azure - 应用程序网关 ARM 模板 - 启用防火墙的参数

Question

我有一个可用的 ARM 模板来部署启用了 WAF 的应用程序网关，当前始终启用防火墙并根据参数设置防火墙模式。

我们希望参数化启用WAF，以便可以在没有WAF的情况下部署AGW

属性中的对象如下所示:

"webApplicationFirewallConfiguration": {
                "enabled": "[parameters('applicationGateway').firewallEnabled]",
                "firewallMode": "[parameters('applicationGateway').firewallMode]",
                "ruleSetType": "OWASP",
                "ruleSetVersion": "3.0"
            }

参数文件设置了这些:

                "firewallEnabled": false,
                "Tier": "Standard",
                "skuSize": "Standard_Medium",

但是在部署时尝试启用防火墙时会出错

New-AzResourceGroupDeployment : 11:28:27 AM - Error:
Code=ApplicationGatewayFirewallCannotBeEnabledForSelectedSku;
Message=Application Gateway 
/subscriptions//providers/Microsoft.Network/applicationGatewa
ys/EXAMPLE-AGW does not support WebApplicationFirewall with the
selected SKU tier Standard

看起来它仍在尝试启用防火墙，即使“enabled:”属性为 false，我认为它会忽略对象中的其余属性，但显然不会。谁能看到我在这里做错了什么吗？

Answer 1

失败原因:由于标准层 AppGateway 不支持 WebApplicationFirewall，因此即使启用设置为 false，模板验证也会失败，因为验证会将“webApplicationFirewallConfiguration” key 本身视为对标准层无效。

修复:使用嵌套模板创建应用程序网关模板的子部署，如果防火墙已禁用，则不带“webApplicationFirewallConfiguration”，否则，如果启用防火墙以及防火墙模式值，则创建包含“webApplicationFirewallConfiguration”的应用程序网关模板的子部署在参数文件中。

工作示例:请在下面找到用于部署的根模板以及两个启用和禁用防火墙的模板。然后，它有两个参数文件 - 一个用于启用防火墙，另一个用于禁用防火墙。

要试用此示例，请按照以下步骤操作:

1. 将两个子模板上​​传到 Blob 存储中。
2. 使此 Blob 容器可在其中上传模板，供公众访问或在创建模板的网址时使用 SAS token 。
3. 使用上传的子模板的网址更新根模板中的变量“appGatewaysTemplateWaffalse”和“appGatewaysTemplateWaftrue”。
4. 去 https://portal.azure.com/#create/Microsoft.Template ->“在编辑器中构建您自己的模板”。
5. 根据需要使用此更新后的根模板以及网址和参数文件(启用或禁用)。

根模板(VNet + 子部署):

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "applicationGateway": {
      "type": "object",
      "metadata": {
        "description": "Application gateway specific information"
      }
    },
    "virtualNetworkName": {
      "type": "string",
      "metadata": {
        "description": "virtual network name"
      }
    },
    "vnetAddressPrefix": {
      "type": "string",
      "defaultValue": "10.0.0.0/16",
      "metadata": {
        "description": "virtual network address range"
      }
    },
    "subnetName": {
      "type": "string",
      "defaultValue": "subnet1",
      "metadata": {
        "description": "Subnet Name"
      }
    },
    "subnetPrefix": {
      "type": "string",
      "defaultValue": "10.0.0.0/24",
      "metadata": {
        "description": "Subnet prefix"
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location for all resources."
      }
    }
  },
  "variables": {
    "subnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('subnetName'))]",
    "appGatewaysTemplateWaffalse": "https://da2.blob.core.windows.net/templates/app-gateway-waf-false.json",
    "appGatewaysTemplateWaftrue": "https://da2.blob.core.windows.net/templates/app-gateway-waf-true.json"
  },
  "resources": [
    {
      "apiVersion": "2015-06-15",
      "type": "Microsoft.Network/virtualNetworks",
      "name": "[parameters('virtualNetworkName')]",
      "location": "[parameters('location')]",
      "properties": {
        "addressSpace": {
          "addressPrefixes": [
            "[parameters('vnetAddressPrefix')]"
          ]
        },
        "subnets": [
          {
            "name": "[parameters('subnetName')]",
            "properties": {
              "addressPrefix": "[parameters('subnetPrefix')]"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2015-01-01",
      "name": "azure-appGateways-non-waf-deployment",
      "dependsOn": [
        "[concat('Microsoft.Network/virtualNetworks/', parameters('virtualNetworkName'))]"
      ],
      "properties": {
        "mode": "Incremental",
        "templateLink": {
          "uri": "[variables(concat('appGatewaysTemplateWaf',string(parameters('applicationGateway').firewallEnabled)))]"
        },
        "parameters": {
          "applicationGateway": {
            "value": "[parameters('applicationGateway')]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "subnetRef": {
            "value": "[variables('subnetRef')]"
          }
        }
      }
    }
  ]
}

没有 webApplicationFirewallConfiguration 的子模板:

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "applicationGateway": {
      "type": "object",
      "metadata": {
        "description": "Application gateway specific information"
      }
    },
    "subnetRef": {
      "type": "string",
      "defaultValue": "subnet id",
      "metadata": {
        "description": "Subnet Id"
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location for all resources."
      }
    }
  },
  "variables": {},
  "resources": [
    {
      "apiVersion": "2017-06-01",
      "name": "[parameters('applicationGateway').applicationGatewayName]",
      "type": "Microsoft.Network/applicationGateways",
      "location": "[parameters('location')]",
      "dependsOn": [],
      "properties": {
        "sku": {
          "name": "[parameters('applicationGateway').applicationGatewaySize]",
          "tier": "[parameters('applicationGateway').skuTier]",
          "capacity": "[parameters('applicationGateway').applicationGatewayInstanceCount]"
        },
        "gatewayIPConfigurations": [
          {
            "name": "appGatewayIpConfig",
            "properties": {
              "subnet": {
                "id": "[parameters('subnetRef')]"
              }
            }
          }
        ],
        "frontendIPConfigurations": [
          {
            "name": "appGatewayFrontendIP",
            "properties": {
              "subnet": {
                "id": "[parameters('subnetRef')]"
              }
            }
          }
        ],
        "frontendPorts": [
          {
            "name": "appGatewayFrontendPort",
            "properties": {
              "Port": "[parameters('applicationGateway').frontendPort]"
            }
          }
        ],
        "backendAddressPools": [
          {
            "name": "appGatewayBackendPool",
            "properties": {
              "BackendAddresses": "[parameters('applicationGateway').backendIPAddresses]"
            }
          }
        ],
        "backendHttpSettingsCollection": [
          {
            "name": "appGatewayBackendHttpSettings",
            "properties": {
              "Port": "[parameters('applicationGateway').backendPort]",
              "Protocol": "Http",
              "CookieBasedAffinity": "[parameters('applicationGateway').cookieBasedAffinity]"
            }
          }
        ],
        "httpListeners": [
          {
            "name": "appGatewayHttpListener",
            "properties": {
              "FrontendIpConfiguration": {
                "Id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/frontendIPConfigurations/appGatewayFrontendIP')]"
              },
              "FrontendPort": {
                "Id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/frontendPorts/appGatewayFrontendPort')]"
              },
              "Protocol": "Http",
              "SslCertificate": null
            }
          }
        ],
        "requestRoutingRules": [
          {
            "Name": "rule1",
            "properties": {
              "RuleType": "Basic",
              "httpListener": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/httpListeners/appGatewayHttpListener')]"
              },
              "backendAddressPool": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/backendAddressPools/appGatewayBackendPool')]"
              },
              "backendHttpSettings": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/backendHttpSettingsCollection/appGatewayBackendHttpSettings')]"
              }
            }
          }
        ]
      }
    }
  ]
}

带有 webApplicationFirewallConfiguration 的子模板:

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "applicationGateway": {
      "type": "object",
      "metadata": {
        "description": "Application gateway specific information"
      }
    },
    "subnetRef": {
      "type": "string",
      "defaultValue": "subnet id",
      "metadata": {
        "description": "Subnet Id"
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location for all resources."
      }
    }
  },
  "variables": {},
  "resources": [
    {
      "apiVersion": "2017-06-01",
      "name": "[parameters('applicationGateway').applicationGatewayName]",
      "type": "Microsoft.Network/applicationGateways",
      "location": "[parameters('location')]",
      "dependsOn": [],
      "properties": {
        "sku": {
          "name": "[parameters('applicationGateway').applicationGatewaySize]",
          "tier": "[parameters('applicationGateway').skuTier]",
          "capacity": "[parameters('applicationGateway').applicationGatewayInstanceCount]"
        },
        "gatewayIPConfigurations": [
          {
            "name": "appGatewayIpConfig",
            "properties": {
              "subnet": {
                "id": "[parameters('subnetRef')]"
              }
            }
          }
        ],
        "frontendIPConfigurations": [
          {
            "name": "appGatewayFrontendIP",
            "properties": {
              "subnet": {
                "id": "[parameters('subnetRef')]"
              }
            }
          }
        ],
        "frontendPorts": [
          {
            "name": "appGatewayFrontendPort",
            "properties": {
              "Port": "[parameters('applicationGateway').frontendPort]"
            }
          }
        ],
        "backendAddressPools": [
          {
            "name": "appGatewayBackendPool",
            "properties": {
              "BackendAddresses": "[parameters('applicationGateway').backendIPAddresses]"
            }
          }
        ],
        "backendHttpSettingsCollection": [
          {
            "name": "appGatewayBackendHttpSettings",
            "properties": {
              "Port": "[parameters('applicationGateway').backendPort]",
              "Protocol": "Http",
              "CookieBasedAffinity": "[parameters('applicationGateway').cookieBasedAffinity]"
            }
          }
        ],
        "httpListeners": [
          {
            "name": "appGatewayHttpListener",
            "properties": {
              "FrontendIpConfiguration": {
                "Id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/frontendIPConfigurations/appGatewayFrontendIP')]"
              },
              "FrontendPort": {
                "Id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/frontendPorts/appGatewayFrontendPort')]"
              },
              "Protocol": "Http",
              "SslCertificate": null
            }
          }
        ],
        "webApplicationFirewallConfiguration": {
            "enabled": "[parameters('applicationGateway').firewallEnabled]",
            "firewallMode": "[parameters('applicationGateway').firewallMode]",
            "ruleSetType": "OWASP",
            "ruleSetVersion": "3.0"
        },
        "requestRoutingRules": [
          {
            "Name": "rule1",
            "properties": {
              "RuleType": "Basic",
              "httpListener": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/httpListeners/appGatewayHttpListener')]"
              },
              "backendAddressPool": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/backendAddressPools/appGatewayBackendPool')]"
              },
              "backendHttpSettings": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/backendHttpSettingsCollection/appGatewayBackendHttpSettings')]"
              }
            }
          }
        ]
      }
    }
  ]
}

禁用防火墙的参数:

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "applicationGateway": {
        "value": {
            "firewallEnabled": "false",
            "skuTier": "Standard",
            "applicationGatewayName": "yourappgateway",
            "applicationGatewaySize": "Standard_Small",
            "applicationGatewayInstanceCount": 1,
            "frontendPort": 80,
            "backendPort": 80,
            "backendIPAddresses": [
                {
                "IpAddress": "10.0.0.7"
                },
                {
                "IpAddress": "10.0.0.8"
                },
                {
                "IpAddress": "10.0.0.9"
                }
            ],
            "cookieBasedAffinity": "Disabled"
        }
    },
    "virtualNetworkName": {
      "value": "yourvnetname"
    },
    "vnetAddressPrefix": {
      "value": "10.0.0.0/16"
    },
    "subnetName": {
      "value": "yoursubnet"
    },
    "subnetPrefix": {
      "value": "10.0.0.0/24"
    }
  }
}

启用防火墙的参数:

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "applicationGateway": {
        "value": {
            "firewallEnabled": "true",
            "firewallMode": "Detection",
            "skuTier": "WAF",
            "applicationGatewayName": "yourappgateway",
            "applicationGatewaySize": "WAF_Medium",
            "applicationGatewayInstanceCount": 1,
            "frontendPort": 80,
            "backendPort": 80,
            "backendIPAddresses": [
                {
                "IpAddress": "10.0.0.7"
                },
                {
                "IpAddress": "10.0.0.8"
                },
                {
                "IpAddress": "10.0.0.9"
                }
            ],
            "cookieBasedAffinity": "Disabled"
        }
    },
    "virtualNetworkName": {
      "value": "yourvnetname"
    },
    "vnetAddressPrefix": {
      "value": "10.0.0.0/16"
    },
    "subnetName": {
      "value": "yoursubnet"
    },
    "subnetPrefix": {
      "value": "10.0.0.0/24"
    }
  }
}