Microsoft.Network firewallPolicies/ruleCollectionGroups

Article
10/24/2024

Bicep resource definition

The firewallPolicies/ruleCollectionGroups resource type can be deployed with operations that target:

Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Network/firewallPolicies/ruleCollectionGroups resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.Network/firewallPolicies/ruleCollectionGroups@2024-03-01' = {
  name: 'string'
  properties: {
    priority: int
    ruleCollections: [
      {
        name: 'string'
        priority: int
        ruleCollectionType: 'string'
        // For remaining properties, see FirewallPolicyRuleCollection objects
      }
    ]
  }
}

FirewallPolicyRule objects

Set the ruleType property to specify the type of object.

For ApplicationRule, use:

{
  destinationAddresses: [
    'string'
  ]
  fqdnTags: [
    'string'
  ]
  httpHeadersToInsert: [
    {
      headerName: 'string'
      headerValue: 'string'
    }
  ]
  protocols: [
    {
      port: int
      protocolType: 'string'
    }
  ]
  ruleType: 'ApplicationRule'
  sourceAddresses: [
    'string'
  ]
  sourceIpGroups: [
    'string'
  ]
  targetFqdns: [
    'string'
  ]
  targetUrls: [
    'string'
  ]
  terminateTLS: bool
  webCategories: [
    'string'
  ]
}

For NatRule, use:

{
  destinationAddresses: [
    'string'
  ]
  destinationPorts: [
    'string'
  ]
  ipProtocols: [
    'string'
  ]
  ruleType: 'NatRule'
  sourceAddresses: [
    'string'
  ]
  sourceIpGroups: [
    'string'
  ]
  translatedAddress: 'string'
  translatedFqdn: 'string'
  translatedPort: 'string'
}

For NetworkRule, use:

{
  destinationAddresses: [
    'string'
  ]
  destinationFqdns: [
    'string'
  ]
  destinationIpGroups: [
    'string'
  ]
  destinationPorts: [
    'string'
  ]
  ipProtocols: [
    'string'
  ]
  ruleType: 'NetworkRule'
  sourceAddresses: [
    'string'
  ]
  sourceIpGroups: [
    'string'
  ]
}

FirewallPolicyRuleCollection objects

Set the ruleCollectionType property to specify the type of object.

For FirewallPolicyFilterRuleCollection, use:

{
  action: {
    type: 'string'
  }
  ruleCollectionType: 'FirewallPolicyFilterRuleCollection'
  rules: [
    {
      description: 'string'
      name: 'string'
      ruleType: 'string'
      // For remaining properties, see FirewallPolicyRule objects
    }
  ]
}

For FirewallPolicyNatRuleCollection, use:

{
  action: {
    type: 'string'
  }
  ruleCollectionType: 'FirewallPolicyNatRuleCollection'
  rules: [
    {
      description: 'string'
      name: 'string'
      ruleType: 'string'
      // For remaining properties, see FirewallPolicyRule objects
    }
  ]
}

Property values

ApplicationRule

Name	Description	Value
destinationAddresses	List of destination IP addresses or Service Tags.	string[]
fqdnTags	List of FQDN Tags for this rule.	string[]
httpHeadersToInsert	List of HTTP/S headers to insert.	FirewallPolicyHttpHeaderToInsert[]
protocols	Array of Application Protocols.	FirewallPolicyRuleApplicationProtocol[]
ruleType	Rule Type.	'ApplicationRule' (required)
sourceAddresses	List of source IP addresses for this rule.	string[]
sourceIpGroups	List of source IpGroups for this rule.	string[]
targetFqdns	List of FQDNs for this rule.	string[]
targetUrls	List of Urls for this rule condition.	string[]
terminateTLS	Terminate TLS connections for this rule.	bool
webCategories	List of destination azure web categories.	string[]

FirewallPolicyFilterRuleCollection

Name	Description	Value
action	The action type of a Filter rule collection.	FirewallPolicyFilterRuleCollectionAction
ruleCollectionType	The type of the rule collection.	'FirewallPolicyFilterRuleCollection' (required)
rules	List of rules included in a rule collection.	FirewallPolicyRule[]

FirewallPolicyFilterRuleCollectionAction

Name	Description	Value
type	The type of action.	'Allow' 'Deny'

FirewallPolicyHttpHeaderToInsert

Name	Description	Value
headerName	Contains the name of the header	string
headerValue	Contains the value of the header	string

FirewallPolicyNatRuleCollection

Name	Description	Value
action	The action type of a Nat rule collection.	FirewallPolicyNatRuleCollectionAction
ruleCollectionType	The type of the rule collection.	'FirewallPolicyNatRuleCollection' (required)
rules	List of rules included in a rule collection.	FirewallPolicyRule[]

FirewallPolicyNatRuleCollectionAction

Name	Description	Value
type	The type of action.	'DNAT'

FirewallPolicyRule

Name	Description	Value
description	Description of the rule.	string
name	Name of the rule.	string
ruleType	Set to 'ApplicationRule' for type ApplicationRule. Set to 'NatRule' for type NatRule. Set to 'NetworkRule' for type NetworkRule.	'ApplicationRule' 'NatRule' 'NetworkRule' (required)

FirewallPolicyRuleApplicationProtocol

Name	Description	Value
port	Port number for the protocol, cannot be greater than 64000.	int Constraints: Min value = 0 Max value = 64000
protocolType	Protocol type.	'Http' 'Https'

FirewallPolicyRuleCollection

Name	Description	Value
name	The name of the rule collection.	string
priority	Priority of the Firewall Policy Rule Collection resource.	int Constraints: Min value = 100 Max value = 65000
ruleCollectionType	Set to 'FirewallPolicyFilterRuleCollection' for type FirewallPolicyFilterRuleCollection. Set to 'FirewallPolicyNatRuleCollection' for type FirewallPolicyNatRuleCollection.	'FirewallPolicyFilterRuleCollection' 'FirewallPolicyNatRuleCollection' (required)

FirewallPolicyRuleCollectionGroupProperties

Name	Description	Value
priority	Priority of the Firewall Policy Rule Collection Group resource.	int Constraints: Min value = 100 Max value = 65000
ruleCollections	Group of Firewall Policy rule collections.	FirewallPolicyRuleCollection[]