azurerm_firewall_policy_rule_collection_group destination_ports argument does not support "*"

[schlickspringer]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

terraform 0.13.5
azurerm 2.49.0

Affected Resource(s)

• azurerm_firewall_policy_rule_collection_group

Terraform Configuration Files

resource "azurerm_firewall_policy_rule_collection_group" "defaultgrouprules" {
  name               = "DefaultNetworkRuleCollectionGroup"
  firewall_policy_id = azurerm_firewall_policy.pol01.id
  priority           = 200
 network_rule_collection {
    name     = "CollectionforTesting"
    priority = 1000
    action   = "Allow"
    rule {
      name                  = "AllowAll"
      protocols             = ["Any","ICMP","TCP","UDP"]
      source_addresses      = ["*"]
      destination_addresses = ["*"]
      destination_ports     = ["*"]
    }
  }
}

Debug Output

Panic Output

Expected Behaviour

Apply the configuration.

Actual Behaviour

An error results when using "*" as a destination_ports argument. An asterisk is a valid destination_port argument when using the Azure Portal.

Error: invalid format of "network_rule_collection.0.rule.0.destination_ports.0"

Steps to Reproduce

1. terraform apply

Important Factoids

References

• azurerm_firewall_policy_rule_collection_group destination_ports argument does not support "*" or "1-65535" #9304

[adamday2]

I believe this is a dupe of #10524 and #10187 where the recommendation was to set the value to 1-65535.

[schlickspringer]

I have already tried this but have the strange behavior: When set to 1-65535 my ping to a destination behind FW does not work. As soon as I change the ports to "*" within Azure Portal my ping command works.

So I guess there is something different behind the scenes. At least for ICMP protocol.

[pauldotyu]

Any updates on this? I too have confirmed that using a port range of 1-65535 does not work for Azure Firewall Policy Manager rule collections.

[juicybaba]

ping and traceroute are reply on ICMP, and ICMP is a protocol on network layer which doesnt have the concept of port
https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol

To me, port should be ignored (by using "*") for ICMP traffic.

[jkroepke]

@adamday2

where the recommendation was to set the value to 1-65535.

1-65535 != *

https://docs.microsoft.com/de-de/azure/firewall/rule-processing#network-rule-protocol

If a destination port is explicitly configured, then the rule is translated to a TCP+UDP rule.

That means, If a rule has port like 1-65535 defined, ICMP not longer works.

[ghost]

This has been released in version 2.56.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
    version = "~> 2.56.0"
}
# ... other configuration ...

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!