Snabbstart: Skapa en Azure Firewall med flera offentliga IP-adresser – ARM-mall

I den här snabbstarten använder du en Azure Resource Manager-mall (ARM-mall) för att distribuera en Azure Firewall med flera offentliga IP-adresser från ett offentligt IP-adressprefix. Den distribuerade brandväggen har regler för NAT-regelinsamling som tillåter RDP-anslutningar till två virtuella Windows Server 2019-datorer.

Diagram som visar nätverkskonfigurationen för den här snabbstarten.

En Azure Resource Manager-mall är en JSON-fil (JavaScript Object Notation) som definierar infrastrukturen och konfigurationen för projektet. Mallen använder deklarativ syntax. Du beskriver den avsedda distributionen utan att skriva sekvensen med programmeringskommandon för att skapa distributionen.

Mer information om Azure Firewall med flera offentliga IP-adresser finns i Distribuera en Azure Firewall med flera offentliga IP-adresser med Azure PowerShell.

Om din miljö uppfyller förhandskraven och du är van att använda ARM-mallar väljer du knappen Distribuera till Azure. Mallen öppnas i Azure portalen.

Knapp för att distribuera Resource Manager-mallen till Azure.

Förutsättningar

Granska mallen

Den här mallen skapar en Azure Firewall med två offentliga IP-adresser, tillsammans med de resurser som behövs för att stödja Azure Firewall.

Mallen som används i den här snabbstarten kommer från Azure-snabbstartsmallar.

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "metadata": {
    "_generator": {
      "name": "bicep",
      "version": "0.26.54.24096",
      "templateHash": "8395247770070350203"
    }
  },
  "parameters": {
    "adminUsername": {
      "type": "string",
      "metadata": {
        "description": "Admin username for the backend servers"
      }
    },
    "adminPassword": {
      "type": "securestring",
      "metadata": {
        "description": "Password for the admin account on the backend servers"
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location for all resources."
      }
    },
    "vmSize": {
      "type": "string",
      "defaultValue": "Standard_B2ms",
      "metadata": {
        "description": "Size of the virtual machine."
      }
    }
  },
  "variables": {
    "copy": [
      {
        "name": "azureFirewallIpConfigurations",
        "count": "[length(range(0, 2))]",
        "input": {
          "name": "[format('IpConf{0}', add(range(0, 2)[copyIndex('azureFirewallIpConfigurations')], 1))]",
          "properties": {
            "subnet": "[if(equals(range(0, 2)[copyIndex('azureFirewallIpConfigurations')], 0), json(format('{{\"id\": \"{0}\"}}', variables('azureFirewallSubnetId'))), null())]",
            "publicIPAddress": {
              "id": "[resourceId('Microsoft.Network/publicIPAddresses', format('{0}{1}', variables('publicIpAddressName'), add(range(0, 2)[range(0, 2)[copyIndex('azureFirewallIpConfigurations')]], 1)))]"
            }
          }
        }
      }
    ],
    "virtualMachineName": "myVM",
    "virtualNetworkName": "myVNet",
    "networkInterfaceName": "net-int",
    "ipConfigName": "ipconfig",
    "ipPrefixName": "public_ip_prefix",
    "ipPrefixSize": 31,
    "publicIpAddressName": "public_ip",
    "nsgName": "vm-nsg",
    "firewallName": "FW-01",
    "vnetPrefix": "10.0.0.0/16",
    "fwSubnetPrefix": "10.0.0.0/24",
    "backendSubnetPrefix": "10.0.1.0/24",
    "azureFirewallSubnetId": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), 'AzureFirewallSubnet')]"
  },
  "resources": [
    {
      "copy": {
        "name": "nsg",
        "count": "[length(range(0, 2))]"
      },
      "type": "Microsoft.Network/networkSecurityGroups",
      "apiVersion": "2023-09-01",
      "name": "[format('{0}{1}', variables('nsgName'), add(range(0, 2)[copyIndex()], 1))]",
      "location": "[parameters('location')]",
      "properties": {
        "securityRules": [
          {
            "name": "RDP",
            "properties": {
              "protocol": "Tcp",
              "sourcePortRange": "*",
              "destinationPortRange": "3389",
              "sourceAddressPrefix": "*",
              "destinationAddressPrefix": "*",
              "access": "Allow",
              "priority": 300,
              "direction": "Inbound"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.Network/publicIPPrefixes",
      "apiVersion": "2023-09-01",
      "name": "[variables('ipPrefixName')]",
      "location": "[parameters('location')]",
      "properties": {
        "prefixLength": "[variables('ipPrefixSize')]",
        "publicIPAddressVersion": "IPv4"
      },
      "sku": {
        "name": "Standard"
      }
    },
    {
      "copy": {
        "name": "publicIPAddress",
        "count": "[length(range(0, 2))]"
      },
      "type": "Microsoft.Network/publicIPAddresses",
      "apiVersion": "2023-09-01",
      "name": "[format('{0}{1}', variables('publicIpAddressName'), add(range(0, 2)[copyIndex()], 1))]",
      "location": "[parameters('location')]",
      "sku": {
        "name": "Standard"
      },
      "properties": {
        "publicIPAddressVersion": "IPv4",
        "publicIPAllocationMethod": "Static",
        "publicIPPrefix": {
          "id": "[resourceId('Microsoft.Network/publicIPPrefixes', variables('ipPrefixName'))]"
        },
        "idleTimeoutInMinutes": 4
      },
      "dependsOn": [
        "[resourceId('Microsoft.Network/publicIPPrefixes', variables('ipPrefixName'))]"
      ]
    },
    {
      "type": "Microsoft.Network/virtualNetworks",
      "apiVersion": "2023-09-01",
      "name": "[variables('virtualNetworkName')]",
      "location": "[parameters('location')]",
      "properties": {
        "addressSpace": {
          "addressPrefixes": [
            "[variables('vnetPrefix')]"
          ]
        },
        "subnets": [
          {
            "name": "myBackendSubnet",
            "properties": {
              "addressPrefix": "[variables('backendSubnetPrefix')]",
              "routeTable": {
                "id": "[resourceId('Microsoft.Network/routeTables', 'rt-01')]"
              },
              "privateEndpointNetworkPolicies": "Enabled",
              "privateLinkServiceNetworkPolicies": "Enabled"
            }
          }
        ],
        "enableDdosProtection": false,
        "enableVmProtection": false
      },
      "dependsOn": [
        "[resourceId('Microsoft.Network/routeTables', 'rt-01')]"
      ]
    },
    {
      "type": "Microsoft.Network/virtualNetworks/subnets",
      "apiVersion": "2023-09-01",
      "name": "[format('{0}/{1}', variables('virtualNetworkName'), 'AzureFirewallSubnet')]",
      "properties": {
        "addressPrefix": "[variables('fwSubnetPrefix')]",
        "privateEndpointNetworkPolicies": "Enabled",
        "privateLinkServiceNetworkPolicies": "Enabled"
      },
      "dependsOn": [
        "[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworkName'))]"
      ]
    },
    {
      "copy": {
        "name": "virtualMachine",
        "count": "[length(range(0, 2))]"
      },
      "type": "Microsoft.Compute/virtualMachines",
      "apiVersion": "2023-09-01",
      "name": "[format('{0}{1}', variables('virtualMachineName'), add(range(0, 2)[copyIndex()], 1))]",
      "location": "[parameters('location')]",
      "properties": {
        "hardwareProfile": {
          "vmSize": "[parameters('vmSize')]"
        },
        "storageProfile": {
          "imageReference": {
            "publisher": "MicrosoftWindowsServer",
            "offer": "WindowsServer",
            "sku": "2019-Datacenter",
            "version": "latest"
          },
          "osDisk": {
            "osType": "Windows",
            "createOption": "FromImage",
            "caching": "ReadWrite",
            "managedDisk": {
              "storageAccountType": "StandardSSD_LRS"
            },
            "diskSizeGB": 127
          }
        },
        "osProfile": {
          "computerName": "[format('{0}{1}', variables('virtualMachineName'), add(range(0, 2)[copyIndex()], 1))]",
          "adminUsername": "[parameters('adminUsername')]",
          "adminPassword": "[parameters('adminPassword')]",
          "windowsConfiguration": {
            "provisionVMAgent": true,
            "enableAutomaticUpdates": true
          },
          "allowExtensionOperations": true
        },
        "networkProfile": {
          "networkInterfaces": [
            {
              "id": "[resourceId('Microsoft.Network/networkInterfaces', format('{0}{1}', variables('networkInterfaceName'), add(range(0, 2)[range(0, 2)[copyIndex()]], 1)))]"
            }
          ]
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.Network/networkInterfaces', format('{0}{1}', variables('networkInterfaceName'), add(range(0, 2)[range(0, 2)[copyIndex()]], 1)))]"
      ]
    },
    {
      "copy": {
        "name": "netInterface",
        "count": "[length(range(0, 2))]"
      },
      "type": "Microsoft.Network/networkInterfaces",
      "apiVersion": "2023-09-01",
      "name": "[format('{0}{1}', variables('networkInterfaceName'), add(range(0, 2)[copyIndex()], 1))]",
      "location": "[parameters('location')]",
      "properties": {
        "ipConfigurations": [
          {
            "name": "[format('{0}{1}', variables('ipConfigName'), add(range(0, 2)[copyIndex()], 1))]",
            "properties": {
              "subnet": {
                "id": "[reference(resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworkName')), '2023-09-01').subnets[0].id]"
              },
              "primary": true
            }
          }
        ],
        "enableAcceleratedNetworking": false,
        "enableIPForwarding": false,
        "networkSecurityGroup": {
          "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}{1}', variables('nsgName'), add(range(0, 2)[range(0, 2)[copyIndex()]], 1)))]"
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}{1}', variables('nsgName'), add(range(0, 2)[range(0, 2)[copyIndex()]], 1)))]",
        "[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworkName'))]"
      ]
    },
    {
      "type": "Microsoft.Network/azureFirewalls",
      "apiVersion": "2023-09-01",
      "name": "[variables('firewallName')]",
      "location": "[parameters('location')]",
      "properties": {
        "sku": {
          "name": "AZFW_VNet",
          "tier": "Standard"
        },
        "threatIntelMode": "Deny",
        "ipConfigurations": "[variables('azureFirewallIpConfigurations')]",
        "applicationRuleCollections": [
          {
            "name": "web",
            "properties": {
              "priority": 100,
              "action": {
                "type": "Allow"
              },
              "rules": [
                {
                  "name": "wan-address",
                  "protocols": [
                    {
                      "protocolType": "Http",
                      "port": 80
                    },
                    {
                      "protocolType": "Https",
                      "port": 443
                    }
                  ],
                  "targetFqdns": [
                    "getmywanip.com"
                  ],
                  "sourceAddresses": [
                    "*"
                  ]
                },
                {
                  "name": "google",
                  "protocols": [
                    {
                      "protocolType": "Http",
                      "port": 80
                    },
                    {
                      "protocolType": "Https",
                      "port": 443
                    }
                  ],
                  "targetFqdns": [
                    "www.google.com"
                  ],
                  "sourceAddresses": [
                    "10.0.1.0/24"
                  ]
                },
                {
                  "name": "wupdate",
                  "protocols": [
                    {
                      "protocolType": "Http",
                      "port": 80
                    },
                    {
                      "protocolType": "Https",
                      "port": 443
                    }
                  ],
                  "fqdnTags": [
                    "WindowsUpdate"
                  ],
                  "sourceAddresses": [
                    "*"
                  ]
                }
              ]
            }
          }
        ],
        "natRuleCollections": [
          {
            "name": "Coll-01",
            "properties": {
              "priority": 100,
              "action": {
                "type": "Dnat"
              },
              "rules": [
                {
                  "name": "rdp-01",
                  "protocols": [
                    "TCP"
                  ],
                  "translatedAddress": "10.0.1.4",
                  "translatedPort": "3389",
                  "sourceAddresses": [
                    "*"
                  ],
                  "destinationAddresses": [
                    "[reference(resourceId('Microsoft.Network/publicIPAddresses', format('{0}{1}', variables('publicIpAddressName'), add(range(0, 2)[0], 1))), '2023-09-01').ipAddress]"
                  ],
                  "destinationPorts": [
                    "3389"
                  ]
                },
                {
                  "name": "rdp-02",
                  "protocols": [
                    "TCP"
                  ],
                  "translatedAddress": "10.0.1.5",
                  "translatedPort": "3389",
                  "sourceAddresses": [
                    "*"
                  ],
                  "destinationAddresses": [
                    "[reference(resourceId('Microsoft.Network/publicIPAddresses', format('{0}{1}', variables('publicIpAddressName'), add(range(0, 2)[1], 1))), '2023-09-01').ipAddress]"
                  ],
                  "destinationPorts": [
                    "3389"
                  ]
                }
              ]
            }
          }
        ]
      },
      "dependsOn": [
        "publicIPAddress",
        "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), 'AzureFirewallSubnet')]"
      ]
    },
    {
      "type": "Microsoft.Network/routeTables",
      "apiVersion": "2023-09-01",
      "name": "rt-01",
      "location": "[parameters('location')]",
      "properties": {
        "disableBgpRoutePropagation": false,
        "routes": [
          {
            "name": "fw",
            "properties": {
              "addressPrefix": "0.0.0.0/0",
              "nextHopType": "VirtualAppliance",
              "nextHopIpAddress": "10.0.0.4"
            }
          }
        ]
      }
    }
  ],
  "outputs": {
    "name": {
      "type": "string",
      "value": "[variables('firewallName')]"
    },
    "resourceId": {
      "type": "string",
      "value": "[resourceId('Microsoft.Network/azureFirewalls', variables('firewallName'))]"
    },
    "location": {
      "type": "string",
      "value": "[parameters('location')]"
    },
    "resourceGroupName": {
      "type": "string",
      "value": "[resourceGroup().name]"
    }
  }
}

Mallen definierar flera Azure-resurser, inklusive:

Distribuera mallen

Distribuera ARM-mallen till Azure:

  1. Välj Distribuera till Azure för att logga in på Azure och öppna mallen. Mallen skapar en Azure Firewall, nätverksinfrastrukturen och två virtuella datorer.

    Knapp för att distribuera Resource Manager-mallen till Azure.

  2. I portalen går du till Skapa en Azure Firewall med flera offentliga IP-adresser och anger eller väljer följande värden:

    • Prenumeration: Välj från befintliga prenumerationer.
    • Resursgrupp: Välj från befintliga resursgrupper eller välj Skapa ny och välj OK.
    • Plats: Välj en plats.
    • Administratörsanvändarnamn: Ange ett användarnamn för administratörsanvändarkontot.
    • Administratörslösenord: Ange ett administratörslösenord eller en nyckel.

  3. Välj Jag godkänner de villkor som anges ovan och välj sedan Köp. Distributionen kan ta 10 minuter eller längre att slutföra.

Verifiera utplaceringen

Granska de distribuerade resurserna i Azure Portal. Observera brandväggens offentliga IP-adresser.

Använd Anslutning till fjärrskrivbord för att ansluta till brandväggens offentliga IP-adresser. Lyckade anslutningar visar NAT-regler i brandväggen som tillåter anslutning till backend-servrarna.

Rensa resurser

När du inte längre behöver de resurser som du skapade med brandväggen tar du bort resursgruppen. Om du tar bort resursgruppen tas brandväggen och alla relaterade resurser bort.

Om du vill ta bort resursgruppen anropar du cmdleten Remove-AzResourceGroup :

Remove-AzResourceGroup -Name "<your resource group name>"

Nästa steg

Självstudie: Distribuera och konfigurera Azure Firewall i ett hybridnätverk med hjälp av Azure Portal

  • Last updated on