Skip to content

Commit 52467c1

Browse files
schaffererinschaffererin
committed
Creating new Bicep quickstart article - Firewall Manager
1 parent 140a4ad commit 52467c1

File tree

3 files changed

+132
-0
lines changed

3 files changed

+132
-0
lines changed

‎articles/azure-resource-manager/bicep/toc.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -147,6 +147,8 @@
147147
href: ../../dns/dns-get-started-bicep.md?toc=/azure/azure-resource-manager/bicep/toc.json
148148
- name: ExpressRoute
149149
href: ../../expressroute/quickstart-create-expressroute-vnet-bicep.md?toc=/azure/azure-resource-manager/bicep/toc.json
150+
- name: Firewall Manager
151+
href: ../../firewall-manager/quick-secure-virtual-hub-bicep.md?toc=/azure/azure-resource-manager/bicep/toc.json
150152
- name: Front Door
151153
href: ../../frontdoor/quickstart-create-front-door-bicep.md?toc=/azure/azure-resource-manager/bicep/toc.json
152154
- name: Load Balancer - internal

‎articles/firewall-manager/quick-secure-virtual-hub-bicep.md

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
---
2+
title: 'Quickstart: Secure virtual hub using Azure Firewall Manager - Bicep'
3+
description: In this quickstart, you learn how to secure your virtual hub using Azure Firewall Manager and Bicep.
4+
services: firewall-manager
5+
author: schaffererin
6+
ms.author: v-eschaffer
7+
ms.date: 06/28/2022
8+
ms.topic: quickstart
9+
ms.service: firewall-manager
10+
ms.custom: devx-track-azurepowershell, subject-armqs, mode-arm
11+
---
12+
13+
# Quickstart: Secure your virtual hub using Azure Firewall Manager - Bicep
14+
15+
In this quickstart, you use Bicep to secure your virtual hub using Azure Firewall Manager. The deployed firewall has an application rule that allows connections to `www.microsoft.com` . Two Windows Server 2019 virtual machines are deployed to test the firewall. One jump server is used to connect to the workload server. From the workload server, you can only connect to `www.microsoft.com`.
16+
17+
[!INCLUDE [About Bicep](../../includes/resource-manager-quickstart-bicep-introduction.md)]
18+
19+
For more information about Azure Firewall Manager, see [What is Azure Firewall Manager?](overview.md).
20+
21+
## Prerequisites
22+
23+
- An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
24+
25+
## Review the Bicep file
26+
27+
This Bicep file creates a secured virtual hub using Azure Firewall Manager, along with the necessary resources to support the scenario.
28+
29+
The Bicep file used in this quickstart is from [Azure Quickstart Templates](https://azure.microsoft.com/resources/templates/fwm-docs-qs/).
30+
31+
:::code language="bicep" source="~/quickstart-templates/quickstarts/microsoft.network/fwm-docs-qs/main.bicep":::
32+
33+
Multiple Azure resources are defined in the Bicep file:
34+
35+
- [**Microsoft.Network/virtualWans**](/azure/templates/microsoft.network/virtualWans)
36+
- [**Microsoft.Network/virtualHubs**](/azure/templates/microsoft.network/virtualHubs)
37+
- [**Microsoft.Network/firewallPolicies**](/azure/templates/microsoft.network/firewallPolicies)
38+
- [**Microsoft.Network/azureFirewalls**](/azure/templates/microsoft.network/azureFirewalls)
39+
- [**Microsoft.Network/virtualNetworks**](/azure/templates/microsoft.network/virtualnetworks)
40+
- [**Microsoft.Compute/virtualMachines**](/azure/templates/microsoft.compute/virtualmachines)
41+
- [**Microsoft.Storage/storageAccounts**](/azure/templates/microsoft.storage/storageAccounts)
42+
- [**Microsoft.Network/networkInterfaces**](/azure/templates/microsoft.network/networkinterfaces)
43+
- [**Microsoft.Network/networkSecurityGroups**](/azure/templates/microsoft.network/networksecuritygroups)
44+
- [**Microsoft.Network/publicIPAddresses**](/azure/templates/microsoft.network/publicipaddresses)
45+
- [**Microsoft.Network/routeTables**](/azure/templates/microsoft.network/routeTables)
46+
47+
## Deploy the Bicep file
48+
49+
1. Save the Bicep file as `main.bicep` to your local computer.
50+
1. Deploy the Bicep file using either Azure CLI or Azure PowerShell.
51+
52+
# [CLI](#tab/CLI)
53+
54+
```azurecli
55+
az group create --name exampleRG --location eastus
56+
az deployment group create --resource-group exampleRG --template-file main.bicep --parameters adminUsername=<admin-user>
57+
```
58+
59+
# [PowerShell](#tab/PowerShell)
60+
61+
```azurepowershell
62+
New-AzResourceGroup -Name exampleRG -Location eastus
63+
New-AzResourceGroupDeployment -ResourceGroupName exampleRG -TemplateFile ./main.bicep -adminUsername "<admin-user>"
64+
```
65+
66+
---
67+
68+
> [!NOTE]
69+
> Replace **\<admin-user\>** with the administrator login username for the servers. You'll be prompted to enter **adminPassword**.
70+
71+
When the deployment finishes, you should see a message indicating the deployment succeeded.
72+
73+
## Validate the deployment
74+
75+
Use Azure CLI or Azure PowerShell to review the deployed resources.
76+
77+
# [CLI](#tab/CLI)
78+
79+
```azurecli-interactive
80+
az resource list --resource-group exampleRG
81+
```
82+
83+
# [PowerShell](#tab/PowerShell)
84+
85+
```azurepowershell-interactive
86+
Get-AzResource -ResourceGroupName exampleRG
87+
```
88+
89+
---
90+
91+
Now, test the firewall rules to confirm that it works as expected.
92+
93+
1. From the Azure portal, review the network settings for the **Workload-Srv** virtual machine and note the private IP address.
94+
2. Connect a remote desktop to **Jump-Srv** virtual machine, and sign in. From there, open a remote desktop connection to the **Workload-Srv** private IP address.
95+
3. Open Internet Explorer and browse to `www.microsoft.com`.
96+
4. Select **OK** > **Close** on the Internet Explorer security alerts.
97+
98+
You should see the Microsoft home page.
99+
100+
5. Browse to `www.google.com`.
101+
102+
You should be blocked by the firewall.
103+
104+
Now you've verified that the firewall rules are working, you can browse to the one allowed FQDN, but not to any others.
105+
106+
## Clean up resources
107+
108+
When you no longer need the resources that you created with the firewall, use Azure portal, Azure CLI, or Azure PowerShell to delete the resource group. This removes the firewall and all the related resources.
109+
110+
# [CLI](#tab/CLI)
111+
112+
```azurecli-interactive
113+
az group delete --name exampleRG
114+
```
115+
116+
# [PowerShell](#tab/PowerShell)
117+
118+
```azurepowershell-interactive
119+
Remove-AzResourceGroup -Name exampleRG
120+
```
121+
122+
---
123+
124+
## Next steps
125+
126+
> [!div class="nextstepaction"]
127+
> [Learn about security partner providers](trusted-security-partners.md)

‎articles/firewall-manager/toc.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@
77
- name: Quickstarts
88
expanded: true
99
items:
10+
- name: Secure virtual hub - Bicep
11+
displayName: Resource Manager, ARM, Template
12+
href: quick-secure-virtual-hub-bicep.md
1013
- name: Secure virtual hub - ARM template
1114
displayName: Resource Manager
1215
href: quick-secure-virtual-hub.md

0 commit comments

Comments
 (0)