应用程序网关ARM模板 - 启用防火墙的参数

问题描述 投票：0回答：2

我有一个工作的ARM模板来部署一个启用了WAF的应用程序网关，这当前始终启用防火墙并根据参数设置防火墙模式。

我们希望参数化启用WAF，以便可以在没有WAF的情况下部署AGW

属性中的对象如下所示：

"webApplicationFirewallConfiguration": {
                "enabled": "[parameters('applicationGateway').firewallEnabled]",
                "firewallMode": "[parameters('applicationGateway').firewallMode]",
                "ruleSetType": "OWASP",
                "ruleSetVersion": "3.0"
            }

参数文件具有以下设置：

                "firewallEnabled": false,
                "Tier": "Standard",
                "skuSize": "Standard_Medium",

但是在部署时，它会尝试启用防火墙

New-AzResourceGroupDeployment : 11:28:27 AM - Error:
Code=ApplicationGatewayFirewallCannotBeEnabledForSelectedSku;
Message=Application Gateway 
/subscriptions//providers/Microsoft.Network/applicationGatewa
ys/EXAMPLE-AGW does not support WebApplicationFirewall with the
selected SKU tier Standard

看起来它仍然试图启用防火墙，即使“enabled：”属性是假的，我认为它会忽略对象中的其余属性但显然不会。谁能看到我在这里做错了什么？

azure arm-template azure-application-gateway
2个回答
0
投票

失败原因：由于标准层AppGateway不支持WebApplicationFirewall，即使启用设置为false，模板VALIDATION也将失败，因为验证看到“webApplicationFirewallConfiguration”键本身对于标准层无效。

修复：如果禁用防火墙，则使用嵌套模板创建没有“webApplicationFirewallConfiguration”的Application Gateway模板的子部署，如果启用防火墙，则使用“webApplicationFirewallConfiguration”以及参数文件中的防火墙模式值。

工作示例：请在下面找到用于部署的根模板以及启用了防火墙和禁用防火墙的两个模板。然后，它有两个参数文件 - 一个用于启用防火墙，另一个用于禁用防火墙。

要试用此示例，请按照以下步骤操作：

  1. 在Blob存储中上载两个子模板。
  2. 制作此Blob容器，模板上传，公共可访问或在创建模板的URL时使用SAS令牌。
  3. 使用上传的子模板的URL更新根模板中的变量“appGatewaysTemplateWaffalse”和“appGatewaysTemplateWaftrue”。
  4. 去https://portal.azure.com/#create/Microsoft.Template - >“在编辑器中构建自己的模板”。
  5. 根据需要将此更新的根模板与URL和参数文件（启用或禁用）一起使用。

根模板（VNet +子部署）：

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "applicationGateway": {
      "type": "object",
      "metadata": {
        "description": "Application gateway specific information"
      }
    },
    "virtualNetworkName": {
      "type": "string",
      "metadata": {
        "description": "virtual network name"
      }
    },
    "vnetAddressPrefix": {
      "type": "string",
      "defaultValue": "10.0.0.0/16",
      "metadata": {
        "description": "virtual network address range"
      }
    },
    "subnetName": {
      "type": "string",
      "defaultValue": "subnet1",
      "metadata": {
        "description": "Subnet Name"
      }
    },
    "subnetPrefix": {
      "type": "string",
      "defaultValue": "10.0.0.0/24",
      "metadata": {
        "description": "Subnet prefix"
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location for all resources."
      }
    }
  },
  "variables": {
    "subnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('subnetName'))]",
    "appGatewaysTemplateWaffalse": "https://da2.blob.core.windows.net/templates/app-gateway-waf-false.json",
    "appGatewaysTemplateWaftrue": "https://da2.blob.core.windows.net/templates/app-gateway-waf-true.json"
  },
  "resources": [
    {
      "apiVersion": "2015-06-15",
      "type": "Microsoft.Network/virtualNetworks",
      "name": "[parameters('virtualNetworkName')]",
      "location": "[parameters('location')]",
      "properties": {
        "addressSpace": {
          "addressPrefixes": [
            "[parameters('vnetAddressPrefix')]"
          ]
        },
        "subnets": [
          {
            "name": "[parameters('subnetName')]",
            "properties": {
              "addressPrefix": "[parameters('subnetPrefix')]"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2015-01-01",
      "name": "azure-appGateways-non-waf-deployment",
      "dependsOn": [
        "[concat('Microsoft.Network/virtualNetworks/', parameters('virtualNetworkName'))]"
      ],
      "properties": {
        "mode": "Incremental",
        "templateLink": {
          "uri": "[variables(concat('appGatewaysTemplateWaf',string(parameters('applicationGateway').firewallEnabled)))]"
        },
        "parameters": {
          "applicationGateway": {
            "value": "[parameters('applicationGateway')]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "subnetRef": {
            "value": "[variables('subnetRef')]"
          }
        }
      }
    }
  ]
}

没有Web应用程序防火墙配置的子模板

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "applicationGateway": {
      "type": "object",
      "metadata": {
        "description": "Application gateway specific information"
      }
    },
    "subnetRef": {
      "type": "string",
      "defaultValue": "subnet id",
      "metadata": {
        "description": "Subnet Id"
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location for all resources."
      }
    }
  },
  "variables": {},
  "resources": [
    {
      "apiVersion": "2017-06-01",
      "name": "[parameters('applicationGateway').applicationGatewayName]",
      "type": "Microsoft.Network/applicationGateways",
      "location": "[parameters('location')]",
      "dependsOn": [],
      "properties": {
        "sku": {
          "name": "[parameters('applicationGateway').applicationGatewaySize]",
          "tier": "[parameters('applicationGateway').skuTier]",
          "capacity": "[parameters('applicationGateway').applicationGatewayInstanceCount]"
        },
        "gatewayIPConfigurations": [
          {
            "name": "appGatewayIpConfig",
            "properties": {
              "subnet": {
                "id": "[parameters('subnetRef')]"
              }
            }
          }
        ],
        "frontendIPConfigurations": [
          {
            "name": "appGatewayFrontendIP",
            "properties": {
              "subnet": {
                "id": "[parameters('subnetRef')]"
              }
            }
          }
        ],
        "frontendPorts": [
          {
            "name": "appGatewayFrontendPort",
            "properties": {
              "Port": "[parameters('applicationGateway').frontendPort]"
            }
          }
        ],
        "backendAddressPools": [
          {
            "name": "appGatewayBackendPool",
            "properties": {
              "BackendAddresses": "[parameters('applicationGateway').backendIPAddresses]"
            }
          }
        ],
        "backendHttpSettingsCollection": [
          {
            "name": "appGatewayBackendHttpSettings",
            "properties": {
              "Port": "[parameters('applicationGateway').backendPort]",
              "Protocol": "Http",
              "CookieBasedAffinity": "[parameters('applicationGateway').cookieBasedAffinity]"
            }
          }
        ],
        "httpListeners": [
          {
            "name": "appGatewayHttpListener",
            "properties": {
              "FrontendIpConfiguration": {
                "Id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/frontendIPConfigurations/appGatewayFrontendIP')]"
              },
              "FrontendPort": {
                "Id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/frontendPorts/appGatewayFrontendPort')]"
              },
              "Protocol": "Http",
              "SslCertificate": null
            }
          }
        ],
        "requestRoutingRules": [
          {
            "Name": "rule1",
            "properties": {
              "RuleType": "Basic",
              "httpListener": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/httpListeners/appGatewayHttpListener')]"
              },
              "backendAddressPool": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/backendAddressPools/appGatewayBackendPool')]"
              },
              "backendHttpSettings": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/backendHttpSettingsCollection/appGatewayBackendHttpSettings')]"
              }
            }
          }
        ]
      }
    }
  ]
}

Web应用程序防火墙配置的子模板：

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "applicationGateway": {
      "type": "object",
      "metadata": {
        "description": "Application gateway specific information"
      }
    },
    "subnetRef": {
      "type": "string",
      "defaultValue": "subnet id",
      "metadata": {
        "description": "Subnet Id"
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location for all resources."
      }
    }
  },
  "variables": {},
  "resources": [
    {
      "apiVersion": "2017-06-01",
      "name": "[parameters('applicationGateway').applicationGatewayName]",
      "type": "Microsoft.Network/applicationGateways",
      "location": "[parameters('location')]",
      "dependsOn": [],
      "properties": {
        "sku": {
          "name": "[parameters('applicationGateway').applicationGatewaySize]",
          "tier": "[parameters('applicationGateway').skuTier]",
          "capacity": "[parameters('applicationGateway').applicationGatewayInstanceCount]"
        },
        "gatewayIPConfigurations": [
          {
            "name": "appGatewayIpConfig",
            "properties": {
              "subnet": {
                "id": "[parameters('subnetRef')]"
              }
            }
          }
        ],
        "frontendIPConfigurations": [
          {
            "name": "appGatewayFrontendIP",
            "properties": {
              "subnet": {
                "id": "[parameters('subnetRef')]"
              }
            }
          }
        ],
        "frontendPorts": [
          {
            "name": "appGatewayFrontendPort",
            "properties": {
              "Port": "[parameters('applicationGateway').frontendPort]"
            }
          }
        ],
        "backendAddressPools": [
          {
            "name": "appGatewayBackendPool",
            "properties": {
              "BackendAddresses": "[parameters('applicationGateway').backendIPAddresses]"
            }
          }
        ],
        "backendHttpSettingsCollection": [
          {
            "name": "appGatewayBackendHttpSettings",
            "properties": {
              "Port": "[parameters('applicationGateway').backendPort]",
              "Protocol": "Http",
              "CookieBasedAffinity": "[parameters('applicationGateway').cookieBasedAffinity]"
            }
          }
        ],
        "httpListeners": [
          {
            "name": "appGatewayHttpListener",
            "properties": {
              "FrontendIpConfiguration": {
                "Id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/frontendIPConfigurations/appGatewayFrontendIP')]"
              },
              "FrontendPort": {
                "Id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/frontendPorts/appGatewayFrontendPort')]"
              },
              "Protocol": "Http",
              "SslCertificate": null
            }
          }
        ],
        "webApplicationFirewallConfiguration": {
            "enabled": "[parameters('applicationGateway').firewallEnabled]",
            "firewallMode": "[parameters('applicationGateway').firewallMode]",
            "ruleSetType": "OWASP",
            "ruleSetVersion": "3.0"
        },
        "requestRoutingRules": [
          {
            "Name": "rule1",
            "properties": {
              "RuleType": "Basic",
              "httpListener": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/httpListeners/appGatewayHttpListener')]"
              },
              "backendAddressPool": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/backendAddressPools/appGatewayBackendPool')]"
              },
              "backendHttpSettings": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/backendHttpSettingsCollection/appGatewayBackendHttpSettings')]"
              }
            }
          }
        ]
      }
    }
  ]
}

禁用防火墙的参数：

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "applicationGateway": {
        "value": {
            "firewallEnabled": "false",
            "skuTier": "Standard",
            "applicationGatewayName": "yourappgateway",
            "applicationGatewaySize": "Standard_Small",
            "applicationGatewayInstanceCount": 1,
            "frontendPort": 80,
            "backendPort": 80,
            "backendIPAddresses": [
                {
                "IpAddress": "10.0.0.7"
                },
                {
                "IpAddress": "10.0.0.8"
                },
                {
                "IpAddress": "10.0.0.9"
                }
            ],
            "cookieBasedAffinity": "Disabled"
        }
    },
    "virtualNetworkName": {
      "value": "yourvnetname"
    },
    "vnetAddressPrefix": {
      "value": "10.0.0.0/16"
    },
    "subnetName": {
      "value": "yoursubnet"
    },
    "subnetPrefix": {
      "value": "10.0.0.0/24"
    }
  }
}

启用防火墙的参数：

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "applicationGateway": {
        "value": {
            "firewallEnabled": "true",
            "firewallMode": "Detection",
            "skuTier": "WAF",
            "applicationGatewayName": "yourappgateway",
            "applicationGatewaySize": "WAF_Medium",
            "applicationGatewayInstanceCount": 1,
            "frontendPort": 80,
            "backendPort": 80,
            "backendIPAddresses": [
                {
                "IpAddress": "10.0.0.7"
                },
                {
                "IpAddress": "10.0.0.8"
                },
                {
                "IpAddress": "10.0.0.9"
                }
            ],
            "cookieBasedAffinity": "Disabled"
        }
    },
    "virtualNetworkName": {
      "value": "yourvnetname"
    },
    "vnetAddressPrefix": {
      "value": "10.0.0.0/16"
    },
    "subnetName": {
      "value": "yoursubnet"
    },
    "subnetPrefix": {
      "value": "10.0.0.0/24"
    }
  }
}
0
投票

不确定为什么会这样，但你总能做到这一点：

"variables": {
    "waffalse": {
        "enabled": false
    },
    "waftrue": {
        "enabled": true,
        "firewallMode": "[parameters('applicationGateway').firewallMode]",
        "ruleSetType": "OWASP",
        "ruleSetVersion": "3.0"
    }
}
...
"webApplicationFirewallConfiguration": "[variables(concat('waf', string(parameters('applicationGateway').firewallEnabled)))]"

所以根据条件使用一个变量或另一个变量

最新问题
© www.soinside.com 2019 - 2024. All rights reserved.