Skip to content

Commit 35855a2

Browse files
NiviShenkerNiviShenker
authored
Update migrate-to-policy.md
1 parent 76a2d4f commit 35855a2

File tree

1 file changed

+177
-118
lines changed

1 file changed

+177
-118
lines changed

‎articles/firewall-manager/migrate-to-policy.md

Lines changed: 177 additions & 118 deletions
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,10 @@ The beginning of the script defines the source firewall name and resource group
2525
Modify the following script to migrate your firewall configuration.
2626

2727
```azurepowershell
28-
#Input params to be modified as needed
29-
$FirewallResourceGroup = "AzFWMigrateRG"
28+
# Input params to be modified as needed
29+
$FirewallResourceGroup = "AzFWMigrateRG"
3030
$FirewallName = "azfw"
31+
$FirewallPolicyResourceGroup = "AzFWPolicyRG"
3132
$FirewallPolicyName = "fwpolicy"
3233
$FirewallPolicyLocation = "WestEurope"
3334
@@ -37,145 +38,203 @@ $DefaultNatRuleCollectionGroupName = "NatRuleCollectionGroup"
3738
$ApplicationRuleGroupPriority = 300
3839
$NetworkRuleGroupPriority = 200
3940
$NatRuleGroupPriority = 100
41+
$InvalidCharsPattern = "[']"
4042
41-
#Helper functions for translating ApplicationProtocol and ApplicationRule
43+
# Helper functions for translating ApplicationProtocol and ApplicationRule
4244
Function GetApplicationProtocolsString
4345
{
44-
Param([Object[]] $Protocols)
45-
$output = ""
46-
ForEach ($protocol in $Protocols) {
47-
$output += $protocol.ProtocolType + ":" + $protocol.Port + ","
48-
}
49-
return $output.Substring(0, $output.Length - 1)
46+
Param([Object[]] $Protocols)
47+
$output = ""
48+
ForEach ($protocol in $Protocols)
49+
{
50+
$output += $protocol.ProtocolType + ":" + $protocol.Port + ","
51+
}
52+
return $output.Substring(0, $output.Length - 1)
5053
}
51-
5254
Function GetApplicationRuleCmd
5355
{
54-
Param([Object] $ApplicationRule)
55-
56-
$cmd = "New-AzFirewallPolicyApplicationRule"
57-
$cmd = $cmd + " -Name " + $ApplicationRule.Name
58-
$cmd = $cmd + " -SourceAddress " + $ApplicationRule.SourceAddresses
59-
60-
if ($ApplicationRule.Description) {
61-
$cmd = $cmd + " -Description " + $ApplicationRule.Description
62-
}
63-
if ($ApplicationRule.TargetFqdns) {
64-
$protocols = GetApplicationProtocolsString($ApplicationRule.Protocols)
65-
$cmd = $cmd + " -Protocol " + $protocols
66-
$cmd = $cmd + " -TargetFqdn " + $ApplicationRule.TargetFqdns
67-
}
68-
if ($ApplicationRule.FqdnTags) {
69-
$cmd = $cmd + " -FqdnTag " + $ApplicationRule.FqdnTags
56+
Param([Object] $ApplicationRule)
57+
$cmd = "New-AzFirewallPolicyApplicationRule"
58+
$parsedName = ParseRuleName($ApplicationRule.Name)
59+
$cmd = $cmd + " -Name " + "'" + $parsedName + "'"
60+
if ($ApplicationRule.SourceAddresses)
61+
{
62+
$ApplicationRule.SourceAddresses = $ApplicationRule.SourceAddresses -join ","
63+
$cmd = $cmd + " -SourceAddress " + $ApplicationRule.SourceAddresses
64+
}
65+
elseif ($ApplicationRule.SourceIpGroups)
66+
{
67+
$ApplicationRule.SourceIpGroups = $ApplicationRule.SourceIpGroups -join ","
68+
$cmd = $cmd + " -SourceIpGroup " + $ApplicationRule.SourceIpGroups
69+
}
70+
if ($ApplicationRule.Description)
71+
{
72+
$cmd = $cmd + " -Description " + "'" + $ApplicationRule.Description + "'"
73+
}
74+
if ($ApplicationRule.TargetFqdns)
75+
{
76+
$protocols = GetApplicationProtocolsString($ApplicationRule.Protocols)
77+
$cmd = $cmd + " -Protocol " + $protocols
78+
$AppRule = $($ApplicationRule.TargetFqdns) -join ","
79+
$cmd = $cmd + " -TargetFqdn " + $AppRule
80+
}
81+
if ($ApplicationRule.FqdnTags)
82+
{
83+
$cmd = $cmd + " -FqdnTag " + "'" + $ApplicationRule.FqdnTags + "'"
84+
}
85+
return $cmd
86+
}
87+
Function ParseRuleName
88+
{
89+
Param([Object] $RuleName)
90+
if ($RuleName -match $InvalidCharsPattern) {
91+
$newRuleName = $RuleName -split $InvalidCharsPattern -join ""
92+
Write-Host "Rule $RuleName contains an invalid character. Invalid characters have been removed, rule new name is $newRuleName. " -ForegroundColor Yellow
93+
return $newRuleName
7094
}
71-
72-
return $cmd
95+
return $RuleName
7396
}
74-
75-
If(!(Get-AzResourceGroup -Name $FirewallResourceGroup))
97+
If (!(Get-AzResourceGroup -Name $FirewallPolicyResourceGroup))
7698
{
77-
New-AzResourceGroup -Name $FirewallResourceGroup -Location $FirewallPolicyLocation
99+
New-AzResourceGroup -Name $FirewallPolicyResourceGroup -Location $FirewallPolicyLocation
78100
}
79-
80101
$azfw = Get-AzFirewall -Name $FirewallName -ResourceGroupName $FirewallResourceGroup
81102
Write-Host "creating empty firewall policy"
82-
$fwp = New-AzFirewallPolicy -Name $FirewallPolicyName -ResourceGroupName $FirewallResourceGroup -Location $FirewallPolicyLocation -ThreatIntelMode $azfw.ThreatIntelMode
103+
if ($azfw.DNSEnableProxy) {
104+
$fwDnsSetting = New-AzFirewallPolicyDnsSetting -EnableProxy
105+
$fwp = New-AzFirewallPolicy -Name $FirewallPolicyName -ResourceGroupName $FirewallPolicyResourceGroup -Location $FirewallPolicyLocation -ThreatIntelMode $azfw.ThreatIntelMode -DnsSetting $fwDnsSetting -Force
106+
}
107+
else {
108+
$fwp = New-AzFirewallPolicy -Name $FirewallPolicyName -ResourceGroupName $FirewallPolicyResourceGroup -Location $FirewallPolicyLocation -ThreatIntelMode $azfw.ThreatIntelMode
109+
}
83110
Write-Host $fwp.Name "created"
84-
Write-Host "creating " $azfw.ApplicationRuleCollections.Count " application rule collections"
85111
86-
#Translate ApplicationRuleCollection
87-
If ($azfw.ApplicationRuleCollections.Count -gt 0) {
88-
$firewallPolicyAppRuleCollections = @()
89-
ForEach ($appRc in $azfw.ApplicationRuleCollections) {
90-
If ($appRc.Rules.Count -gt 0) {
91-
Write-Host "creating " $appRc.Rules.Count " application rules for collection " $appRc.Name
92-
$firewallPolicyAppRules = @()
93-
ForEach ($appRule in $appRc.Rules) {
94-
$cmd = GetApplicationRuleCmd($appRule)
95-
$firewallPolicyAppRule = Invoke-Expression $cmd
96-
Write-Host "Created appRule " $firewallPolicyAppRule.Name
97-
$firewallPolicyAppRules += $firewallPolicyAppRule
98-
}
99-
$fwpAppRuleCollection = New-AzFirewallPolicyFilterRuleCollection -Name $appRC.Name -Priority $appRC.Priority -ActionType $appRC.Action.Type -Rule $firewallPolicyAppRules
100-
Write-Host "Created appRuleCollection " $fwpAppRuleCollection.Name
101-
}
102-
$firewallPolicyAppRuleCollections += $fwpAppRuleCollection
103-
}
104-
$appRuleGroup = New-AzFirewallPolicyRuleCollectionGroup -Name $DefaultAppRuleCollectionGroupName -Priority $ApplicationRuleGroupPriority -RuleCollection $firewallPolicyAppRuleCollections -FirewallPolicyObject $fwp
105-
Write-Host "Created ApplicationRuleCollectionGroup " $appRuleGroup.Name
112+
# Translate ApplicationRuleCollection
113+
Write-Host "creating " $azfw.ApplicationRuleCollections.Count " application rule collections"
114+
If ($azfw.ApplicationRuleCollections.Count -gt 0)
115+
{
116+
$firewallPolicyAppRuleCollections = @()
117+
ForEach ($appRc in $azfw.ApplicationRuleCollections)
118+
{
119+
If ($appRc.Rules.Count -gt 0)
120+
{
121+
Write-Host "creating " $appRc.Rules.Count " application rules for collection " $appRc.Name
122+
$firewallPolicyAppRules = @()
123+
ForEach ($appRule in $appRc.Rules)
124+
{
125+
$cmd = GetApplicationRuleCmd($appRule)
126+
$firewallPolicyAppRule = Invoke-Expression $cmd
127+
Write-Host "Created Application Rule: " $firewallPolicyAppRule.Name
128+
$firewallPolicyAppRules += $firewallPolicyAppRule
129+
}
130+
$fwpAppRuleCollection = New-AzFirewallPolicyFilterRuleCollection -Name $appRC.Name -Priority $appRC.Priority -ActionType $appRC.Action.Type -Rule $firewallPolicyAppRules
131+
Write-Host "Created Application Rule Collection: " $fwpAppRuleCollection.Name
132+
}
133+
$firewallPolicyAppRuleCollections += $fwpAppRuleCollection
134+
}
135+
$appRuleGroup = New-AzFirewallPolicyRuleCollectionGroup -Name $DefaultAppRuleCollectionGroupName -Priority $ApplicationRuleGroupPriority -RuleCollection $firewallPolicyAppRuleCollections -FirewallPolicyObject $fwp
136+
Write-Host "Created Application Rule Collection Group: " $appRuleGroup.Name
106137
}
107138
108-
#Translate NetworkRuleCollection
139+
# Translate NetworkRuleCollection
109140
Write-Host "creating " $azfw.NetworkRuleCollections.Count " network rule collections"
110-
If ($azfw.NetworkRuleCollections.Count -gt 0) {
111-
$firewallPolicyNetRuleCollections = @()
112-
ForEach ($rc in $azfw.NetworkRuleCollections) {
113-
If ($rc.Rules.Count -gt 0) {
114-
Write-Host "creating " $rc.Rules.Count " network rules for collection " $rc.Name
115-
$firewallPolicyNetRules = @()
116-
ForEach ($rule in $rc.Rules) {
117-
If($rule.SourceAddresses){
118-
If($rule.DestinationAddresses)
119-
{
120-
$firewallPolicyNetRule = New-AzFirewallPolicyNetworkRule -Name $rule.Name -SourceAddress $rule.SourceAddresses -DestinationAddress $rule.DestinationAddresses -DestinationPort $rule.DestinationPorts -Protocol $rule.Protocols
121-
}
122-
elseif($rule.DestinationIpGroups)
123-
{
124-
$firewallPolicyNetRule = New-AzFirewallPolicyNetworkRule -Name $rule.Name -SourceAddress $rule.SourceAddresses -DestinationIpGroup $rule.DestinationIpGroups -DestinationPort $rule.DestinationPorts -Protocol $rule.Protocols
125-
}
126-
}
127-
elseif($rule.SourceIpGroups){
128-
If($rule.DestinationAddresses)
129-
{
130-
$firewallPolicyNetRule = New-AzFirewallPolicyNetworkRule -Name $rule.Name -SourceIpGroup $rule.SourceIpGroups -DestinationAddress $rule.DestinationAddresses -DestinationPort $rule.DestinationPorts -Protocol $rule.Protocols
131-
}
132-
elseif($rule.DestinationIpGroups)
133-
{
134-
$firewallPolicyNetRule = New-AzFirewallPolicyNetworkRule -Name $rule.Name -SourceIpGroup $rule.SourceIpGroups -DestinationIpGroup $rule.DestinationIpGroups -DestinationPort $rule.DestinationPorts -Protocol $rule.Protocols
135-
}
136-
}
137-
Write-Host "Created network rule " $firewallPolicyNetRule.Name
138-
$firewallPolicyNetRules += $firewallPolicyNetRule
139-
}
140-
$fwpNetRuleCollection = New-AzFirewallPolicyFilterRuleCollection -Name $rc.Name -Priority $rc.Priority -ActionType $rc.Action.Type -Rule $firewallPolicyNetRules
141-
Write-Host "Created NetworkRuleCollection " $fwpNetRuleCollection.Name
142-
}
143-
$firewallPolicyNetRuleCollections += $fwpNetRuleCollection
144-
}
145-
$netRuleGroup = New-AzFirewallPolicyRuleCollectionGroup -Name $DefaultNetRuleCollectionGroupName -Priority $NetworkRuleGroupPriority -RuleCollection $firewallPolicyNetRuleCollections -FirewallPolicyObject $fwp
146-
Write-Host "Created NetworkRuleCollectionGroup " $netRuleGroup.Name
141+
If ($azfw.NetworkRuleCollections.Count -gt 0)
142+
{
143+
$firewallPolicyNetRuleCollections = @()
144+
ForEach ($rc in $azfw.NetworkRuleCollections)
145+
{
146+
If ($rc.Rules.Count -gt 0)
147+
{
148+
Write-Host "creating " $rc.Rules.Count " network rules for collection " $rc.Name
149+
$firewallPolicyNetRules = @()
150+
ForEach ($rule in $rc.Rules)
151+
{
152+
$parsedName = ParseRuleName($rule.Name)
153+
If ($rule.SourceAddresses)
154+
{
155+
If ($rule.DestinationAddresses)
156+
{
157+
$firewallPolicyNetRule = New-AzFirewallPolicyNetworkRule -Name $parsedName -SourceAddress $rule.SourceAddresses -DestinationAddress $rule.DestinationAddresses -DestinationPort $rule.DestinationPorts -Protocol $rule.Protocols
158+
}
159+
elseif ($rule.DestinationIpGroups)
160+
{
161+
$firewallPolicyNetRule = New-AzFirewallPolicyNetworkRule -Name $parsedName -SourceAddress $rule.SourceAddresses -DestinationIpGroup $rule.DestinationIpGroups -DestinationPort $rule.DestinationPorts -Protocol $rule.Protocols
162+
}
163+
elseif ($rule.DestinationFqdns)
164+
{
165+
$firewallPolicyNetRule = New-AzFirewallPolicyNetworkRule -Name $parsedName -SourceAddress $rule.SourceAddresses -DestinationFqdn $rule.DestinationFqdns -DestinationPort $rule.DestinationPorts -Protocol $rule.Protocols
166+
}
167+
}
168+
elseif ($rule.SourceIpGroups)
169+
{
170+
If ($rule.DestinationAddresses)
171+
{
172+
$firewallPolicyNetRule = New-AzFirewallPolicyNetworkRule -Name $parsedName -SourceIpGroup $rule.SourceIpGroups -DestinationAddress $rule.DestinationAddresses -DestinationPort $rule.DestinationPorts -Protocol $rule.Protocols
173+
}
174+
elseif ($rule.DestinationIpGroups)
175+
{
176+
$firewallPolicyNetRule = New-AzFirewallPolicyNetworkRule -Name $parsedName -SourceIpGroup $rule.SourceIpGroups -DestinationIpGroup $rule.DestinationIpGroups -DestinationPort $rule.DestinationPorts -Protocol $rule.Protocols
177+
}
178+
elseif ($rule.DestinationFqdns)
179+
{
180+
$firewallPolicyNetRule = New-AzFirewallPolicyNetworkRule -Name $parsedName -SourceIpGroup $rule.SourceIpGroups -DestinationFqdn $rule.DestinationFqdns -DestinationPort $rule.DestinationPorts -Protocol $rule.Protocols
181+
}
182+
}
183+
Write-Host "Created network rule: " $firewallPolicyNetRule.Name
184+
$firewallPolicyNetRules += $firewallPolicyNetRule
185+
}
186+
$fwpNetRuleCollection = New-AzFirewallPolicyFilterRuleCollection -Name $rc.Name -Priority $rc.Priority -ActionType $rc.Action.Type -Rule $firewallPolicyNetRules
187+
Write-Host "Created Network Rule Collection: " $fwpNetRuleCollection.Name
188+
}
189+
$firewallPolicyNetRuleCollections += $fwpNetRuleCollection
190+
}
191+
$netRuleGroup = New-AzFirewallPolicyRuleCollectionGroup -Name $DefaultNetRuleCollectionGroupName -Priority $NetworkRuleGroupPriority -RuleCollection $firewallPolicyNetRuleCollections -FirewallPolicyObject $fwp
192+
Write-Host "Created Network Rule Collection Group: " $netRuleGroup.Name
147193
}
148194
149-
#Translate NatRuleCollection
195+
# Translate NatRuleCollection
150196
# Hierarchy for NAT rule collection is different for AZFW and FirewallPolicy. In AZFW you can have a NatRuleCollection with multiple NatRules
151-
# where each NatRule will have its own set of source , dest, translated IPs and ports.
152-
# In FirewallPolicy a NatRuleCollection has a a set of rules which has one condition (source and dest IPs and Ports) and the translated IP and ports
197+
# where each NatRule will have its own set of source , dest, translated IPs and ports.
198+
# In FirewallPolicy a NatRuleCollection has a set of rules which has one condition (source and dest IPs and Ports) and the translated IP and ports
153199
# as part of NatRuleCollection.
154200
# So when translating NAT rules we will have to create separate ruleCollection for each rule in AZFW and every ruleCollection will have only 1 rule.
155-
156-
Write-Host "creating " $azfw.NatRuleCollections.Count " network rule collections"
157-
If ($azfw.NatRuleCollections.Count -gt 0) {
158-
$firewallPolicyNatRuleCollections = @()
159-
$priority = 100
160-
ForEach ($rc in $azfw.NatRuleCollections) {
161-
$firewallPolicyNatRules = @()
162-
If ($rc.Rules.Count -gt 0) {
163-
Write-Host "creating " $rc.Rules.Count " nat rules for collection " $rc.Name
164-
ForEach ($rule in $rc.Rules) {
165-
$firewallPolicyNatRule = New-AzFirewallPolicyNatRule -Name $rule.Name -SourceAddress $rule.SourceAddresses -TranslatedAddress $rule.TranslatedAddress -TranslatedPort $rule.TranslatedPort -DestinationAddress $rule.DestinationAddresses -DestinationPort $rule.DestinationPorts -Protocol $rule.Protocols
166-
Write-Host "Created nat rule " $firewallPolicyNatRule.Name
167-
$firewallPolicyNatRules += $firewallPolicyNatRule
168-
}
169-
$natRuleCollectionName = $rc.Name+$rule.Name
170-
$fwpNatRuleCollection = New-AzFirewallPolicyNatRuleCollection -Name $natRuleCollectionName -Priority $priority -ActionType $rc.Action.Type -Rule $firewallPolicyNatRules
171-
$priority += 1
172-
Write-Host "Created NatRuleCollection " $fwpNatRuleCollection.Name
173-
$firewallPolicyNatRuleCollections += $fwpNatRuleCollection
174-
}
175-
}
176-
$natRuleGroup = New-AzFirewallPolicyRuleCollectionGroup -Name $DefaultNatRuleCollectionGroupName -Priority $NatRuleGroupPriority -RuleCollection $firewallPolicyNatRuleCollections -FirewallPolicyObject $fwp
177-
Write-Host "Created NatRuleCollectionGroup " $natRuleGroup.Name
201+
Write-Host "creating " $azfw.NatRuleCollections.Count " NAT rule collections"
202+
If ($azfw.NatRuleCollections.Count -gt 0)
203+
{
204+
$firewallPolicyNatRuleCollections = @()
205+
$priority = 100
206+
ForEach ($rc in $azfw.NatRuleCollections)
207+
{
208+
$firewallPolicyNatRules = @()
209+
If ($rc.Rules.Count -gt 0)
210+
{
211+
Write-Host "creating " $rc.Rules.Count " nat rules for collection " $rc.Name
212+
ForEach ($rule in $rc.Rules)
213+
{
214+
$parsedName = ParseRuleName($rule.Name)
215+
If ($rule.SourceAddresses)
216+
{
217+
$firewallPolicyNatRule = New-AzFirewallPolicyNatRule -Name $parsedName -SourceIpGroup $rule.SourceAddresses -TranslatedAddress $rule.TranslatedAddress -TranslatedPort $rule.TranslatedPort -DestinationAddress $rule.DestinationAddresses -DestinationPort $rule.DestinationPorts -Protocol $rule.Protocols
218+
}
219+
elseif ($rule.SourceIpGroups)
220+
{
221+
$firewallPolicyNatRule = New-AzFirewallPolicyNatRule -Name $parsedName -SourceIpGroup $rule.SourceIpGroups -TranslatedAddress $rule.TranslatedAddress -TranslatedPort $rule.TranslatedPort -DestinationAddress $rule.DestinationAddresses -DestinationPort $rule.DestinationPorts -Protocol $rule.Protocols
222+
}
223+
Write-Host "Created NAT rule: " $firewallPolicyNatRule.Name
224+
$firewallPolicyNatRules += $firewallPolicyNatRule
225+
}
226+
227+
$natRuleCollectionName = $rc.Name
228+
$fwpNatRuleCollection = New-AzFirewallPolicyNatRuleCollection -Name $natRuleCollectionName -Priority $priority -ActionType $rc.Action.Type -Rule $firewallPolicyNatRules
229+
$priority += 1
230+
Write-Host "Created NAT Rule Collection: " $fwpNatRuleCollection.Name
231+
$firewallPolicyNatRuleCollections += $fwpNatRuleCollection
232+
}
233+
}
234+
$natRuleCollectionGroup = New-AzFirewallPolicyRuleCollectionGroup -Name $DefaultNatRuleCollectionGroupName -Priority $NatRuleGroupPriority -RuleCollection $firewallPolicyNatRuleCollections -FirewallPolicyObject $fwp
235+
Write-Host "Created NAT Rule Collection Group: " $natRuleCollectionGroup.Name
178236
}
237+
179238
```
180239
## Next steps
181240

0 commit comments

Comments
 (0)