Firewall creation is failing while creating through terraform.

Hello @Naveen Vanamadi ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you are trying to deploy an Azure Firewall using Terraform but it is failing with an InternalServerError message.

• May I know in which region you are trying to deploy the Azure Firewall?
• Have you tried deploying the Azure Firewall using any other tools such as Azure portal/PowerShell/CLI in the same region? If yes, was it successfull?
• Could you please share the Terraform script that you are using to deploy the Azure Firewall?

Regards,

Gita

Hi @GitaraniSharma-MSFT ,

below is my response.

version.tf:
--------------------------------------
terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "<=3.91.0"
    }
    vault = {
      source  = "hashicorp/vault"
      version = "<=3.10.0"
    }
  }
  required_version = ">= 1.3.0"
}
resource.tf
-------------------------------
resource "azurerm_firewall" "firewall" {
  name                = local.fw_name
  resource_group_name = local.rg_name
  location            = local.location
  sku_name            = var.fw_sku_name
  sku_tier            = var.fw_sku_tier
  firewall_policy_id  = var.fw_firewall_policy_id != null ? var.fw_firewall_policy_id : azurerm_firewall_policy.firewall_policy.id

  dynamic "ip_configuration" {
    for_each = var.fw_ip_configuration != null ? [var.fw_ip_configuration] : []
    content {
      name                 = lookup(ip_configuration.value, "name", null)
      subnet_id            = lookup(ip_configuration.value, "subnet_id", null)
      public_ip_address_id = lookup(ip_configuration.value, "public_ip_address_id", null)
    }
  }

  dns_servers = var.fw_dns_servers

  dynamic "management_ip_configuration" {
    for_each = var.fw_management_ip_configuration != null ? [var.fw_management_ip_configuration] : []
    content {
      name                 = lookup(management_ip_configuration.value, "name", null)
      subnet_id            = lookup(management_ip_configuration.value, "subnet_id", null)
      public_ip_address_id = lookup(management_ip_configuration.value, "public_ip_address_id", null)
    }
  }

  threat_intel_mode = var.fw_threat_intel_mode

  dynamic "virtual_hub" {
    for_each = var.fw_virtual_hub != null ? [var.fw_virtual_hub] : []
    content {
      virtual_hub_id  = lookup(var.virtual_hub, "virtual_hub_id", null)
      public_ip_count = lookup(var.virtual_hub, "public_ip_count", null)
    }
  }

  zones      = var.fw_zones
  tags       = var.fw_tags
  depends_on = [azurerm_public_ip.public_ip, azurerm_subnet.subnet, azurerm_firewall_policy.firewall_policy]
}

variables.tf:
----------------------------
variable "fw_sku_name" {
  type        = string
  description = "(Optional) Sku name of the Firewall. Possible values are AZFW_Hub and AZFW_VNet. Changing this forces a new resource to be created."
  default     = "AZFW_VNet"
}

variable "fw_sku_tier" {
  type        = string
  description = "(Optional) Sku tier of the Firewall. Possible values are Premium and Standard. Changing this forces a new resource to be created."
  default     = "Standard"
}

variable "fw_firewall_policy_id" {
  type        = string
  description = "(Optional) The ID of the Firewall Policy applied to this Firewall."
  default     = null
}

variable "fw_ip_configuration" {
  type = object({
    name                 = string # (Required) Specifies the name of the IP Configuration.
    subnet_id            = string # (Optional) Reference to the subnet associated with the IP Configuration.
    public_ip_address_id = string # (Optional) The ID of the Public IP Address associated with the firewall.
  })
  description = "(Optional) An ip_configuration block as documented below."
  default     = null
}

variable "fw_dns_servers" {
  type        = list(string)
  description = "(Optional) A list of DNS servers that the Azure Firewall will direct DNS traffic to the for name resolution."
  default     = null
}

variable "fw_management_ip_configuration" {
  type = object({
    name                 = string # (Required) Specifies the name of the IP Configuration.
    subnet_id            = string # (Required) Reference to the subnet associated with the IP Configuration. Changing this forces a new resource to be created.
    public_ip_address_id = string # (Required) The ID of the Public IP Address associated with the firewall.
  })
  description = "(Optional) A management_ip_configuration block as documented below, which allows force-tunnelling of traffic to be performed by the firewall. Adding or removing this block or changing the subnet_id in an existing block forces a new resource to be created."
  default     = null
}

variable "fw_threat_intel_mode" {
  type        = string
  description = "(Optional) The operation mode for threat intelligence-based filtering. Possible values are: Off, Alert,Deny and (empty string). Defaults to Alert."
  default     = null
}

variable "fw_virtual_hub" {
  type = object({
    virtual_hub_id  = string # (Required) Specifies the ID of the Virtual Hub where the Firewall resides in.
    public_ip_count = number # (Optional) Specifies the number of public IPs to assign to the Firewall. Defaults to 1.
  })
  description = "(Optional) A virtual_hub block as documented below."
  default     = null
}

variable "fw_zones" {
  type        = list(string)
  description = "(Optional) Specifies the availability zones in which the Azure Firewall should be created. Changing this forces a new resource to be created."
  default     = null
}

variable "fw_tags" {
  type        = map(string)
  description = "(Optional) A mapping of tags to assign to the resource."
  default     = {}
}

locals.tf:
----------------------
locals {
  rg_name                                              = "network-rg"
  location                                             = "eastus2"
  tags                                                 = {}
  vnet_name                                            = "lz-vnet"
  vnet_address_space                                   = ["10.0.0.0/16"]
  subnet_name                                          = "GatewaySubnet"
  subnet_address_prefixes                              = ["10.0.0.0/24"]
  subnet_private_endpoint_network_policies_enabled     = false
  subnet_private_link_service_network_policies_enabled = false
  pip_name                                             = "lz-pip"
  vnet_gateway_name                                    = "lz-vnet-gateway"
  fw_policy_name                                       = "lz-firewall-policy"
  fw_name                                              = "lz-firewall"
  vnet_peering_name                                    = "lz-vnet-peering"
  wan_name                                             = "lz-wan"
  vhub_name                                            = "lz_vhub"
  vhub_address_prefix                                  = "10.3.0.0/23"
  express_route_gateway_name                           = "lz-exp-route-gw"
  vpn_gateway_name                                     = "lz-vpn-gateway"
  virtual_hub_connection_name                          = "lz-vhub-conn"
  create_ddos                                          = false
  network_ddos_name                                    = "lz-ddos"
  dns_zone_name                                        = "matildacloudtest.com"
  private_dns_zone_name                                = "matildacloudprivate.com"
  private_dns_zone_virtual_network_link_name           = "lz-vnet-link"
}

Tfvars file:
----------------------------------------
  "fw_ip_configuration": {
        "name": "testfirewall",
        "subnet_id": "/subscriptions/9a932bb4-2ec3-45b9-87f9-8f7409b7830f/resourceGroups/network-rg/providers/Microsoft.Network/virtualNetworks/lz-vnet/subnets/AzureFirewallSubnet",
        "public_ip_address_id": "/subscriptions/9a932bb4-2ec3-45b9-87f9-8f7409b7830f/resourceGroups/TerraformTestingRG/providers/Microsoft.Network/publicIPAddresses/firewall-pip1"
    },
    "fw_management_ip_configuration": {
        "name": "firewallmanagement",
        "subnet_id": "/subscriptions/9a932bb4-2ec3-45b9-87f9-8f7409b7830f/resourceGroups/network-rg/providers/Microsoft.Network/virtualNetworks/lz-vnet/subnets/AzureFirewallManagementSubnet",
        "public_ip_address_id": "/subscriptions/9a932bb4-2ec3-45b9-87f9-8f7409b7830f/resourceGroups/TerraformTestingRG/providers/Microsoft.Network/publicIPAddresses/firewall-pip"
    },

• May I know in which region you are trying to deploy the Azure Firewall? - EastUs2
• Have you tried deploying the Azure Firewall using any other tools such as Azure portal/PowerShell/CLI in the same region? If yes, was it successfull? - Yes, I'm able to create through portal to same region.
• Could you please share the Terraform script that you are using to deploy the Azure Firewall? Yes

Also to elaborate more on this issue, I was combined all network related resources into one module and deploying them through terraform. Only Firewall creation is causing the issue and rest everything deployed successfully. I tried adding the configuration files in .zip format unfortunately the site not supporting the format hence provided code snippet only for Firewall creation.

Firewall Public IP config:

SKU: Standard

Tier: Regional

Hi @GitaraniSharma-MSFT ,

Thank you for providing the response. I will raise a support ticket but not sure I have the support plan or not. Kindly help me to get the one-time free tech support.

@Naveen Vanamadi , thank you for the update. Please check the private message for next steps.

@GitaraniSharma-MSFT I have raised a support ticket and got the below fix for the issue.

I reviewed the error that appears and it states that the VPN gateway is not in provisioning state. I observed the TerraForm code that you share I see that it that there is a depends_on variable that is set to depend on subnet, so I would ask you to add another depends_on variable and set it to depend on VPN Gateway and then try to deploy Azure Firewall again.

Just like I mentioned in my previous email Terra Form codes scope are only partially in scope of our team, so we are working it on best practice.   But based on my knowledge, it seems like you’re encountering an issue where the creation of a VPN Gateway is affecting the creation of a Firewall in your Terraform configuration. This can happen if there are dependencies or resource constraints defined in your Terraform code that link these resources together.   For example, if you have a firewall policy that specifies routing to be sent over a VPN connection provided by a VPN Gateway, then logically, you cannot create the firewall until after the VPN Gateway is available. Similarly, if there are shared network interfaces or other resources required by both services before they can be created independently.

Just to add, my Terraform configuration contains the multiple resource creation(network resources). So the firewall creation was impacted by VPN Gateway resource creation. Hence I have added depends_on conditions to firewall block for VPN_Gateway which is the fix for this issue.