-
Notifications
You must be signed in to change notification settings - Fork 4.1k
adding support for firewall policy on vnet firewall #11003
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
markcowl
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Per comment, I think thsi is best addressed by parameter sets. Also, needs a changelog update
| else | ||
| { | ||
|
|
||
| if (FirewallPolicyId != null && (this.ApplicationRuleCollection != null || this.NetworkRuleCollection != null || this.NatRuleCollection != null)) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This seems like something that should be enforced through parameter sets - FirewallPolicyId should not be in the same parameter sets that include ApplicationRUleCollection or NetworkRuleCollection
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I am having trouble with the mutual exclusion scenario @markcowl placing firewall policy id in one parameter set and rule collections in another did not achieve the desired result.
I have tried various combinations but could not get it done. Do you have an example where we can achieve mutual exclusion using paramter sets? I will keep exploring as well
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We have decided to fail the call from NRP when there are both the policy and the rule collections. This way we need not make changes on the PS when we try to support policy+collections in case, show a message which is common across multiple platforms and track the usage. Also I would like to make a PR against network january branch and not the master. I have created another PR: #11013 am closing this one
Description
Checklist
CONTRIBUTING.mdChangeLog.mdfile(s) has been updated:ChangeLog.mdfile can be found atsrc/{{SERVICE}}/{{SERVICE}}/ChangeLog.md## Upcoming Releaseheader -- no new version header should be added