Quickstart: Een Azure Firewall maken met meerdere openbare IP-adressen - ARM-sjabloon
In deze quickstart gebruikt u een Azure Resource Manager-sjabloon (ARM-sjabloon) om een Azure-firewall met meerdere openbare IP-adressen van een openbaar IP-adresvoorvoegsel te implementeren. De geïmplementeerde firewall heeft regels voor het verzamelen van NAT-regels waarmee RDP-verbindingen met twee Windows Server 2019-VM's worden toegestaan.
Een Azure Resource Manager-sjabloon is een JSON-bestand (JavaScript Object Notation) dat de infrastructuur en configuratie voor uw project definieert. Voor de sjabloon is declaratieve syntaxis vereist. U beschrijft de beoogde implementatie zonder de reeks programmeeropdrachten te schrijven om de implementatie te maken.
Zie Een Azure-firewall met meerdere openbare IP-adressen implementeren met Azure PowerShell voor meer informatie over Azure Firewall met meerdere openbare IP-adressen.
Als uw omgeving voldoet aan de vereisten en u benkend bent met het gebruik van ARM-sjablonen, selecteert u de knop Implementeren naar Azure. De sjabloon wordt in Azure Portal geopend.
Vereisten
- Een Azure-account met een actief abonnement. Gratis een account maken
De sjabloon controleren
Met deze sjabloon maakt u een Azure-firewall met twee openbare IP-adressen, samen met de benodigde resources die ondersteuning bieden voor de Azure-firewall.
De sjabloon die in deze quickstart wordt gebruikt, komt uit Azure-snelstartsjablonen.
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"metadata": {
"_generator": {
"name": "bicep",
"version": "0.26.54.24096",
"templateHash": "8395247770070350203"
}
},
"parameters": {
"adminUsername": {
"type": "string",
"metadata": {
"description": "Admin username for the backend servers"
}
},
"adminPassword": {
"type": "securestring",
"metadata": {
"description": "Password for the admin account on the backend servers"
}
},
"location": {
"type": "string",
"defaultValue": "[resourceGroup().location]",
"metadata": {
"description": "Location for all resources."
}
},
"vmSize": {
"type": "string",
"defaultValue": "Standard_B2ms",
"metadata": {
"description": "Size of the virtual machine."
}
}
},
"variables": {
"copy": [
{
"name": "azureFirewallIpConfigurations",
"count": "[length(range(0, 2))]",
"input": {
"name": "[format('IpConf{0}', add(range(0, 2)[copyIndex('azureFirewallIpConfigurations')], 1))]",
"properties": {
"subnet": "[if(equals(range(0, 2)[copyIndex('azureFirewallIpConfigurations')], 0), json(format('{{\"id\": \"{0}\"}}', variables('azureFirewallSubnetId'))), null())]",
"publicIPAddress": {
"id": "[resourceId('Microsoft.Network/publicIPAddresses', format('{0}{1}', variables('publicIpAddressName'), add(range(0, 2)[range(0, 2)[copyIndex('azureFirewallIpConfigurations')]], 1)))]"
}
}
}
}
],
"virtualMachineName": "myVM",
"virtualNetworkName": "myVNet",
"networkInterfaceName": "net-int",
"ipConfigName": "ipconfig",
"ipPrefixName": "public_ip_prefix",
"ipPrefixSize": 31,
"publicIpAddressName": "public_ip",
"nsgName": "vm-nsg",
"firewallName": "FW-01",
"vnetPrefix": "10.0.0.0/16",
"fwSubnetPrefix": "10.0.0.0/24",
"backendSubnetPrefix": "10.0.1.0/24",
"azureFirewallSubnetId": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), 'AzureFirewallSubnet')]"
},
"resources": [
{
"copy": {
"name": "nsg",
"count": "[length(range(0, 2))]"
},
"type": "Microsoft.Network/networkSecurityGroups",
"apiVersion": "2023-09-01",
"name": "[format('{0}{1}', variables('nsgName'), add(range(0, 2)[copyIndex()], 1))]",
"location": "[parameters('location')]",
"properties": {
"securityRules": [
{
"name": "RDP",
"properties": {
"protocol": "Tcp",
"sourcePortRange": "*",
"destinationPortRange": "3389",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "*",
"access": "Allow",
"priority": 300,
"direction": "Inbound"
}
}
]
}
},
{
"type": "Microsoft.Network/publicIPPrefixes",
"apiVersion": "2023-09-01",
"name": "[variables('ipPrefixName')]",
"location": "[parameters('location')]",
"properties": {
"prefixLength": "[variables('ipPrefixSize')]",
"publicIPAddressVersion": "IPv4"
},
"sku": {
"name": "Standard"
}
},
{
"copy": {
"name": "publicIPAddress",
"count": "[length(range(0, 2))]"
},
"type": "Microsoft.Network/publicIPAddresses",
"apiVersion": "2023-09-01",
"name": "[format('{0}{1}', variables('publicIpAddressName'), add(range(0, 2)[copyIndex()], 1))]",
"location": "[parameters('location')]",
"sku": {
"name": "Standard"
},
"properties": {
"publicIPAddressVersion": "IPv4",
"publicIPAllocationMethod": "Static",
"publicIPPrefix": {
"id": "[resourceId('Microsoft.Network/publicIPPrefixes', variables('ipPrefixName'))]"
},
"idleTimeoutInMinutes": 4
},
"dependsOn": [
"[resourceId('Microsoft.Network/publicIPPrefixes', variables('ipPrefixName'))]"
]
},
{
"type": "Microsoft.Network/virtualNetworks",
"apiVersion": "2023-09-01",
"name": "[variables('virtualNetworkName')]",
"location": "[parameters('location')]",
"properties": {
"addressSpace": {
"addressPrefixes": [
"[variables('vnetPrefix')]"
]
},
"subnets": [
{
"name": "myBackendSubnet",
"properties": {
"addressPrefix": "[variables('backendSubnetPrefix')]",
"routeTable": {
"id": "[resourceId('Microsoft.Network/routeTables', 'rt-01')]"
},
"privateEndpointNetworkPolicies": "Enabled",
"privateLinkServiceNetworkPolicies": "Enabled"
}
}
],
"enableDdosProtection": false,
"enableVmProtection": false
},
"dependsOn": [
"[resourceId('Microsoft.Network/routeTables', 'rt-01')]"
]
},
{
"type": "Microsoft.Network/virtualNetworks/subnets",
"apiVersion": "2023-09-01",
"name": "[format('{0}/{1}', variables('virtualNetworkName'), 'AzureFirewallSubnet')]",
"properties": {
"addressPrefix": "[variables('fwSubnetPrefix')]",
"privateEndpointNetworkPolicies": "Enabled",
"privateLinkServiceNetworkPolicies": "Enabled"
},
"dependsOn": [
"[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworkName'))]"
]
},
{
"copy": {
"name": "virtualMachine",
"count": "[length(range(0, 2))]"
},
"type": "Microsoft.Compute/virtualMachines",
"apiVersion": "2023-09-01",
"name": "[format('{0}{1}', variables('virtualMachineName'), add(range(0, 2)[copyIndex()], 1))]",
"location": "[parameters('location')]",
"properties": {
"hardwareProfile": {
"vmSize": "[parameters('vmSize')]"
},
"storageProfile": {
"imageReference": {
"publisher": "MicrosoftWindowsServer",
"offer": "WindowsServer",
"sku": "2019-Datacenter",
"version": "latest"
},
"osDisk": {
"osType": "Windows",
"createOption": "FromImage",
"caching": "ReadWrite",
"managedDisk": {
"storageAccountType": "StandardSSD_LRS"
},
"diskSizeGB": 127
}
},
"osProfile": {
"computerName": "[format('{0}{1}', variables('virtualMachineName'), add(range(0, 2)[copyIndex()], 1))]",
"adminUsername": "[parameters('adminUsername')]",
"adminPassword": "[parameters('adminPassword')]",
"windowsConfiguration": {
"provisionVMAgent": true,
"enableAutomaticUpdates": true
},
"allowExtensionOperations": true
},
"networkProfile": {
"networkInterfaces": [
{
"id": "[resourceId('Microsoft.Network/networkInterfaces', format('{0}{1}', variables('networkInterfaceName'), add(range(0, 2)[range(0, 2)[copyIndex()]], 1)))]"
}
]
}
},
"dependsOn": [
"[resourceId('Microsoft.Network/networkInterfaces', format('{0}{1}', variables('networkInterfaceName'), add(range(0, 2)[range(0, 2)[copyIndex()]], 1)))]"
]
},
{
"copy": {
"name": "netInterface",
"count": "[length(range(0, 2))]"
},
"type": "Microsoft.Network/networkInterfaces",
"apiVersion": "2023-09-01",
"name": "[format('{0}{1}', variables('networkInterfaceName'), add(range(0, 2)[copyIndex()], 1))]",
"location": "[parameters('location')]",
"properties": {
"ipConfigurations": [
{
"name": "[format('{0}{1}', variables('ipConfigName'), add(range(0, 2)[copyIndex()], 1))]",
"properties": {
"subnet": {
"id": "[reference(resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworkName')), '2023-09-01').subnets[0].id]"
},
"primary": true
}
}
],
"enableAcceleratedNetworking": false,
"enableIPForwarding": false,
"networkSecurityGroup": {
"id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}{1}', variables('nsgName'), add(range(0, 2)[range(0, 2)[copyIndex()]], 1)))]"
}
},
"dependsOn": [
"[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}{1}', variables('nsgName'), add(range(0, 2)[range(0, 2)[copyIndex()]], 1)))]",
"[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworkName'))]"
]
},
{
"type": "Microsoft.Network/azureFirewalls",
"apiVersion": "2023-09-01",
"name": "[variables('firewallName')]",
"location": "[parameters('location')]",
"properties": {
"sku": {
"name": "AZFW_VNet",
"tier": "Standard"
},
"threatIntelMode": "Deny",
"ipConfigurations": "[variables('azureFirewallIpConfigurations')]",
"applicationRuleCollections": [
{
"name": "web",
"properties": {
"priority": 100,
"action": {
"type": "Allow"
},
"rules": [
{
"name": "wan-address",
"protocols": [
{
"protocolType": "Http",
"port": 80
},
{
"protocolType": "Https",
"port": 443
}
],
"targetFqdns": [
"getmywanip.com"
],
"sourceAddresses": [
"*"
]
},
{
"name": "google",
"protocols": [
{
"protocolType": "Http",
"port": 80
},
{
"protocolType": "Https",
"port": 443
}
],
"targetFqdns": [
"www.google.com"
],
"sourceAddresses": [
"10.0.1.0/24"
]
},
{
"name": "wupdate",
"protocols": [
{
"protocolType": "Http",
"port": 80
},
{
"protocolType": "Https",
"port": 443
}
],
"fqdnTags": [
"WindowsUpdate"
],
"sourceAddresses": [
"*"
]
}
]
}
}
],
"natRuleCollections": [
{
"name": "Coll-01",
"properties": {
"priority": 100,
"action": {
"type": "Dnat"
},
"rules": [
{
"name": "rdp-01",
"protocols": [
"TCP"
],
"translatedAddress": "10.0.1.4",
"translatedPort": "3389",
"sourceAddresses": [
"*"
],
"destinationAddresses": [
"[reference(resourceId('Microsoft.Network/publicIPAddresses', format('{0}{1}', variables('publicIpAddressName'), add(range(0, 2)[0], 1))), '2023-09-01').ipAddress]"
],
"destinationPorts": [
"3389"
]
},
{
"name": "rdp-02",
"protocols": [
"TCP"
],
"translatedAddress": "10.0.1.5",
"translatedPort": "3389",
"sourceAddresses": [
"*"
],
"destinationAddresses": [
"[reference(resourceId('Microsoft.Network/publicIPAddresses', format('{0}{1}', variables('publicIpAddressName'), add(range(0, 2)[1], 1))), '2023-09-01').ipAddress]"
],
"destinationPorts": [
"3389"
]
}
]
}
}
]
},
"dependsOn": [
"publicIPAddress",
"[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), 'AzureFirewallSubnet')]"
]
},
{
"type": "Microsoft.Network/routeTables",
"apiVersion": "2023-09-01",
"name": "rt-01",
"location": "[parameters('location')]",
"properties": {
"disableBgpRoutePropagation": false,
"routes": [
{
"name": "fw",
"properties": {
"addressPrefix": "0.0.0.0/0",
"nextHopType": "VirtualAppliance",
"nextHopIpAddress": "10.0.0.4"
}
}
]
}
}
],
"outputs": {
"name": {
"type": "string",
"value": "[variables('firewallName')]"
},
"resourceId": {
"type": "string",
"value": "[resourceId('Microsoft.Network/azureFirewalls', variables('firewallName'))]"
},
"location": {
"type": "string",
"value": "[parameters('location')]"
},
"resourceGroupName": {
"type": "string",
"value": "[resourceGroup().name]"
}
}
}
Er worden meerdere Azure-resources gedefinieerd in de sjabloon:
- Microsoft.Network/networkSecurityGroups
- Microsoft.Network/publicIPPrefix
- Microsoft.Network/publicIPAddresses
- Microsoft.Network/virtualNetworks
- Microsoft.Compute/virtualMachines
- Microsoft.Storage/storageAccounts
- Microsoft.Network/networkInterfaces
- Microsoft.Network/azureFirewalls
- Microsoft.Network/routeTables
De sjabloon implementeren
Het ARM-sjabloon implementeren in Azure:
Selecteer Implementeren in Azure om u aan te melden bij Azure en de sjabloon te openen. Met de sjabloon maakt u een Azure-firewall, de netwerkinfrastructuur en twee virtuele machines.
Typ of selecteer in de portal, op de pagina Een Azure-firewall met openbare IP-adressen maken, de volgende waarden:
- Abonnement: Selecteren uit bestaande abonnementen
- Resourcegroep: Selecteer uit bestaande resourcegroepen of selecteer Nieuwe maken en selecteer OK.
- Locatie: Selecteer een locatie
- Gebruikersnaam van beheerder: typ de gebruikersnaam voor het gebruikersaccount van de beheerder
- Beheerderswachtwoord: typ een beheerderswachtwoord of -sleutel
Selecteer Ik ga akkoord met de bovenstaande voorwaarden en selecteer vervolgens Kopen. De implementatie kan 10 minuten of langer duren.
De implementatie valideren
Controleer in Azure Portal de geïmplementeerde resources. Noteer de openbare IP-adressen van de firewall.
Gebruik Verbinding met extern bureaublad om verbinding te maken met de openbare IP-adressen van de firewall. Geslaagde verbindingen demonstreren firewall NAT-regels die de verbinding met de back-endservers toestaan.
Resources opschonen
Wanneer u de resources die u met de firewall hebt gemaakt niet meer nodig hebt, verwijdert u de resourcegroep. Als u de resourcegroep verwijdert, worden de firewall en alle gerelateerde resources verwijderd.
Als u de resourcegroep wilt verwijderen, roept u de cmdlet Remove-AzResourceGroup aan:
Remove-AzResourceGroup -Name "<your resource group name>"