minimum: 100
maximum: 65000
|
Priority of the application rule collection resource.
|
|
properties.provisioningState
|
ProvisioningState
|
The provisioning state of the application rule collection resource.
|
|
properties.rules
|
AzureFirewallApplicationRule[]
|
Collection of rules used by a application rule collection.
|
AzureFirewallApplicationRuleProtocol
Object
Properties of the application rule protocol.
| Name |
Type |
Description |
|
port
|
integer
(int32)
minimum: 0
maximum: 64000
|
Port number for the protocol, cannot be greater than 64000. This field is optional.
|
|
protocolType
|
AzureFirewallApplicationRuleProtocolType
|
Protocol type.
|
AzureFirewallApplicationRuleProtocolType
Enumeration
The protocol type of a Application Rule resource.
| Value |
Description |
|
Http
|
Http
|
|
Https
|
Https
|
|
Mssql
|
Mssql
|
AzureFirewallAutoscaleConfiguration
Object
Azure Firewall Autoscale Configuration parameters.
| Name |
Type |
Description |
|
maxCapacity
|
integer
(int32)
minimum: 2
|
The maximum number of capacity units for this azure firewall. Use null to reset the value to the service default.
|
|
minCapacity
|
integer
(int32)
minimum: 2
|
The minimum number of capacity units for this azure firewall. Use null to reset the value to the service default.
|
AzureFirewallIPConfiguration
Object
IP configuration of an Azure Firewall.
| Name |
Type |
Description |
|
etag
|
string
|
A unique read-only string that changes whenever the resource is updated.
|
|
id
|
string
|
Resource ID.
|
|
name
|
string
|
Name of the resource that is unique within a resource group. This name can be used to access the resource.
|
|
properties.privateIPAddress
|
string
|
The Firewall Internal Load Balancer IP to be used as the next hop in User Defined Routes.
|
|
properties.provisioningState
|
ProvisioningState
|
The provisioning state of the Azure firewall IP configuration resource.
|
|
properties.publicIPAddress
|
SubResource
|
Reference to the PublicIP resource. This field is a mandatory input if subnet is not null.
|
|
properties.subnet
|
SubResource
|
Reference to the subnet resource. This resource must be named 'AzureFirewallSubnet' or 'AzureFirewallManagementSubnet'.
|
|
type
|
string
|
Type of the resource.
|
AzureFirewallIpGroups
Object
IpGroups associated with azure firewall.
| Name |
Type |
Description |
|
changeNumber
|
string
|
The iteration number.
|
|
id
|
string
|
Resource ID.
|
AzureFirewallNatRCAction
Object
AzureFirewall NAT Rule Collection Action.
AzureFirewallNatRCActionType
Enumeration
The action type of a NAT rule collection.
| Value |
Description |
|
Snat
|
Snat
|
|
Dnat
|
Dnat
|
AzureFirewallNatRule
Object
Properties of a NAT rule.
| Name |
Type |
Description |
|
description
|
string
|
Description of the rule.
|
|
destinationAddresses
|
string[]
|
List of destination IP addresses for this rule. Supports IP ranges, prefixes, and service tags.
|
|
destinationPorts
|
string[]
|
List of destination ports.
|
|
name
|
string
|
Name of the NAT rule.
|
|
protocols
|
AzureFirewallNetworkRuleProtocol[]
|
Array of AzureFirewallNetworkRuleProtocols applicable to this NAT rule.
|
|
sourceAddresses
|
string[]
|
List of source IP addresses for this rule.
|
|
sourceIpGroups
|
string[]
|
List of source IpGroups for this rule.
|
|
translatedAddress
|
string
|
The translated address for this NAT rule.
|
|
translatedFqdn
|
string
|
The translated FQDN for this NAT rule.
|
|
translatedPort
|
string
|
The translated port for this NAT rule.
|
AzureFirewallNatRuleCollection
Object
NAT rule collection resource.
| Name |
Type |
Description |
|
etag
|
string
|
A unique read-only string that changes whenever the resource is updated.
|
|
id
|
string
|
Resource ID.
|
|
name
|
string
|
The name of the resource that is unique within the Azure firewall. This name can be used to access the resource.
|
|
properties.action
|
AzureFirewallNatRCAction
|
The action type of a NAT rule collection.
|
|
properties.priority
|
integer
(int32)
minimum: 100
maximum: 65000
|
Priority of the NAT rule collection resource.
|
|
properties.provisioningState
|
ProvisioningState
|
The provisioning state of the NAT rule collection resource.
|
|
properties.rules
|
AzureFirewallNatRule[]
|
Collection of rules used by a NAT rule collection.
|
AzureFirewallNetworkRule
Object
Properties of the network rule.
| Name |
Type |
Description |
|
description
|
string
|
Description of the rule.
|
|
destinationAddresses
|
string[]
|
List of destination IP addresses.
|
|
destinationFqdns
|
string[]
|
List of destination FQDNs.
|
|
destinationIpGroups
|
string[]
|
List of destination IpGroups for this rule.
|
|
destinationPorts
|
string[]
|
List of destination ports.
|
|
name
|
string
|
Name of the network rule.
|
|
protocols
|
AzureFirewallNetworkRuleProtocol[]
|
Array of AzureFirewallNetworkRuleProtocols.
|
|
sourceAddresses
|
string[]
|
List of source IP addresses for this rule.
|
|
sourceIpGroups
|
string[]
|
List of source IpGroups for this rule.
|
AzureFirewallNetworkRuleCollection
Object
Network rule collection resource.
| Name |
Type |
Description |
|
etag
|
string
|
A unique read-only string that changes whenever the resource is updated.
|
|
id
|
string
|
Resource ID.
|
|
name
|
string
|
The name of the resource that is unique within the Azure firewall. This name can be used to access the resource.
|
|
properties.action
|
AzureFirewallRCAction
|
The action type of a rule collection.
|
|
properties.priority
|
integer
(int32)
minimum: 100
maximum: 65000
|
Priority of the network rule collection resource.
|
|
properties.provisioningState
|
ProvisioningState
|
The provisioning state of the network rule collection resource.
|
|
properties.rules
|
AzureFirewallNetworkRule[]
|
Collection of rules used by a network rule collection.
|
AzureFirewallNetworkRuleProtocol
Enumeration
The protocol of a Network Rule resource.
| Value |
Description |
|
TCP
|
TCP
|
|
UDP
|
UDP
|
|
Any
|
Any
|
|
ICMP
|
ICMP
|
AzureFirewallPublicIPAddress
Object
Public IP Address associated with azure firewall.
| Name |
Type |
Description |
|
address
|
string
|
Public IP Address value.
|
AzureFirewallRCAction
Object
Properties of the AzureFirewallRCAction.
AzureFirewallRCActionType
Enumeration
The action type of a rule collection.
| Value |
Description |
|
Allow
|
Allow
|
|
Deny
|
Deny
|
AzureFirewallSku
Object
SKU of an Azure Firewall.
AzureFirewallSkuName
Enumeration
Name of an Azure Firewall SKU.
| Value |
Description |
|
AZFW_VNet
|
AZFW_VNet
|
|
AZFW_Hub
|
AZFW_Hub
|
AzureFirewallSkuTier
Enumeration
Tier of an Azure Firewall.
| Value |
Description |
|
Standard
|
Standard
|
|
Premium
|
Premium
|
|
Basic
|
Basic
|
AzureFirewallThreatIntelMode
Enumeration
The operation mode for Threat Intel.
| Value |
Description |
|
Alert
|
Alert
|
|
Deny
|
Deny
|
|
Off
|
Off
|
CloudError
Object
An error response from the service.
CloudErrorBody
Object
An error response from the service.
| Name |
Type |
Description |
|
code
|
string
|
An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
|
|
details
|
CloudErrorBody[]
|
A list of additional details about the error.
|
|
message
|
string
|
A message describing the error, intended to be suitable for display in a user interface.
|
|
target
|
string
|
The target of the particular error. For example, the name of the property in error.
|
ExtendedLocation
Object
ExtendedLocation complex type.
| Name |
Type |
Description |
|
name
|
string
|
The name of the extended location.
|
|
type
|
ExtendedLocationTypes
|
The type of the extended location.
|
ExtendedLocationTypes
Enumeration
The supported ExtendedLocation types. Currently only EdgeZone is supported in Microsoft.Network resources.
| Value |
Description |
|
EdgeZone
|
EdgeZone
|
HubIPAddresses
Object
IP addresses associated with azure firewall.
| Name |
Type |
Description |
|
privateIPAddress
|
string
|
Private IP Address associated with azure firewall.
|
|
publicIPs
|
HubPublicIPAddresses
|
Public IP addresses associated with azure firewall.
|
HubPublicIPAddresses
Object
Public IP addresses associated with azure firewall.
| Name |
Type |
Description |
|
addresses
|
AzureFirewallPublicIPAddress[]
|
The list of Public IP addresses associated with azure firewall or IP addresses to be retained.
|
|
count
|
integer
(int32)
|
The number of Public IP addresses associated with azure firewall.
|
ProvisioningState
Enumeration
Provisioning states of a resource.
| Value |
Description |
|
Failed
|
Failed
|
|
Succeeded
|
Succeeded
|
|
Canceled
|
Canceled
|
|
Creating
|
Creating
|
|
Updating
|
Updating
|
|
Deleting
|
Deleting
|
SubResource
Object
Reference to another subresource.
| Name |
Type |
Description |
|
id
|
string
|
Resource ID.
|