Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Modules] Connect Azure Firewall to a VirtualHub #2395

Merged
merged 19 commits into from
Jan 9, 2023

Conversation

fblix
Copy link
Contributor

@fblix fblix commented Dec 1, 2022

Description

This PR introduces and fixes the functionality towards Azure Firewalls in combination with Secured Virtual Hubs.
A bit of background:
An Azure Firewall can be configured to either run in an VirtualNetwork setup (Sku: AzFw_Vnet) or in a Secured Virtual Hub context (Sku: AzFw_hub). A firewall can therefore be deployed without a virtual network and instead with a secured virtual hub.


It is also not possible to attach a Azure Firewall to a Virtual Hub but only in reverse order. If you allow the AzureFirewallId property in the virtual hub two things happen:

  • The firewall is empty (has no policies attached): the deployment will succeed but not change anything.
  • The firewall has policies attached: the deployment will fail with either:
    • Standard SKU: {"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.","details":[{"code":"AzureFirewallSkuCannotBeUpdated","message":"Update on SKU is not supported for Azure Firewall standard."}]}
    • Premium SKU: {"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.","details":[{"code":"AzureFirewallSkuCannotBeUpdated","message":"Update on SKU is not supported for Azure Firewall premium (Sku name change is not allowed)."}]}

Following the documentation https://learn.microsoft.com/en-us/azure/firewall-manager/deployment-overview reveals that there is a specific deployment order to be followed. Thus, we only enabled the connection between firewall and vhub to be established from the firewall side and NOT vice-versa to keep control of the deployment order

Pipeline references

Pipeline
Network: AzureFirewalls

Type of Change

Please delete options that are not relevant.

  • Bugfix (non-breaking change which fixes an issue)

Checklist

  • I'm sure there are no other open Pull Requests for the same update/change
  • My corresponding pipelines / checks run clean and green without any errors or warnings
  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation (readme)
  • I did format my code

@JPEasier JPEasier added bug Something isn't working [cat] modules category: modules labels Dec 1, 2022
@fblix fblix changed the title Users/fblix jpeasier/1627 azure firewalls to virtual hubs [Bugfix] Connect Azure Firewall to a VirtualHub Dec 1, 2022
@fblix fblix changed the title [Bugfix] Connect Azure Firewall to a VirtualHub [Modules] Connect Azure Firewall to a VirtualHub Dec 1, 2022
@github-actions
Copy link

github-actions bot commented Dec 1, 2022

Test Results

  1 files    1 suites   45s ⏱️
54 tests 53 ✔️ 1 💤 0
94 runs  89 ✔️ 5 💤 0

Results for commit 1de867a.

♻️ This comment has been updated with latest results.

@fblix fblix marked this pull request as ready for review December 1, 2022 21:40
@fblix fblix requested a review from a team as a code owner December 1, 2022 21:40
@fblix fblix merged commit 3ea6b12 into main Jan 9, 2023
@fblix fblix deleted the users/fblix_jpeasier/1627-azure-firewalls-to-virtual-hubs branch January 9, 2023 18:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working [cat] modules category: modules
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Feature Request]: Support Azure Firewalls that are connected to Virtual Hubs
3 participants