Azfw ipgroups to master (New)

[ssripadham]

Description

- `Azure Firewall will support IpGroups can be used in the network/application/dnat rules as described below.

• As a source or destination address in AZFW network rules
• As a source address in AZFW application rules
• As a source address in DNAT rules. `

1. Azure Firewall Application Rules

     "AzureFirewallApplicationRule": {
         "properties": {
           "name": {
             "type": "string",
             "description": "Name of the application rule."
           },
           "description": {
             "type": "string",
             "description": "Description of the rule."
           },
           ...
           "sourceIpGroups": {
             "type": "array",
             "description": "List of source IP Groups for this rule.",
             "items": {
               "type": "string"
             }
           },
       ...
     }
    }

2. Azure Firewall NAT Rules

   "AzureFirewallNatRule": {
         "properties": {
           "name": {
             "type": "string",
             "description": "Name of the NAT rule."
           },
           "description": {
             "type": "string",
             "description": "Description of the rule."
           },
          ...

    "sourceIpGroups": {
      "type": "array",
      "description": "List of source IP Groups for this rule.",
      "items": {
        "type": "string"
      }
    }
       …
   }
   }

3. Azure Firewall Network Rules

    "AzureFirewallNetworkRule": {
         "properties": {
           "name": {
             "type": "string",
             "description": "Name of the network rule."
           },
           "description": {
             "type": "string",
             "description": "Description of the rule."
           },
          ...
           "sourceIpGroups": {
             "type": "array",
             "description": "List of source IP Groups for this rule.",
             "items": {
               "type": "string"
             }
           },
           "destinationIpGroups": {
             "type": "array",
             "description": "List of destination IP Groups for this rule.",
             "items": {
               "type": "string"
             }
           },
       ...
    }
   }

Checklist

• I have read the Submitting Changes section of CONTRIBUTING.md
• The title of the PR is clear and informative
• The appropriate ChangeLog.md file(s) has been updated:
  • For any service, the ChangeLog.md file can be found at src/{{SERVICE}}/{{SERVICE}}/ChangeLog.md
  • A snippet outlining the change(s) made in the PR should be written under the ## Upcoming Release header -- no new version header should be added
• The PR does not introduce breaking changes
• If applicable, the changes made in the PR have proper test coverage
• For public API changes to cmdlets:
  • a cmdlet design review was approved for the changes in this repository (Microsoft internal only)
  • the markdown help files have been regenerated using the commands listed here

REFERENCE: #10647

[wyunchi-ms]

This parameter set name is never used.

[wyunchi-ms]

Change default parameter set may cause breaking change. Is this you want?

[ssripadham]

Yes, this is required.

Default (Default)

New-AzFirewallApplicationRule -Name <String> [-Description <String>] -SourceAddress <String[]>
[-TargetFqdn <String[]>] [-FqdnTag <String[]>]
 [-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm] [<CommonParameters>]

SourceIpGroup

New-AzFirewallApplicationRule -Name <String> [-Description <String>] 
 -SourceIpGroup <String[]> [-TargetFqdn <String[]>] [-FqdnTag <String[]>]
 [-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm] [<CommonParameters>]

TargetFqdn

New-AzFirewallApplicationRule -Name <String> [-Description <String>] [-SourceAddress <String[]>]
 [-SourceIpGroup <String[]>] -TargetFqdn <String[]> -Protocol <String[]>
 [-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm] [<CommonParameters>]

FqdnTag

New-AzFirewallApplicationRule -Name <String> [-Description <String>] [-SourceAddress <String[]>]
 [-SourceIpGroup <String[]>] [-FqdnTag <String[]>] [-DefaultProfile <IAzureContextContainer>] [-WhatIf]
 [-Confirm] [<CommonParameters>]


Ideally, we desire atleast one source and one destination

[wyunchi-ms]

Hi @ssripadham could you please take a look at these comments?

[ssripadham]

I am simplifying the Pull Request wrt Option Sets. The latest PR is here: https://github.com/Azure/azure-powershell/pull/10674/files. Let us close this one.