快速入門：建立 Azure 防火牆和防火牆原則 - ARM 範本

發行項
06/13/2024

在本快速入門中，您將使用 Azure Resource Manager 範本 (ARM 範本) 建立 Azure 防火牆和防火牆原則。防火牆原則具有允許連線至 www.microsoft.com 的應用程式規則，以及允許使用 WindowsUpdate FQDN 標籤連線至 Windows Update 的規則。網路規則允許使用 13.86.101.172 透過 UDP 連線至時間伺服器。

此外，規則也會使用 IP 群組來定義來源 IP 位址。

Azure Resource Manager 範本是一個 JavaScript 物件標記法 (JSON) 檔案，會定義專案的基礎結構和設定。範本使用宣告式語法。您可以描述預期的部署，而不需要撰寫程式設計命令順序來建立部署。

如需 Azure 防火牆管理員的詳細資訊，請參閱什麼是 Azure 防火牆管理員？。

如需 Azure 防火牆的詳細資訊，請參閱什麼是 Azure 防火牆？。

如需關於 IP 群組的資訊，請參閱 Azure 防火牆中的 IP 群組。

如果您的環境符合必要條件，而且您很熟悉 ARM 範本，請選取 [部署至 Azure] 按鈕。範本會在 Azure 入口網站中開啟。

必要條件

具有有效訂用帳戶的 Azure 帳戶。免費建立帳戶。

檢閱範本

此範本會建立中樞虛擬網路，以及支援案例的必要資源。

本快速入門中使用的範本是來自 Azure 快速入門範本。

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "metadata": {
    "_generator": {
      "name": "bicep",
      "version": "0.8.9.13224",
      "templateHash": "2614956787969031174"
    }
  },
  "parameters": {
    "virtualNetworkName": {
      "type": "string",
      "defaultValue": "[format('vnet{0}', uniqueString(resourceGroup().id))]",
      "metadata": {
        "description": "Virtual network name"
      }
    },
    "firewallName": {
      "type": "string",
      "defaultValue": "[format('fw{0}', uniqueString(resourceGroup().id))]",
      "metadata": {
        "description": "Azure Firewall name"
      }
    },
    "numberOfPublicIPAddresses": {
      "type": "int",
      "defaultValue": 2,
      "maxValue": 100,
      "minValue": 1,
      "metadata": {
        "description": "Number of public IP addresses for the Azure Firewall"
      }
    },
    "availabilityZones": {
      "type": "array",
      "defaultValue": [],
      "metadata": {
        "description": "Zone numbers e.g. 1,2,3."
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location for all resources."
      }
    },
    "infraIpGroupName": {
      "type": "string",
      "defaultValue": "[format('{0}-infra-ipgroup-{1}', parameters('location'), uniqueString(resourceGroup().id))]"
    },
    "workloadIpGroupName": {
      "type": "string",
      "defaultValue": "[format('{0}-workload-ipgroup-{1}', parameters('location'), uniqueString(resourceGroup().id))]"
    },
    "firewallPolicyName": {
      "type": "string",
      "defaultValue": "[format('{0}-firewallPolicy', parameters('firewallName'))]"
    }
  },
  "variables": {
    "copy": [
      {
        "name": "azureFirewallIpConfigurations",
        "count": "[length(range(0, parameters('numberOfPublicIPAddresses')))]",
        "input": {
          "name": "[format('IpConf{0}', range(0, parameters('numberOfPublicIPAddresses'))[copyIndex('azureFirewallIpConfigurations')])]",
          "properties": {
            "subnet": "[if(equals(range(0, parameters('numberOfPublicIPAddresses'))[copyIndex('azureFirewallIpConfigurations')], 0), json(format('{{\"id\": \"{0}\"}}', variables('azureFirewallSubnetId'))), json('null'))]",
            "publicIPAddress": {
              "id": "[format('{0}{1}', variables('azureFirewallPublicIpId'), add(range(0, parameters('numberOfPublicIPAddresses'))[copyIndex('azureFirewallIpConfigurations')], 1))]"
            }
          }
        }
      }
    ],
    "vnetAddressPrefix": "10.10.0.0/24",
    "azureFirewallSubnetPrefix": "10.10.0.0/25",
    "publicIPNamePrefix": "publicIP",
    "azurepublicIpname": "[variables('publicIPNamePrefix')]",
    "azureFirewallSubnetName": "AzureFirewallSubnet",
    "azureFirewallSubnetId": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), variables('azureFirewallSubnetName'))]",
    "azureFirewallPublicIpId": "[resourceId('Microsoft.Network/publicIPAddresses', variables('publicIPNamePrefix'))]"
  },
  "resources": [
    {
      "type": "Microsoft.Network/ipGroups",
      "apiVersion": "2022-01-01",
      "name": "[parameters('workloadIpGroupName')]",
      "location": "[parameters('location')]",
      "properties": {
        "ipAddresses": [
          "10.20.0.0/24",
          "10.30.0.0/24"
        ]
      }
    },
    {
      "type": "Microsoft.Network/ipGroups",
      "apiVersion": "2022-01-01",
      "name": "[parameters('infraIpGroupName')]",
      "location": "[parameters('location')]",
      "properties": {
        "ipAddresses": [
          "10.40.0.0/24",
          "10.50.0.0/24"
        ]
      }
    },
    {
      "type": "Microsoft.Network/virtualNetworks",
      "apiVersion": "2022-01-01",
      "name": "[parameters('virtualNetworkName')]",
      "location": "[parameters('location')]",
      "tags": {
        "displayName": "[parameters('virtualNetworkName')]"
      },
      "properties": {
        "addressSpace": {
          "addressPrefixes": [
            "[variables('vnetAddressPrefix')]"
          ]
        },
        "subnets": [
          {
            "name": "[variables('azureFirewallSubnetName')]",
            "properties": {
              "addressPrefix": "[variables('azureFirewallSubnetPrefix')]"
            }
          }
        ],
        "enableDdosProtection": false
      }
    },
    {
      "copy": {
        "name": "publicIpAddress",
        "count": "[length(range(0, parameters('numberOfPublicIPAddresses')))]"
      },
      "type": "Microsoft.Network/publicIPAddresses",
      "apiVersion": "2022-01-01",
      "name": "[format('{0}{1}', variables('azurepublicIpname'), add(range(0, parameters('numberOfPublicIPAddresses'))[copyIndex()], 1))]",
      "location": "[parameters('location')]",
      "sku": {
        "name": "Standard"
      },
      "properties": {
        "publicIPAllocationMethod": "Static",
        "publicIPAddressVersion": "IPv4"
      }
    },
    {
      "type": "Microsoft.Network/firewallPolicies",
      "apiVersion": "2022-01-01",
      "name": "[parameters('firewallPolicyName')]",
      "location": "[parameters('location')]",
      "properties": {
        "threatIntelMode": "Alert"
      }
    },
    {
      "type": "Microsoft.Network/firewallPolicies/ruleCollectionGroups",
      "apiVersion": "2022-01-01",
      "name": "[format('{0}/{1}', parameters('firewallPolicyName'), 'DefaultNetworkRuleCollectionGroup')]",
      "properties": {
        "priority": 200,
        "ruleCollections": [
          {
            "ruleCollectionType": "FirewallPolicyFilterRuleCollection",
            "action": {
              "type": "Allow"
            },
            "name": "azure-global-services-nrc",
            "priority": 1250,
            "rules": [
              {
                "ruleType": "NetworkRule",
                "name": "time-windows",
                "ipProtocols": [
                  "UDP"
                ],
                "destinationAddresses": [
                  "13.86.101.172"
                ],
                "sourceIpGroups": [
                  "[resourceId('Microsoft.Network/ipGroups', parameters('workloadIpGroupName'))]",
                  "[resourceId('Microsoft.Network/ipGroups', parameters('infraIpGroupName'))]"
                ],
                "destinationPorts": [
                  "123"
                ]
              }
            ]
          }
        ]
      },
      "dependsOn": [
        "[resourceId('Microsoft.Network/firewallPolicies', parameters('firewallPolicyName'))]",
        "[resourceId('Microsoft.Network/ipGroups', parameters('infraIpGroupName'))]",
        "[resourceId('Microsoft.Network/ipGroups', parameters('workloadIpGroupName'))]"
      ]
    },
    {
      "type": "Microsoft.Network/firewallPolicies/ruleCollectionGroups",
      "apiVersion": "2022-01-01",
      "name": "[format('{0}/{1}', parameters('firewallPolicyName'), 'DefaultApplicationRuleCollectionGroup')]",
      "properties": {
        "priority": 300,
        "ruleCollections": [
          {
            "ruleCollectionType": "FirewallPolicyFilterRuleCollection",
            "name": "global-rule-url-arc",
            "priority": 1000,
            "action": {
              "type": "Allow"
            },
            "rules": [
              {
                "ruleType": "ApplicationRule",
                "name": "winupdate-rule-01",
                "protocols": [
                  {
                    "protocolType": "Https",
                    "port": 443
                  },
                  {
                    "protocolType": "Http",
                    "port": 80
                  }
                ],
                "fqdnTags": [
                  "WindowsUpdate"
                ],
                "terminateTLS": false,
                "sourceIpGroups": [
                  "[resourceId('Microsoft.Network/ipGroups', parameters('workloadIpGroupName'))]",
                  "[resourceId('Microsoft.Network/ipGroups', parameters('infraIpGroupName'))]"
                ]
              }
            ]
          },
          {
            "ruleCollectionType": "FirewallPolicyFilterRuleCollection",
            "action": {
              "type": "Allow"
            },
            "name": "Global-rules-arc",
            "priority": 1202,
            "rules": [
              {
                "ruleType": "ApplicationRule",
                "name": "global-rule-01",
                "protocols": [
                  {
                    "protocolType": "Https",
                    "port": 443
                  }
                ],
                "targetFqdns": [
                  "www.microsoft.com"
                ],
                "terminateTLS": false,
                "sourceIpGroups": [
                  "[resourceId('Microsoft.Network/ipGroups', parameters('workloadIpGroupName'))]",
                  "[resourceId('Microsoft.Network/ipGroups', parameters('infraIpGroupName'))]"
                ]
              }
            ]
          }
        ]
      },
      "dependsOn": [
        "[resourceId('Microsoft.Network/firewallPolicies', parameters('firewallPolicyName'))]",
        "[resourceId('Microsoft.Network/ipGroups', parameters('infraIpGroupName'))]",
        "[resourceId('Microsoft.Network/firewallPolicies/ruleCollectionGroups', parameters('firewallPolicyName'), 'DefaultNetworkRuleCollectionGroup')]",
        "[resourceId('Microsoft.Network/ipGroups', parameters('workloadIpGroupName'))]"
      ]
    },
    {
      "type": "Microsoft.Network/azureFirewalls",
      "apiVersion": "2021-03-01",
      "name": "[parameters('firewallName')]",
      "location": "[parameters('location')]",
      "zones": "[if(equals(length(parameters('availabilityZones')), 0), null(), parameters('availabilityZones'))]",
      "properties": {
        "ipConfigurations": "[variables('azureFirewallIpConfigurations')]",
        "firewallPolicy": {
          "id": "[resourceId('Microsoft.Network/firewallPolicies', parameters('firewallPolicyName'))]"
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.Network/firewallPolicies/ruleCollectionGroups', parameters('firewallPolicyName'), 'DefaultApplicationRuleCollectionGroup')]",
        "[resourceId('Microsoft.Network/firewallPolicies', parameters('firewallPolicyName'))]",
        "[resourceId('Microsoft.Network/ipGroups', parameters('infraIpGroupName'))]",
        "[resourceId('Microsoft.Network/firewallPolicies/ruleCollectionGroups', parameters('firewallPolicyName'), 'DefaultNetworkRuleCollectionGroup')]",
        "publicIpAddress",
        "[resourceId('Microsoft.Network/virtualNetworks', parameters('virtualNetworkName'))]",
        "[resourceId('Microsoft.Network/ipGroups', parameters('workloadIpGroupName'))]"
      ]
    }
  ]
}

範本中定義了多個 Azure 資源：

部署範本

將 ARM 範本部署到 Azure：

選取 [部署至 Azure] 以登入 Azure 並開啟範本。此範本會建立 Azure 防火牆、虛擬 WAN 與虛擬中樞、網路基礎結構和兩部虛擬機器。
在入口網站的 [使用規則和 IP 群組建立防火牆和防火牆原則] 頁面上，輸入或選取下列值：
- 訂用帳戶：從現有的訂用帳戶選取。
- 資源群組：從現有的資源群組選取，或選取[新建]，然後選取 [確定]。
- 地區：選取區域。
- 防火牆名稱：輸入防火牆的名稱。
選取 [檢閱 + 建立]，然後選取 [建立]。部署可能需要 10 分鐘或更久的時間才能完成。

檢閱已部署的資源

部署完成後，您會看到下列類似資源。

部署的資源

清除資源

當您不再需要先前為防火牆建立的資源時，請刪除資源群組。這會移除防火牆和所有相關資源。

呼叫 Remove-AzResourceGroup Cmdlet 以刪除資源群組：

Remove-AzResourceGroup -Name "<your resource group name>"

下一步

Azure 防火牆管理員原則概觀

共用方式為