AzureFirewall with IpGroups (LATEST)

[ssripadham]

Description

- `Azure Firewall will support IpGroups can be used in the network/application/dnat rules as described below.

• As a source or destination address in AZFW network rules
• As a source address in AZFW application rules
• As a source address in DNAT rules. `

1. Azure Firewall Application Rules

     "AzureFirewallApplicationRule": {
         "properties": {
           "name": {
             "type": "string",
             "description": "Name of the application rule."
           },
           "description": {
             "type": "string",
             "description": "Description of the rule."
           },
           ...
           "sourceIpGroups": {
             "type": "array",
             "description": "List of source IP Groups for this rule.",
             "items": {
               "type": "string"
             }
           },
       ...
     }
    }

2. Azure Firewall NAT Rules

   "AzureFirewallNatRule": {
         "properties": {
           "name": {
             "type": "string",
             "description": "Name of the NAT rule."
           },
           "description": {
             "type": "string",
             "description": "Description of the rule."
           },
          ...

    "sourceIpGroups": {
      "type": "array",
      "description": "List of source IP Groups for this rule.",
      "items": {
        "type": "string"
      }
    }
       …
   }
   }

3. Azure Firewall Network Rules

    "AzureFirewallNetworkRule": {
         "properties": {
           "name": {
             "type": "string",
             "description": "Name of the network rule."
           },
           "description": {
             "type": "string",
             "description": "Description of the rule."
           },
          ...
           "sourceIpGroups": {
             "type": "array",
             "description": "List of source IP Groups for this rule.",
             "items": {
               "type": "string"
             }
           },
           "destinationIpGroups": {
             "type": "array",
             "description": "List of destination IP Groups for this rule.",
             "items": {
               "type": "string"
             }
           },
       ...
    }
   }

Checklist

• I have read the Submitting Changes section of CONTRIBUTING.md
• The title of the PR is clear and informative
• The appropriate ChangeLog.md file(s) has been updated:
  • For any service, the ChangeLog.md file can be found at src/{{SERVICE}}/{{SERVICE}}/ChangeLog.md
  • A snippet outlining the change(s) made in the PR should be written under the ## Upcoming Release header -- no new version header should be added
• The PR does not introduce breaking changes
• If applicable, the changes made in the PR have proper test coverage
• For public API changes to cmdlets:
  • a cmdlet design review was approved for the changes in this repository (Microsoft internal only)
  • the markdown help files have been regenerated using the commands listed here

[Yabo Hu (VeryEarly)]

it looks like you need two parameter sets, SourceAddress and SourceIpGroup will need to be mandatory for each.

[ssripadham]

No, we do not want to use the parameter set. It lead us to complication in paramterset definition as in https://github.com/Azure/azure-powershell/pull/10668/files
We are using an approach where both SourceAddress & SourceIpGroup are optional and using checks to make sure atleast one of these is supplied by the user

[ssripadham]

We are using similar approach for Destination Addresses in network rule.

[Yabo Hu (VeryEarly)]

the similar approach is not appropriate either, breaking change fix needed

[Yabo Hu (VeryEarly)]

better to put exception message here https://github.com/Azure/azure-powershell/blob/ipgroup_azfw_branch/src/Network/Network/Properties/Resources.resx

[Yabo Hu (VeryEarly)]

I understand you didn't create this message but this line is confusing, can you put something like "only one of DestinationAddress or DestinationFqdns is allowed"?