Skip to content

Commit 1b80b07

Browse files
ShannonLeavittShannonLeavitt
authored
Merge pull request #202042 from schaffererin/waf-bicep-quickstart
Creating new Bicep quickstart - Web Application Firewall
2 parents 5235b87 + 740eb61 commit 1b80b07

File tree

4 files changed

+134
-0
lines changed

4 files changed

+134
-0
lines changed

‎articles/application-gateway/media/application-gateway-create-gateway-bicep/app-gateway-ip-address-bicep.png

34.5 KB
Loading

‎articles/azure-resource-manager/bicep/toc.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,8 @@
153153
href: ../../private-link/create-private-link-service-bicep.md?toc=/azure/azure-resource-manager/bicep/toc.json
154154
- name: Traffic Manager
155155
href: ../../traffic-manager/quickstart-create-traffic-manager-profile-bicep.md?toc=/azure/azure-resource-manager/bicep/toc.json
156+
- name: Web Application Firewall
157+
href: ../../web-application-firewall/ag/quick-create-bicep.md?toc=/azure/azure-resource-manager/bicep/toc.json
156158
- name: Security
157159
items:
158160
- name: Attestation

‎articles/web-application-firewall/ag/quick-create-bicep.md

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
---
2+
title: 'Quickstart: Create an Azure WAF v2 on Application Gateway - Bicep'
3+
titleSuffix: Azure Application Gateway
4+
description: Learn how to use Bicep to create a Web Application Firewall v2 on Azure Application Gateway.
5+
services: web-application-firewall
6+
author: schaffererin
7+
ms.service: web-application-firewall
8+
ms.topic: quickstart
9+
ms.date: 06/22/2022
10+
ms.author: v-eschaffer
11+
ms.custom: subject-armqs, devx-track-azurepowershell, mode-arm
12+
---
13+
14+
# Quickstart: Create an Azure WAF v2 on Application Gateway using Bicep
15+
16+
In this quickstart, you use Bicep to create an Azure Web Application Firewall v2 on Application Gateway.
17+
18+
[!INCLUDE [About Bicep](../../../includes/resource-manager-quickstart-bicep-introduction.md)]
19+
20+
[!INCLUDE [updated-for-az](../../../includes/updated-for-az.md)]
21+
22+
## Prerequisites
23+
24+
- An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
25+
26+
## Review the Bicep file
27+
28+
This Bicep file creates a simple Web Application Firewall v2 on Azure Application Gateway. This includes a public IP frontend IP address, HTTP settings, a rule with a basic listener on port 80, and a backend pool. The file also creates a WAF policy with a custom rule to block traffic to the backend pool based on an IP address match type.
29+
30+
The Bicep file used in this quickstart is from [Azure Quickstart Templates](https://azure.microsoft.com/resources/templates/ag-docs-wafv2/).
31+
32+
:::code language="bicep" source="~/quickstart-templates/demos/ag-docs-wafv2/main.bicep":::
33+
34+
Multiple Azure resources are defined in the Bicep file:
35+
36+
- [**Microsoft.Network/applicationgateways**](/azure/templates/microsoft.network/applicationgateways)
37+
- [**Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies**](/azure/templates/microsoft.network/ApplicationGatewayWebApplicationFirewallPolicies)
38+
- [**Microsoft.Network/publicIPAddresses**](/azure/templates/microsoft.network/publicipaddresses) : one for the application gateway, and two for the virtual machines.
39+
- [**Microsoft.Network/networkSecurityGroups**](/azure/templates/microsoft.network/networksecuritygroups)
40+
- [**Microsoft.Network/virtualNetworks**](/azure/templates/microsoft.network/virtualnetworks)
41+
- [**Microsoft.Compute/virtualMachines**](/azure/templates/microsoft.compute/virtualmachines) : two virtual machines
42+
- [**Microsoft.Network/networkInterfaces**](/azure/templates/microsoft.network/networkinterfaces) : two for the virtual machines
43+
- [**Microsoft.Compute/virtualMachine/extensions**](/azure/templates/microsoft.compute/virtualmachines/extensions) : to configure IIS and the web pages
44+
45+
## Deploy the Bicep file
46+
47+
1. Save the Bicep file as **main.bicep** to your local computer.
48+
1. Deploy the Bicep file using either Azure CLI or Azure PowerShell.
49+
50+
# [CLI](#tab/CLI)
51+
52+
```azurecli
53+
az group create --name exampleRG --location eastus
54+
az deployment group create --resource-group exampleRG --template-file main.bicep --parameters adminUsername=<admin-user>
55+
```
56+
57+
# [PowerShell](#tab/PowerShell)
58+
59+
```azurepowershell
60+
New-AzResourceGroup -Name exampleRG -Location eastus
61+
New-AzResourceGroupDeployment -ResourceGroupName exampleRG -TemplateFile ./main.bicep -adminUsername "<admin-user>"
62+
```
63+
64+
---
65+
66+
> [!NOTE]
67+
> You'll be prompted to enter **adminPassword**, which is the password for the admin account on the backend servers. The password must be between 8-123 characters long and must contain at least three of the following: an uppercase character, a lowercase character, a numeric digit, or a special character.
68+
69+
When the deployment finishes, you should see a message indicating the deployment succeeded. The deployment can take 10 minutes or longer to complete.
70+
71+
## Validate the deployment
72+
73+
Although IIS isn't required to create the application gateway, it's installed on the backend servers to verify if Azure successfully created a WAF v2 on the application gateway.
74+
75+
Use IIS to test the application gateway:
76+
77+
1. Find the public IP address for the application gateway on its **Overview** page.![Record application gateway public IP address](../../application-gateway/media/application-gateway-create-gateway-bicep/app-gateway-ip-address-bicep.png)
78+
2. Copy the public IP address, and then paste it into the address bar of your browser to browse that IP address.
79+
3. Check the response. A **403 Forbidden** response verifies that the WAF was successfully created and is blocking connections to the backend pool.
80+
4. Change the custom rule to **Allow traffic** using Azure PowerShell.
81+
82+
```azurepowershell
83+
84+
$rgName = "exampleRG"
85+
$appGWName = "myAppGateway"
86+
$fwPolicyName = "WafPol01"
87+
88+
# Pull the existing Azure resources
89+
90+
$appGW = Get-AzApplicationGateway -Name $appGWName -ResourceGroupName $rgName
91+
$pol = Get-AzApplicationGatewayFirewallPolicy -Name $fwPolicyName -ResourceGroupName $rgName
92+
93+
# Update the resources
94+
95+
$pol[0].CustomRules[0].Action = "allow"
96+
$appGW.FirewallPolicy = $pol
97+
98+
# Push your changes to Azure
99+
100+
Set-AzApplicationGatewayFirewallPolicy -Name $fwPolicyName -ResourceGroupName $rgName -CustomRule $pol.CustomRules
101+
Set-AzApplicationGateway -ApplicationGateway $appGW
102+
```
103+
104+
---
105+
106+
Refresh your browser multiple times and you should see connections to both myVM1 and myVM2.
107+
108+
## Clean up resources
109+
110+
When you no longer need the resources that you created with the application gateway, use the Azure portal, Azure CLI, or Azure PowerShell to delete the resource group. This removes the application gateway and all the related resources.
111+
112+
# [CLI](#tab/CLI)
113+
114+
```azurecli-interactive
115+
az group delete --name exampleRG
116+
```
117+
118+
# [PowerShell](#tab/PowerShell)
119+
120+
```azurepowershell-interactive
121+
Remove-AzResourceGroup -Name exampleRG
122+
```
123+
124+
---
125+
126+
## Next steps
127+
128+
> [!div class="nextstepaction"]
129+
> [Tutorial: Create an application gateway with a Web Application Firewall using the Azure portal](application-gateway-web-application-firewall-portal.md)

‎articles/web-application-firewall/toc.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,9 @@
2424
- name: Application Gateway
2525
expanded: true
2626
items:
27+
- name: Deploy WAF v2 - Bicep
28+
displayName: ARM, Template, Resource Manager
29+
href: ./ag/quick-create-bicep.md
2730
- name: Deploy WAF v2 - ARM template
2831
displayName: Resource Manager
2932
href: ./ag/quick-create-template.md

0 commit comments

Comments
 (0)