Skip to content

Commit 58be9a7

Browse files
kjillakjilla
committed
Adding extended location for create firewall
1 parent 7dd3bc3 commit 58be9a7

File tree

8 files changed

+4406
-19
lines changed

8 files changed

+4406
-19
lines changed

‎src/Network/Network.Test/ScenarioTests/AzureFirewallTests.cs‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,5 +249,29 @@ public void TestAzureFirewallAutoscaleConfiguration()
249249
{
250250
TestRunner.RunTestScript("Test-AzureFirewallAutoscaleConfiguration");
251251
}
252+
253+
[Fact]
254+
[Trait(Category.AcceptanceType, Category.CheckIn)]
255+
[Trait(Category.Owner, NrpTeamAlias.azurefirewall)]
256+
public void TestAzureFirewallCRUDWithEdgeZone()
257+
{
258+
TestRunner.RunTestScript("Test-AzureFirewallCRUDWithEdgeZone");
259+
}
260+
261+
[Fact]
262+
[Trait(Category.AcceptanceType, Category.CheckIn)]
263+
[Trait(Category.Owner, NrpTeamAlias.azurefirewall)]
264+
public void TestAzureFirewallVirtualHubCRUDWithEdgeZone()
265+
{
266+
TestRunner.RunTestScript("Test-AzureFirewallVirtualHubCRUDWithEdgeZone");
267+
}
268+
269+
[Fact]
270+
[Trait(Category.AcceptanceType, Category.CheckIn)]
271+
[Trait(Category.Owner, NrpTeamAlias.azurefirewall)]
272+
public void TestAzureFirewallEdgeZoneZonesValidation()
273+
{
274+
TestRunner.RunTestScript("Test-AzureFirewallEdgeZoneZonesValidation");
275+
}
252276
}
253277
}

‎src/Network/Network.Test/ScenarioTests/AzureFirewallTests.ps1‎

Lines changed: 232 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2495,4 +2495,236 @@ function Test-AzureFirewallAutoscaleConfiguration {
24952495
# Cleanup
24962496
Clean-ResourceGroup $rgname
24972497
}
2498+
}
2499+
2500+
<#
2501+
.SYNOPSIS
2502+
Tests AzureFirewall CRUD with EdgeZone.
2503+
#>
2504+
function Test-AzureFirewallCRUDWithEdgeZone {
2505+
# Setup
2506+
$rgname = Get-ResourceGroupName
2507+
$azureFirewallName = Get-ResourceName
2508+
$resourceTypeParent = "Microsoft.Network/AzureFirewalls"
2509+
$location = Get-ProviderLocation $resourceTypeParent "eastus2euap"
2510+
2511+
$vnetName = Get-ResourceName
2512+
$subnetName = "AzureFirewallSubnet"
2513+
$publicIpName = Get-ResourceName
2514+
$edgeZone = "microsoftrrezm1"
2515+
2516+
try {
2517+
# Create the resource group
2518+
$resourceGroup = New-AzResourceGroup -Name $rgname -Location $location -Tags @{ testtag = "testval" }
2519+
2520+
# Create the Virtual Network with EdgeZone
2521+
$subnet = New-AzVirtualNetworkSubnetConfig -Name $subnetName -AddressPrefix 10.0.0.0/24
2522+
$vnet = New-AzVirtualNetwork -Name $vnetName -ResourceGroupName $rgname -Location $location -AddressPrefix 10.0.0.0/16 -Subnet $subnet -EdgeZone $edgeZone
2523+
2524+
# Create public ip with EdgeZone
2525+
$publicip = New-AzPublicIpAddress -ResourceGroupName $rgname -name $publicIpName -location $location -AllocationMethod Static -Sku Standard -EdgeZone $edgeZone
2526+
2527+
# Create AzureFirewall with EdgeZone (should have no zones)
2528+
$azureFirewall = New-AzFirewall -Name $azureFirewallName -ResourceGroupName $rgname -Location $location -VirtualNetwork $vnet -PublicIpAddress $publicip -EdgeZone $edgeZone
2529+
2530+
# Get AzureFirewall
2531+
$getAzureFirewall = Get-AzFirewall -name $azureFirewallName -ResourceGroupName $rgname
2532+
2533+
# Verification
2534+
Assert-AreEqual $rgName $getAzureFirewall.ResourceGroupName
2535+
Assert-AreEqual $azureFirewallName $getAzureFirewall.Name
2536+
Assert-NotNull $getAzureFirewall.Location
2537+
Assert-AreEqual (Normalize-Location $location) $getAzureFirewall.Location
2538+
Assert-NotNull $getAzureFirewall.Etag
2539+
Assert-AreEqual "Alert" $getAzureFirewall.ThreatIntelMode
2540+
Assert-AreEqual 1 @($getAzureFirewall.IpConfigurations).Count
2541+
Assert-NotNull $getAzureFirewall.IpConfigurations[0].Subnet.Id
2542+
Assert-NotNull $getAzureFirewall.IpConfigurations[0].PublicIpAddress.Id
2543+
Assert-NotNull $getAzureFirewall.IpConfigurations[0].PrivateIpAddress
2544+
Assert-AreEqual 0 @($getAzureFirewall.ApplicationRuleCollections).Count
2545+
Assert-AreEqual 0 @($getAzureFirewall.NatRuleCollections).Count
2546+
Assert-AreEqual 0 @($getAzureFirewall.NetworkRuleCollections).Count
2547+
2548+
# Verify EdgeZone specific behavior
2549+
Assert-NotNull $getAzureFirewall.ExtendedLocation
2550+
Assert-AreEqual $edgeZone $getAzureFirewall.ExtendedLocation.Name
2551+
Assert-AreEqual "EdgeZone" $getAzureFirewall.ExtendedLocation.Type
2552+
# Verify that zones are null when EdgeZone is specified
2553+
Assert-Null $getAzureFirewall.Zones
2554+
2555+
# Update the firewall to test modification
2556+
$azureFirewall.ThreatIntelMode = "Deny"
2557+
Set-AzFirewall -AzureFirewall $azureFirewall
2558+
2559+
# Verify the update
2560+
$getAzureFirewall = Get-AzFirewall -name $azureFirewallName -ResourceGroupName $rgname
2561+
Assert-AreEqual "Deny" $getAzureFirewall.ThreatIntelMode
2562+
# Verify EdgeZone properties are preserved
2563+
Assert-NotNull $getAzureFirewall.ExtendedLocation
2564+
Assert-AreEqual $edgeZone $getAzureFirewall.ExtendedLocation.Name
2565+
Assert-Null $getAzureFirewall.Zones
2566+
2567+
# Delete AzureFirewall
2568+
$delete = Remove-AzFirewall -ResourceGroupName $rgname -name $azureFirewallName -PassThru -Force
2569+
Assert-AreEqual true $delete
2570+
2571+
$list = Get-AzFirewall -ResourceGroupName $rgname
2572+
Assert-AreEqual 0 @($list).Count
2573+
}
2574+
finally {
2575+
# Cleanup
2576+
Clean-ResourceGroup $rgname
2577+
}
2578+
}
2579+
2580+
<#
2581+
.SYNOPSIS
2582+
Tests AzureFirewall Virtual Hub CRUD with EdgeZone.
2583+
#>
2584+
function Test-AzureFirewallVirtualHubCRUDWithEdgeZone {
2585+
# Setup
2586+
$rgname = Get-ResourceGroupName
2587+
$azureFirewallName = Get-ResourceName
2588+
$azureFirewallPolicyName = Get-ResourceName
2589+
$resourceTypeParent = "Microsoft.Network/AzureFirewalls"
2590+
$location = Get-ProviderLocation $resourceTypeParent "eastus2euap"
2591+
$skuName = "AZFW_Hub"
2592+
$skuTier = "Standard"
2593+
$edgeZone = "microsoftrrezm1"
2594+
2595+
try {
2596+
# Create the resource group
2597+
$resourceGroup = New-AzResourceGroup -Name $rgname -Location $location
2598+
2599+
# Create Firewall Policy
2600+
$azureFirewallPolicy = New-AzFirewallPolicy -ResourceGroupName $rgname -Name $azureFirewallPolicyName -Location $location
2601+
$azureFirewallPolicyId = $azureFirewallPolicy.Id
2602+
2603+
# Create Hub IP Address object
2604+
$hubIpAddresses = New-AzFirewallHubIpAddress -PublicIPCount 1
2605+
2606+
# Create AzureFirewall with EdgeZone
2607+
New-AzFirewall -Name $azureFirewallName -ResourceGroupName $rgname -Location $location -SkuName $skuName -SkuTier $skuTier -HubIPAddress $hubIpAddresses -FirewallPolicyId $azureFirewallPolicyId -EdgeZone $edgeZone
2608+
2609+
# Get AzureFirewall
2610+
$getAzureFirewall = Get-AzFirewall -name $azureFirewallName -ResourceGroupName $rgname
2611+
2612+
# Verification
2613+
Assert-AreEqual $rgName $getAzureFirewall.ResourceGroupName
2614+
Assert-AreEqual $azureFirewallName $getAzureFirewall.Name
2615+
Assert-NotNull $getAzureFirewall.Location
2616+
Assert-AreEqual (Normalize-Location $location) $getAzureFirewall.Location
2617+
Assert-AreEqual $skuName $getAzureFirewall.Sku.Name
2618+
Assert-AreEqual $skuTier $getAzureFirewall.Sku.Tier
2619+
Assert-NotNull $getAzureFirewall.Etag
2620+
2621+
# Verify EdgeZone specific behavior for Hub firewall
2622+
Assert-NotNull $getAzureFirewall.ExtendedLocation
2623+
Assert-AreEqual $edgeZone $getAzureFirewall.ExtendedLocation.Name
2624+
Assert-AreEqual "EdgeZone" $getAzureFirewall.ExtendedLocation.Type
2625+
# Verify that zones are null when EdgeZone is specified
2626+
Assert-Null $getAzureFirewall.Zones
2627+
2628+
# Verify hub-specific properties
2629+
Assert-NotNull $getAzureFirewall.HubIPAddresses
2630+
Assert-AreEqual 1 @($getAzureFirewall.HubIPAddresses.PublicIPs.Addresses).Count
2631+
2632+
# Delete AzureFirewall
2633+
$delete = Remove-AzFirewall -ResourceGroupName $rgname -name $azureFirewallName -PassThru -Force
2634+
Assert-AreEqual true $delete
2635+
2636+
$list = Get-AzFirewall -ResourceGroupName $rgname
2637+
Assert-AreEqual 0 @($list).Count
2638+
}
2639+
finally {
2640+
# Cleanup
2641+
Clean-ResourceGroup $rgname
2642+
}
2643+
}
2644+
2645+
<#
2646+
.SYNOPSIS
2647+
Tests EdgeZone and Zones validation - zones should be null when EdgeZone is specified.
2648+
#>
2649+
function Test-AzureFirewallEdgeZoneZonesValidation {
2650+
# Setup
2651+
$rgname = Get-ResourceGroupName
2652+
$azureFirewallName = Get-ResourceName
2653+
$resourceTypeParent = "Microsoft.Network/AzureFirewalls"
2654+
$location = Get-ProviderLocation $resourceTypeParent "eastus2euap"
2655+
2656+
$vnetName = Get-ResourceName
2657+
$subnetName = "AzureFirewallSubnet"
2658+
$publicIpName = Get-ResourceName
2659+
$edgeZone = "microsoftrrezm1"
2660+
2661+
try {
2662+
# Create the resource group
2663+
$resourceGroup = New-AzResourceGroup -Name $rgname -Location $location
2664+
2665+
# Create the Virtual Network with EdgeZone
2666+
$subnet = New-AzVirtualNetworkSubnetConfig -Name $subnetName -AddressPrefix 10.0.0.0/24
2667+
$vnet = New-AzVirtualNetwork -Name $vnetName -ResourceGroupName $rgname -Location $location -AddressPrefix 10.0.0.0/16 -Subnet $subnet -EdgeZone $edgeZone
2668+
2669+
# Create public ip with EdgeZone
2670+
$publicip = New-AzPublicIpAddress -ResourceGroupName $rgname -name $publicIpName -location $location -AllocationMethod Static -Sku Standard -EdgeZone $edgeZone
2671+
2672+
# Test 1: Attempt to create firewall with both EdgeZone and Zone parameters (should fail)
2673+
Assert-ThrowsLike { New-AzFirewall -Name $azureFirewallName -ResourceGroupName $rgname -Location $location -VirtualNetwork $vnet -PublicIpAddress $publicip -EdgeZone $edgeZone -Zone 1,2,3 } "*Zones cannot be specified when EdgeZone is provided*"
2674+
2675+
# Test 2: Create firewall with only EdgeZone (should succeed)
2676+
$azureFirewall = New-AzFirewall -Name $azureFirewallName -ResourceGroupName $rgname -Location $location -VirtualNetwork $vnet -PublicIpAddress $publicip -EdgeZone $edgeZone
2677+
2678+
# Get AzureFirewall
2679+
$getAzureFirewall = Get-AzFirewall -name $azureFirewallName -ResourceGroupName $rgname
2680+
2681+
# Verify EdgeZone is set and Zones is null
2682+
Assert-NotNull $getAzureFirewall.ExtendedLocation
2683+
Assert-AreEqual $edgeZone $getAzureFirewall.ExtendedLocation.Name
2684+
Assert-AreEqual "EdgeZone" $getAzureFirewall.ExtendedLocation.Type
2685+
Assert-Null $getAzureFirewall.Zones
2686+
2687+
# Delete the firewall
2688+
Remove-AzFirewall -ResourceGroupName $rgname -name $azureFirewallName -Force
2689+
2690+
# Test 3: Create firewall with only Zone parameters (no EdgeZone)
2691+
# Create new VNet and Public IP with zones for this test
2692+
$vnetName2 = Get-ResourceName
2693+
$publicIpName2 = Get-ResourceName
2694+
$subnet2 = New-AzVirtualNetworkSubnetConfig -Name $subnetName -AddressPrefix 10.1.0.0/24
2695+
$vnet2 = New-AzVirtualNetwork -Name $vnetName2 -ResourceGroupName $rgname -Location $location -AddressPrefix 10.1.0.0/16 -Subnet $subnet2
2696+
$publicip2 = New-AzPublicIpAddress -ResourceGroupName $rgname -name $publicIpName2 -location $location -AllocationMethod Static -Sku Standard -Zone 1,2,3
2697+
2698+
$azureFirewall2Name = Get-ResourceName
2699+
$azureFirewall2 = New-AzFirewall -Name $azureFirewall2Name -ResourceGroupName $rgname -Location $location -VirtualNetwork $vnet2 -PublicIpAddress $publicip2 -Zone 1,2,3
2700+
2701+
# Get AzureFirewall
2702+
$getAzureFirewall2 = Get-AzFirewall -name $azureFirewall2Name -ResourceGroupName $rgname
2703+
2704+
# Verify Zones are set and ExtendedLocation is null
2705+
Assert-AreEqual 3 @($getAzureFirewall2.Zones).Count
2706+
Assert-Null $getAzureFirewall2.ExtendedLocation
2707+
2708+
# Delete the firewall
2709+
Remove-AzFirewall -ResourceGroupName $rgname -name $azureFirewall2Name -Force
2710+
2711+
# Test 4: Create firewall with only EdgeZone (no Zone parameters)
2712+
$azureFirewall3Name = Get-ResourceName
2713+
$azureFirewall3 = New-AzFirewall -Name $azureFirewall3Name -ResourceGroupName $rgname -Location $location -VirtualNetwork $vnet -PublicIpAddress $publicip -EdgeZone $edgeZone
2714+
2715+
# Get AzureFirewall
2716+
$getAzureFirewall3 = Get-AzFirewall -name $azureFirewall3Name -ResourceGroupName $rgname
2717+
2718+
# Verify EdgeZone is set and Zones is null
2719+
Assert-NotNull $getAzureFirewall3.ExtendedLocation
2720+
Assert-AreEqual $edgeZone $getAzureFirewall3.ExtendedLocation.Name
2721+
Assert-Null $getAzureFirewall3.Zones
2722+
2723+
# Delete the firewall
2724+
Remove-AzFirewall -ResourceGroupName $rgname -name $azureFirewall3Name -Force
2725+
}
2726+
finally {
2727+
# Cleanup
2728+
Clean-ResourceGroup $rgname
2729+
}
24982730
}

‎src/Network/Network.Test/SessionRecords/Commands.Network.Test.ScenarioTests.AzureFirewallTests/TestAzureFirewallCRUDWithEdgeZone.json‎

Lines changed: 2043 additions & 0 deletions
Large diffs are not rendered by default.

‎src/Network/Network.Test/SessionRecords/Commands.Network.Test.ScenarioTests.AzureFirewallTests/TestAzureFirewallEdgeZoneZonesValidation.json‎

Lines changed: 2043 additions & 0 deletions
Large diffs are not rendered by default.

‎src/Network/Network/AzureFirewall/NewAzureFirewallCommand.cs‎

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -168,6 +168,11 @@ public class NewAzureFirewallCommand : AzureFirewallBaseCmdlet
168168
HelpMessage = "A list of availability zones denoting where the firewall needs to come from.")]
169169
public string[] Zone { get; set; }
170170

171+
[Parameter(
172+
Mandatory = false,
173+
HelpMessage = "The edge zone where the firewall needs to be deployed.")]
174+
public string EdgeZone { get; set; }
175+
171176
[Alias("Sku")]
172177
[Parameter(
173178
Mandatory = false,
@@ -286,6 +291,12 @@ private PSAzureFirewall CreateAzureFirewall()
286291
sku.Name = !string.IsNullOrEmpty(this.SkuName) ? this.SkuName : MNM.AzureFirewallSkuName.AzfwVnet;
287292
sku.Tier = !string.IsNullOrEmpty(this.SkuTier) ? this.SkuTier : MNM.AzureFirewallSkuTier.Standard;
288293

294+
// Validate that EdgeZone and Zones are not both specified
295+
if (!string.IsNullOrEmpty(this.EdgeZone) && this.Zone != null && this.Zone.Length > 0)
296+
{
297+
throw new ArgumentException("Zones cannot be specified when EdgeZone is provided. EdgeZone deployments do not support availability zones.", nameof(this.Zone));
298+
}
299+
289300
if (sku.Tier.Equals(MNM.AzureFirewallSkuTier.Basic) && !string.IsNullOrEmpty(this.Location))
290301
{
291302
if (FirewallConstants.IsRegionRestrictedForBasicFirewall(this.Location))
@@ -336,10 +347,11 @@ private PSAzureFirewall CreateAzureFirewall()
336347
VirtualHub = VirtualHubId != null ? new MNM.SubResource(VirtualHubId) : null,
337348
FirewallPolicy = FirewallPolicyId != null ? new MNM.SubResource(FirewallPolicyId) : null,
338349
HubIPAddresses = this.HubIPAddress,
339-
Zones = this.Zone == null ? null : this.Zone.ToList(),
350+
Zones = (!string.IsNullOrEmpty(this.EdgeZone)) ? null : (this.Zone == null ? null : this.Zone.ToList()),
340351
EnableFatFlowLogging = (this.EnableFatFlowLogging.IsPresent ? "True" : null),
341352
EnableDnstapLogging = (this.EnableDnstapLogging.IsPresent ? "True" : null),
342-
EnableUDPLogOptimization = (this.EnableUDPLogOptimization.IsPresent ? "True" : null)
353+
EnableUDPLogOptimization = (this.EnableUDPLogOptimization.IsPresent ? "True" : null),
354+
ExtendedLocation = (!string.IsNullOrEmpty(this.EdgeZone)) ? new PSExtendedLocation(this.EdgeZone) : null
343355
};
344356

345357
if (this.PublicIpAddress != null)
@@ -368,12 +380,13 @@ private PSAzureFirewall CreateAzureFirewall()
368380
EnableFatFlowLogging = (this.EnableFatFlowLogging.IsPresent ? "True" : null),
369381
EnableDnstapLogging = (this.EnableDnstapLogging.IsPresent ? "True" : null),
370382
EnableUDPLogOptimization = (this.EnableUDPLogOptimization.IsPresent ? "True" : null),
371-
RouteServerId = this.RouteServerId
383+
RouteServerId = this.RouteServerId,
384+
ExtendedLocation = (!string.IsNullOrEmpty(this.EdgeZone)) ? new PSExtendedLocation(this.EdgeZone) : null
372385
};
373386

374387
if (this.Zone != null)
375388
{
376-
firewall.Zones = this.Zone?.ToList();
389+
firewall.Zones = (!string.IsNullOrEmpty(this.EdgeZone)) ? null : this.Zone?.ToList();
377390
}
378391

379392
if (this.virtualNetwork != null)

‎src/Network/Network/ChangeLog.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@
1919
--->
2020

2121
## Upcoming Release
22+
* Added EdgeZone parameter support for Azure Firewall
23+
* Added `-EdgeZone` parameter to `New-AzFirewall` cmdlet
24+
* When EdgeZone is specified, zones property is automatically set to null
2225

2326
## Version 7.22.0
2427
* Added new RouteTableUsageMode property for Network Manager Routing Configuration

‎src/Network/Network/Models/AzureFirewall/PSAzureFirewall.cs‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,8 @@ public string[] PrivateRange
9393

9494
public string RouteServerId { get; set; }
9595

96+
public PSExtendedLocation ExtendedLocation { get; set; }
97+
9698
[JsonIgnore]
9799
public string IpConfigurationsText
98100
{

0 commit comments

Comments
 (0)