Skip to content

Commit cae98ea

Browse files
ZarrVenkatZarrVenkat
committed
review draft
1 parent 7a07df1 commit cae98ea

File tree

3 files changed

+130
-75
lines changed

3 files changed

+130
-75
lines changed

‎articles/firewall/draft-deploy.md

Lines changed: 130 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -1,135 +1,190 @@
11
---
2-
title: Azure Firewall features
3-
description: Learn about Azure Firewall feature draft and deployment
2+
title: Azure Firewall Draft + Deployment (preview)
3+
decription: Learn how to use Azure Firewall's Draft and Deployment feature to make and apply bulk updates to your firewall policies efficiently. This article provides step-by-step guidance on creating, updating, and deploying drafts, along with supported scenarios and limitations.
44
services: firewall
55
author: vekannan
66
ms.service: azure-firewall
77
ms.topic: concept-article
8-
ms.date: 04/22/2025
8+
ms.date: 05/05/2025
99
ms.author: duau
1010
---
1111

12-
# Azure Firewall Draft + Deployment (Preview)
12+
# Azure Firewall Draft + Deployment (preview)
1313

14-
Organizations are required to make frequent changes to their Firewall Policy for several reasons: onboarding a new application or workload, patching security issue, or for maintenance and optimizing their policy by merging rules or deleting unused rules. These updates can be performed by multiple people, while each update can take up to a few minutes to be deployed.
15-
With Azure Firewall Policy Save & Commit, you can now update your policy in a 2-phased approach:
14+
Organizations often need to update their Azure Firewall Policy for various reasons, such as onboarding new applications or workloads, addressing security vulnerabilities, performing maintenance, or optimizing policies by merging or removing unused rules. These updates may involve multiple contributors, and each change can take several minutes to deploy.
1615

17-
* Draft: Make as many changes as needed, by one or more people, which will be saved in a temporary policy draft (which is cloned from your current applied policy). These changes are extremely fast to make.
16+
[!IMPORTANT]
17+
> **Azure Firewall Draft + Deployment** is currently in PREVIEW.
18+
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
1819
19-
* Deployment: Apply the changes altogether by deploying the draft version and make it your current applied policy.
20+
With Azure Firewall Policy Draft + Deployment, you can streamline this process using a two-phase approach:
2021

21-
In this article, you learn how to:
22+
* **Draft**: Make multiple changes collaboratively, saved in a temporary draft policy cloned from your current applied policy. These changes don't affect the live policy.
2223

23-
> [!div class="checklist"]
24-
> * Create a draft
25-
> * Update a draft
26-
> * Deploy a draft
24+
* **Deployment**: Apply all changes at once by deploying the draft, replacing the current applied policy with the updated version.
2725

28-
## Prerequisites
26+
## Supported scenarios and limitations
27+
28+
The Draft and Deployment feature is designed for specific use cases and has certain constraints:
29+
30+
### Supported scenarios
31+
32+
- This feature is exclusively available for Azure Firewall Policies. It does not support firewalls configured with classic rules.
2933

30-
If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
34+
### Limitations
3135

32-
If you want to use this feature via CLI, then make sure azure-firewall extenstion version is above [1.2.3](https://github.com/Azure/azure-cli-extensions/releases/tag/azure-firewall-1.2.3)
36+
- A draft is created as a clone of the currently applied policy. Any changes made to the applied policy after the draft's creation will not be reflected in the draft unless manually updated.
37+
- Deploying a draft replaces the entire applied policy. Any modifications made to the applied policy after the draft's creation will be lost unless they are included in the draft.
38+
- Creating a new Rule Collection Group (RCG) is not supported directly within a policy draft.
39+
- Only one draft can exist for a policy at any given time.
40+
41+
## Prerequisites
42+
43+
- If you don't have an Azure subscription, you can create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) to get started.
44+
- To use this feature with the Azure CLI, ensure that you have the Azure Firewall extension installed and updated to version [1.2.3 or later](https://github.com/Azure/azure-cli-extensions/releases/tag/azure-firewall-1.2.3).
3345

3446
## Use Draft + Deployment
3547

36-
Azure Firewall's draft + deployment feature allows you to make bulk updates to your firewall policy, before applying them to production.
48+
Azure Firewall Draft + Deployment allows you to make bulk updates to your firewall policy before applying them to production.
49+
50+
# [Portal](#tab/portal)
3751

38-
1. In the Azure portal, navigate to your existing firewall policies or create a new one.
39-
1. On the Azure Firewall Policy blade, under **Management** section click **Draft & Deployment**, then select **Create a new draft.** This creates a draft that is an exact copy of your current applied policy.
52+
1. In the Azure portal, navigate to your existing firewall policy or create a new one.
4053

41-
1. On the draft page, make changes or additions to your rules or settings. These pages are identical to the ones in the deployed draft. These changes will only take effect when you deploy the draft.
42-
:::image type="content" source="media/draft-deploy/drafting changes.png" alt-text="screenshot of drafting changes":::
54+
1. On the **Azure Firewall Policy** blade, under the **Management** section, select **Draft & Deployment**, then select **Create a new draft**. This creates a draft that is an exact copy of your current applied policy.
4355

44-
1. To verify the changes, return to the **deploy** screen and see the rules or setting changes. To deploy, select **deploy draft**. Once deployed, the draft replaces the current policy and becomes the latest version. The draft itself is deleted after the deployment.
56+
1. On the draft page, make changes or additions to your rules or settings. These pages are identical to those in the deployed policy. The changes will only take effect when you deploy the draft.
4557

46-
:::image type="content" source="media/draft-deploy/verify and deploy changes.png" alt-text="screenshot of check changes and deploy":::
58+
:::image type="content" source="media/draft-deploy/drafting changes.png" alt-text="Screenshot showing drafting changes.":::
4759

48-
1. Repeat the process as needed to make further updates to the firewall policy.
60+
1. To verify the changes, return to the **Deploy** screen to review the updated rules or settings. To apply the changes, select **Deploy draft**. Once deployed, the draft replaces the current policy and becomes the latest version. The draft is deleted after deployment.
61+
62+
:::image type="content" source="media/draft-deploy/verify and deploy changes.png" alt-text="Screenshot showing verification and deployment of changes.":::
63+
64+
1. Repeat this process as needed to make further updates to your firewall policy.
4965

5066
> [!NOTE]
51-
> When using this feature via PowerShell or API, you must first download the current policy and manually create a draft based on it. In contrast, when using the Azure portal or CLI, creating a draft automatically generates it from the existing policy.
67+
> When using this feature through Azure PowerShell or Azure REST API, you must first download the current policy and manually create a draft based on it. In contrast, using the Azure portal or CLI automatically generates a draft from the existing policy.
5268
5369
# [CLI](#tab/CLI)
54-
```azurecli-interactive
5570

56-
az login
71+
1. Run the [az login](/cli/azure/authenticate-azure-cli) command to log in to your Azure account:
72+
73+
```azurecli-interactive
74+
az login
75+
```
76+
77+
1. Create a draft using [az network firewall policy draft create](/cli/azure/network/firewall/policy/draft/create) command. This command creates a draft of the current applied policy. You can use the `--policy-name` and `--resource-group` parameters to specify the name and resource group of your firewall policy:
78+
79+
```azurecli-interactive
80+
az network firewall policy draft create --policy-name fw-policy --resource-group test-rg
81+
```
82+
83+
1. Update the settings using [az network firewall policy draft update](/cli/azure/network/firewall/policy/draft/update) command. You can use the `--threat-intel-mode` and `--idps-mode` parameters to specify the threat intelligence mode and IDPS mode for the draft:
84+
85+
```azurecli-interactive
86+
az network firewall policy draft update --policy-name fw-policy --resource-group test-rg --threat-intel-mode Off --idps-mode Deny
87+
```
5788
58-
Create a draft:
59-
az network firewall policy draft create --policy-name fw-policy --resource-group test-rg
89+
1. Update Draft Rules
6090
61-
Update draft (settings):
62-
az network firewall policy draft update --policy-name fw-policy --resource-group test-rg --threat-intel-mode Off --idps-mode Deny
91+
- Create a New Rule Collection Group (RCG) using [az network firewall policy rule-collection-group draft create](/cli/azure/network/firewall/policy/rule-collection-group/draft/create) command:
6392
64-
Update draft (rules):
93+
```azurecli-interactive
94+
az network firewall policy rule-collection-group draft create --rule-collection-group-name rcg-b --policy-name fw-policy --resource-group test-rg --priority 303
95+
```
6596
66-
Create a new RCG in draft:
67-
az network firewall policy rule-collection-group draft create –rule-collection-group-name rcg-b –policy-name fw-policy –resource-group test-rg –priority 303
97+
- Add a NAT Rule Collection to an Existing RCG in the Draft
6898
69-
Update a RCG in draft:
70-
az network firewall policy rule-collection-group draft collection add-nat-collection -n nat_collection_1 --collection-priority 10003 --policy-name fw-policy -g test-rg --rule-collection-group-name rcg-c --action DNAT --rule-name network_rule_21 --description "test" --destination-addresses "202.120.36.15" --source-addresses "202.120.36.13" "202.120.36.14" --translated-address 128.1.1.1 --translated-port 1234 --destination-ports 12000 12001 --ip-protocols TCP UDP
99+
```azurecli-interactive
100+
az network firewall policy rule-collection-group draft collection add-nat-collection \
101+
--name nat_collection_1 \
102+
--collection-priority 10003 \
103+
--policy-name fw-policy \
104+
--resource-group test-rg \
105+
--rule-collection-group-name rcg-c \
106+
--action DNAT \
107+
--rule-name network_rule_21 \
108+
--description "test" \
109+
--destination-addresses "202.120.36.15" \
110+
--source-addresses "202.120.36.13" "202.120.36.14" \
111+
--translated-address 128.1.1.1 \
112+
--translated-port 1234 \
113+
--destination-ports 12000 12001 \
114+
--ip-protocols TCP UDP
115+
```
71116
72-
See the Draft:
73-
az network firewall policy draft show --policy-name fw-policy --resource-group test-rg
117+
1. View the details of the draft using [az network firewall policy draft show](/cli/azure/network/firewall/policy/draft/show) command:
74118
75-
Deploy Draft:
76-
az network firewall policy deploy --name fw-policy --resource-group test-rg
119+
```azurecli-interactive
120+
az network firewall policy draft show --policy-name fw-policy --resource-group test-rg
121+
```
77122
78-
Discard Draft:
79-
az network firewall policy draft delete --policy-name fw-policy --resource-group test-rg
123+
1. Deploy the draft to apply the changes using [az network firewall policy deploy](/cli/azure/network/firewall/policy/deploy) command:
80124
81-
```
125+
```azurecli-interactive
126+
az network firewall policy deploy --name fw-policy --resource-group test-rg
127+
```
128+
129+
1. Discard the draft if you no longer need it using [az network firewall policy draft delete](/cli/azure/network/firewall/policy/draft/delete) command:
130+
131+
```azurecli-interactive
132+
az network firewall policy draft delete --policy-name fw-policy --resource-group test-rg
133+
```
82134
83135
# [PowerShell](#tab/powershell)
84-
85-
```azurepowershell-interactive
86136
87-
Create a draft:
88-
New-AzFirewallPolicyDraft -AzureFirewallPolicyName fw-policy -ResourceGroupName test-rg
89137
90-
Update draft (settings):
91-
Set-AzFirewallPolicyDraft -AzureFirewallPolicyName fw-policy -ResourceGroupName test-rg -ThreatIntelWhitelist $threatIntelWhitelist
138+
1. Use the [New-AzFirewallPolicyDraft](/powershell/module/az.network/new-azfirewallpolicydraft) cmdlet to create a draft of the current applied policy. Specify the policy name and resource group:
92139
93-
Update draft (rules):
94-
Create a new RCG in draft:
95-
New-AzFirewallPolicyRuleCollectionGroupDraft -AzureFirewallPolicyRuleCollectionGroupName rcg-a -ResourceGroupName test-rg -AzureFirewallPolicyName fw-policy -Priority 200
140+
```powershell-interactive
141+
New-AzFirewallPolicyDraft -AzureFirewallPolicyName fw-policy -ResourceGroupName test-rg
142+
```
96143
97-
Update a RCG in draft:
144+
1. Use the [Set-AzFirewallPolicyDraft](/powershell/module/az.network/set-azfirewallpolicydraft) cmdlet to update the settings in the draft. For example, you can update the threat intelligence mode and IDPS mode:
145+
146+
```powershell-interactive
147+
Set-AzFirewallPolicyDraft -AzureFirewallPolicyName fw-policy -ResourceGroupName test-rg -ThreatIntelWhitelist $threatIntelWhitelist
148+
```
149+
150+
1. Update draft rules:
151+
- Use the [New-AzFirewallPolicyRuleCollectionGroupDraft](/powershell/module/az.network/new-azfirewallpolicyrulecollectiongroupdraft) cmdlet to create a new rule collection group (RCG) in the draft. Specify the RCG name, resource group, and policy name:
152+
153+
```powershell-interactive
154+
New-AzFirewallPolicyRuleCollectionGroupDraft -AzureFirewallPolicyRuleCollectionGroupName rcg-a -ResourceGroupName test-rg -AzureFirewallPolicyName fw-policy -Priority 200
155+
```
156+
- Use the [Set-AzFirewallPolicyRuleCollectionGroupDraft](/powershell/module/az.network/set-azfirewallpolicyrulecollectiongroupdraft) cmdlet to add a NAT rule collection to an existing RCG in the draft:
157+
158+
```powershell-interactive
98159
$rule1 = New-AzFirewallPolicyApplicationRule -Name "Allow-HTTP" -Protocol "Http:80" -SourceAddress "10.0.0.0/24" -TargetFqdn www.example.com
99160
100161
$rule2 = New-AzFirewallPolicyApplicationRule -Name "Allow-HTTPS-2" -Protocol "Https:443" -SourceAddress "10.0.0.0/24" -TargetFqdn "www.secureexample.com"
101162
102163
$ruleCollection = New-AzFirewallPolicyFilterRuleCollection -Name "Allow-Rules" -Priority 100 -Rule $rule1, $rule2 -ActionType Allow
103164
104165
Set-AzFirewallPolicyRuleCollectionGroupDraft -AzureFirewallPolicyRuleCollectionGroupName rcg-b -ResourceGroupName test-rg -AzureFirewallPolicyName fw-policy -Priority 400 -RuleCollection $ruleCollection
166+
```
105167
106-
See the draft:
107-
Get-AzFirewallPolicyDraft -AzureFirewallPolicyName fw-policy -ResourceGroupName test-rg
108-
109-
Deploy the draft:
110-
Deploy-AzFirewallPolicy -Name fw-policy -ResourceGroupName test-rg
168+
1. Use the [Get-AzFirewallPolicyDraft](/powershell/module/az.network/get-azfirewallpolicydraft) cmdlet to view the details of the draft:
111169
112-
Discard draft:
113-
Remove-AzFirewallPolicyDraft -AzureFirewallPolicyName fw-policy -ResourceGroupName test-rg
170+
```powershell-interactive
171+
Get-AzFirewallPolicyDraft -AzureFirewallPolicyName fw-policy -ResourceGroupName test-rg
172+
```
114173
115-
```
116-
117-
---
174+
1. Use the [Deploy-AzFirewallPolicy](/powershell/module/az.network/deploy-azfirewallpolicy) cmdlet to apply the changes in the draft to the live policy:
175+
176+
```powershell-interactive
177+
Deploy-AzFirewallPolicy -Name fw-policy -ResourceGroupName test-rg
178+
```
118179
180+
1. If you want to discard the draft without applying the changes, use the [Remove-AzFirewallPolicyDraft](/powershell/module/az.network/remove-azfirewallpolicydraft) cmdlet:
119181
120-
### Draft and Deploy: Supported Scenarios and Limitations
182+
```powershell-interactive
183+
Remove-AzFirewallPolicyDraft -AzureFirewallPolicyName fw-policy -ResourceGroupName test-rg
184+
```
121185
122-
The Draft and Deploy functionality is supported in specific scenarios and comes with the following limitations:
123-
124-
#### Supported Scenarios
125-
- This feature is available only for Azure Firewall Policies. It does not support firewalls using classic rules.
126-
127-
#### Limitations
128-
- A new draft is created as a clone of the currently applied policy. Any changes made to the applied policy after the draft is created will not automatically reflect in the draft unless manually replicated.
129-
- Deploying a draft replaces the entire applied policy. Any updates made to the applied policy after the draft's creation will be overridden unless included in the draft.
130-
- Creating a Rule Collection Group is not supported within a policy draft.
131-
- Only one draft can exist per policy at any given time.
186+
---
132187
133-
## Next Steps
188+
## Next steps
134189
> [!div class="nextstepaction"]
135190
> [Deploy and configure Azure Firewall Premium](premium-deploy.md)

‎articles/firewall/media/draft-deploy/drafting changes.png

5.26 KB
Loading

‎articles/firewall/media/draft-deploy/verify and deploy changes.png

-8.85 KB
Loading

0 commit comments

Comments
 (0)