Skip to content

Commit 807a4ba

Browse files
v-shilsv-shils
authored
Merge pull request #281718 from anaharris-ms/relocate-firewall
Relocation: Firewall
2 parents d520c49 + ff28b74 commit 807a4ba

File tree

4 files changed

+265
-0
lines changed

4 files changed

+265
-0
lines changed

‎articles/firewall/toc.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -183,6 +183,10 @@ items:
183183
href: premium-migrate.md
184184
- name: Migrate to Premium using Terraform
185185
href: /azure/developer/terraform/firewall-upgrade-premium?toc=/azure/firewall/toc.json&bc=/azure/firewall/breadcrumb/toc.json
186+
- name: Relocate
187+
items:
188+
- name: Relocate to another region
189+
href: ../operational-excellence/relocation-firewall.md?toc=/azure/firewall/toc.json&bc=/azure/firewall/breadcrumb/toc.json
186190
- name: Monitor
187191
items:
188192
- name: Monitor diagnostic logs

‎articles/operational-excellence/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,8 @@
5454
href: ../mysql/howto-move-regions-portal.md?toc=/azure/operational-excellence/toc.json
5555
- name: Azure Database for PostgreSQL
5656
href: relocation-postgresql-flexible-server.md
57+
- name: Azure Firewall
58+
href: relocation-firewall.md
5759
- name: Azure Event Grid
5860
items:
5961
- name: Relocate Azure Event Grid domains

‎articles/operational-excellence/overview-relocation.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,7 @@ The following tables provide links to each Azure service relocation document. Th
6868
[Azure Event Grid domains](relocation-event-grid-domains.md)| ✅ | ❌| ❌ |
6969
[Azure Event Grid custom topics](relocation-event-grid-custom-topics.md)| ✅ | ❌| ❌ |
7070
[Azure Event Grid system topics](relocation-event-grid-system-topics.md)| ✅ | ❌| ❌ |
71+
[Azure Firewall](./relocation-firewall.md)|❌ | ✅| ❌ |
7172
[Azure Functions](../azure-functions/functions-move-across-regions.md?toc=/azure/operational-excellence/toc.json)|✅ |❌ | ❌ |
7273
[Azure Logic apps](../logic-apps/move-logic-app-resources.md?toc=/azure/operational-excellence/toc.json)| ✅| ❌ | ❌ |
7374
[Azure Monitor - Log Analytics](./relocation-log-analytics.md)| ✅| ❌ | ❌ |

‎articles/operational-excellence/relocation-firewall.md

Lines changed: 258 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,258 @@
1+
---
2+
title: Relocation guidance for Azure Firewall
3+
description: Learn how to relocate Azure Firewall to a new region
4+
author: anaharris-ms
5+
ms.author: anaharris
6+
ms.reviewer: anaharris
7+
ms.date: 07/23/2024
8+
ms.service: firewall
9+
ms.topic: how-to
10+
ms.custom:
11+
- subject-relocation
12+
---
13+
14+
15+
# Relocate Azure Firewall to another region
16+
17+
This article shows you how to relocate an Azure Firewall that protects an Azure Virtual Network.
18+
19+
20+
## Prerequisites
21+
22+
- We highly recommend that you use Premium SKU. If you are on Standard SKU, consider [migrating from an existing Standard SKU Azure Firewall to Premium SKU](/azure/firewall-manager/migrate-to-policy) before you being relocation.
23+
24+
- The following information must be collected in order to properly plan and execute an Azure Firewall relocation:
25+
26+
- **Deployment model.** *Classic Firewall Rules* or *Firewall policy*.
27+
- **Firewall policy name.** (If *Firewall policy* deployment model is used).
28+
- **Diagnostic setting at the firewall instance level.** (If Log Analytics workspace is used).
29+
- **TLS (Transport Layer Security) Inspection configuration.**: (If Azure Key Vault, Certificate and Managed Identity is used.)
30+
- **Public IP control.** Assess that any external identity relying on Azure Firewall public IP remains fixed and trusted.
31+
32+
33+
- Azure Firewall Standard and Premium tiers have the following dependencies that you may need to be deploy in the target region:
34+
35+
- [Azure Virtual Network](./relocation-virtual-network.md)
36+
- (If used) [Log Analytics Workspace](./relocation-log-analytics.md)
37+
38+
39+
- If you're using the TLS Inspection feature of Azure Firewall Premium tier, the following dependencies also need to be deployed in the target region:
40+
41+
- [Azure Key Vault](./relocation-key-vault.md)
42+
- [Azure Managed Identity](./relocation-managed-identity.md)
43+
44+
45+
## Downtime
46+
47+
To understand the possible downtimes involved, see [Cloud Adoption Framework for Azure: Select a relocation method](/azure/cloud-adoption-framework/relocate/select#select-a-relocation-method).
48+
49+
50+
## Prepare
51+
52+
To prepare for relocation, you need to first export and modify the template from the source region. To view a sample ARM template for Azure Firewall, see [review the template](../firewall-manager/quick-firewall-policy.md#review-the-template).
53+
54+
### Export template
55+
56+
57+
# [portal](#tab/azure-portal)
58+
59+
1. Sign in to the [Azure portal](https://portal.azure.com).
60+
2. Select **All resources** and then select your Azure Firewall resource.
61+
3. On the **Azure Firewall** page, select **Export template** under **Automation** in the left menu.
62+
4. Choose **Download** in the **Export template** page.
63+
64+
5. Locate the .zip file that you downloaded from the portal, and unzip that file to a folder of your choice.
65+
66+
This zip file contains the .json files that include the template and scripts to deploy the template.
67+
68+
69+
# [PowerShell](#tab/azure-powershell)
70+
71+
1. Sign in to your Azure subscription with the `Connect-AzAccount` command and follow the on-screen directions:
72+
73+
```azurecli
74+
75+
Connect-AzAccount
76+
```
77+
78+
2. If your identity is associated with more than one subscription, then set your active subscription to subscription of the Azure Firewall resource that you want to move.
79+
80+
```azurepowershell
81+
82+
$context = Get-AzSubscription -SubscriptionId <subscription-id>
83+
Set-AzContext $context
84+
85+
```
86+
87+
3. Export the template of your source Azure Firewall resource by running the following commands:
88+
89+
```azurepowershell
90+
91+
$resource = Get-AzResource `
92+
-ResourceGroupName <resource-group-name> `
93+
-ResourceName <resource-name> `
94+
-ResourceType <resource-type>
95+
96+
Export-AzResourceGroup `
97+
-ResourceGroupName <resource-group-name> `
98+
-Resource $resource.ResourceId
99+
100+
```
101+
102+
4. Locate the `template.json` in your current directory.
103+
104+
105+
---
106+
107+
### Modify template
108+
109+
In this section, you learn how to modify the template that you generated in the previous section.
110+
111+
If you're running classic firewall rules without Firewall policy, migrate to Firewall policy before preceding with the steps in this section. To learn how to migrate from classic firewall rules to Firewall policy, see [Migrate Azure Firewall configuration to Azure Firewall policy using PowerShell](/azure/firewall-manager/migrate-to-policy).
112+
113+
114+
# [Azure portal](#tab/azure-portal)
115+
116+
1. Sign in to the [Azure portal](https://portal.azure.com).
117+
118+
1. If you're using Premium SKU with TLS Inspection enabled,
119+
1. [Relocate the key vault](./relocation-key-vault.md) that's used for TLS inspection into the new target region. Then, follow [the procedures](../application-gateway/key-vault-certs.md) to move certificates or generate new certificates for TLS inspection into the new key vault in the target region.
120+
1. [Relocate managed identity](./relocation-managed-identity.md) into the new target region. Reassign the corresponding roles for the key vault in the target region and subscription.
121+
122+
1. In the Azure portal, select **Create a resource**.
123+
124+
1. In **Search the Marketplace**, type `template deployment`, and then press **Enter**.
125+
126+
1. Select **Template deployment** and the select **Create**.
127+
128+
1. Select **Build your own template in the editor**.
129+
130+
1. Select **Load file**, and then follow the instructions to load the `template.json` file that you downloaded in the previous section
131+
132+
1. In the `template.json` file, replace:
133+
- `firewallName` with the default value of your Azure Firewall name.
134+
- `azureFirewallPublicIpId` with the ID of your public IP address in the target region.
135+
- `virtualNetworkName` with the name of the virtual network in the target region.
136+
- `firewallPolicy.id` with your policy ID.
137+
138+
1. [Create a new firewall policy](/azure/firewall-manager/create-policy-powershell) using the configuration of the source region and reflect changes introduced by the new target region (IP Address Ranges, Public IP, Rule Collections).
139+
140+
1. If you're using Premium SKU and you want to enable TLS Inspection, update the newly created firewall policy and enable TLS inspection by following [the instructions here](https://techcommunity.microsoft.com/t5/azure-network-security-blog/building-a-poc-for-tls-inspection-in-azure-firewall/ba-p/3676723).
141+
142+
1. Review and update the configuration for the topics below to reflect the changes required for the target region.
143+
- **IP Groups.** To include IP addresses from the target region, if different from the source, *IP Groups* should be reviewed. The IP addresses included in the groups must be modified.
144+
- **Zones.** Configure the [availability Zones (AZ)](../reliability/availability-zones-overview.md) in the target region.
145+
- **Forced Tunneling.** [Ensure that you've relcoated the virtual network](./relocation-virtual-network.md) and that the firewall *Management Subnet* is present before the Azure Firewall is relocated. Update the IP Address in the target region of the Network Virtual Appliance (NVA) to which the Azure Firewall should redirect the traffic, in the User Defined Route (UDR).
146+
- **DNS.** Review IP Addresses for your custom custom *DNS Servers* to reflect your target region. If the *DNS Proxy* feature is enabled, be sure to configure your virtual network DNS server settings and set the Azure Firewall’s private IP address as a *Custom DNS server*.
147+
- **Private IP ranges (SNAT).** - If custom ranges are defined for SNAT, it's recommended that you review and eventually adjust to include the target region address space.
148+
- **Tags.** - Verify and eventually update any tag that may reflect or refer to the new firewall location.
149+
- **Diagnostic Settings.** When recreating the Azure Firewall in the target region, be sure to review the *Diagnostic Setting* adn configure it to reflect the target region (Log Analytics workspace, storage account, Event Hub, or 3rd-party partner solution).
150+
151+
1. Edit the `location` property in the `template.json` file to the target region (The following example sets the target region to `centralus`.):
152+
153+
```json
154+
"resources": [
155+
{
156+
"type": "Microsoft.Network/azureFirewalls",
157+
"apiVersion": "2023-09-01",
158+
"name": "[parameters('azureFirewalls_fw_name')]",
159+
"location": "centralus",}]
160+
```
161+
162+
To find the location code for your target region, see [Data residency in Azure](https://azure.microsoft.com/explore/global-infrastructure/data-residency/#overview).
163+
164+
1. Save the `template.json` file.
165+
166+
# [PowerShell](#tab/azure-powershell)
167+
168+
169+
170+
1. Sign in to the [Azure portal](https://portal.azure.com).
171+
172+
1. If you're using Premium SKU with TLS Inspection enabled,
173+
1. [Relocate the key vault](./relocation-key-vault.md) used for TLS inspection into the new target region and follow the procedures to move certificates or generate new certificates for TLS inspection in the new key vault in the target region.
174+
1. [Relocate managed identity](./relocation-managed-identity.md) into the new target region and reassign the corresponding roles for the key vault in the target region and subscription.
175+
176+
177+
1. In the `template.json` file, replace:
178+
- `firewallName` with the default value of your Azure Firewall name.
179+
- `azureFirewallPublicIpId` with the ID of your public IP address in the target region.
180+
- `virtualNetworkName` with the name of the virtual network in the target region.
181+
- `firewallPolicy.id` with your policy ID.
182+
183+
1. [Create a new firewall policy](/azure/firewall-manager/create-policy-powershell) using the configuration of the source region and reflect changes introduced by the new target region (IP Address Ranges, Public IP, Rule Collections).
184+
185+
1. Review and update the configuration for the topics below to reflect the changes required for the target region.
186+
- **IP Groups.** To include IP addresses from the target region, if different from the source, *IP Groups* should be reviewed. The IP addresses included in the groups must be modified.
187+
- **Zones.** Configure the [availability Zones (AZ)](../reliability/availability-zones-overview.md) in the target region.
188+
- **Forced Tunneling.** [Ensure that you've relcoated the virtual network](./relocation-virtual-network.md) and that the firewall *Management Subnet* is present before the Azure Firewall is relocated. Update the IP Address in the target region of the Network Virtual Appliance (NVA) to which the Azure Firewall should redirect the traffic, in the User Defined Route (UDR).
189+
- **DNS.** Review IP Addresses for your custom custom *DNS Servers* to reflect your target region. If the *DNS Proxy* feature is enabled, be sure to configure your virtual network DNS server settings and set the Azure Firewall’s private IP address as a *Custom DNS server*.
190+
- **Private IP ranges (SNAT).** - If custom ranges are defined for SNAT, it's recommended that you review and eventually adjust to include the target region address space.
191+
- **Tags.** - Verify and eventually update any tag that may reflect or refer to the new firewall location.
192+
- **Diagnostic Settings.** When recreating the Azure Firewall in the target region, be sure to review the *Diagnostic Setting* adn configure it to reflect the target region (Log Analytics workspace, storage account, Event Hub, or 3rd-party partner solution).
193+
194+
1. Edit the `location` property in the `template.json` file to the target region (The following example sets the target region to `centralus`.):
195+
196+
```json
197+
"resources": [
198+
{
199+
"type": "Microsoft.Network/azureFirewalls",
200+
"apiVersion": "2023-09-01",
201+
"name": "[parameters('azureFirewalls_fw_name')]",
202+
"location": "centralus",}]
203+
```
204+
205+
To find the location code for your target region, see [Data residency in Azure](https://azure.microsoft.com/explore/global-infrastructure/data-residency/#overview).
206+
207+
---
208+
209+
210+
## Redeploy
211+
212+
Deploy the template to create a new Azure Firewall in the target region.
213+
214+
215+
# [Azure portal](#tab/azure-portal)
216+
217+
1. Enter or select the property values:
218+
219+
- Subscription: Select an Azure subscription.
220+
221+
- Resource group: Select Create new and give the resource group a name.
222+
223+
- Location: Select an Azure location.
224+
225+
1. The Azure Firewall is now deployed with the adopted configuration to reflect the needed changes in the target region.
226+
1. Verify configuration and functionality.
227+
228+
229+
# [PowerShell](#tab/azure-powershell)
230+
231+
1. Obtain the subscription ID where you want to deploy the target public IP by running the following command:
232+
233+
```azurepowershell
234+
235+
Get-AzSubscription
236+
237+
```
238+
239+
2. Run the following commands to deploy your template:
240+
241+
```azurepowershell
242+
243+
$resourceGroupName = Read-Host -Prompt "Enter the Resource Group name"
244+
$location = Read-Host -Prompt "Enter the location (i.e. eastus)"
245+
246+
New-AzResourceGroup -Name $resourceGroupName -Location "$location"
247+
New-AzResourceGroupDeployment -ResourceGroupName $resourceGroupName -TemplateUri "<name of your local template file>"
248+
249+
1. The Azure Firewall is now deployed with the adopted configuration to reflect the needed changes in the target region.
250+
1. Verify configuration and functionality.
251+
252+
253+
```
254+
255+
## Related content
256+
257+
- [Move resources to a new resource group or subscription](../azure-resource-manager/management/move-resource-group-and-subscription.md)
258+
- [Move Azure VMs to another region](../site-recovery/azure-to-azure-tutorial-migrate.md)

0 commit comments

Comments
 (0)