应用程序网关 ARM 模板 - 启用防火墙的参数

Question

我有一个可用的 ARM 模板来部署启用了 WAF 的应用程序网关，目前它始终启用防火墙并根据参数设置防火墙模式。

我们希望参数化启用 WAF，以便可以在没有 WAF 的情况下部署 AGW

属性中的对象如下所示：

"webApplicationFirewallConfiguration": {
                "enabled": "[parameters('applicationGateway').firewallEnabled]",
                "firewallMode": "[parameters('applicationGateway').firewallMode]",
                "ruleSetType": "OWASP",
                "ruleSetVersion": "3.0"
            }

参数文件设置了这些：

                "firewallEnabled": false,
                "Tier": "Standard",
                "skuSize": "Standard_Medium",

但是在部署时它在尝试启用防火墙时出错

New-AzResourceGroupDeployment : 11:28:27 AM - Error:
Code=ApplicationGatewayFirewallCannotBeEnabledForSelectedSku;
Message=Application Gateway 
/subscriptions//providers/Microsoft.Network/applicationGatewa
ys/EXAMPLE-AGW does not support WebApplicationFirewall with the
selected SKU tier Standard

看起来它仍在尝试启用防火墙，即使 "enabled:" 属性为假，我假设它会忽略对象中的其余属性，但显然不会。谁能看出我在这里做错了什么？

Answer 1

不确定为什么会这样，但您始终可以这样做：

"variables": {
    "waffalse": {
        "enabled": false
    },
    "waftrue": {
        "enabled": true,
        "firewallMode": "[parameters('applicationGateway').firewallMode]",
        "ruleSetType": "OWASP",
        "ruleSetVersion": "3.0"
    }
}
...
"webApplicationFirewallConfiguration": "[variables(concat('waf', string(parameters('applicationGateway').firewallEnabled)))]"

因此根据条件使用一个变量或另一个变量

Answer 2

失败原因： 由于 Standard Tier AppGateway 不支持 WebApplicationFirewall，因此即使启用设置为 false，模板验证也会失败，因为验证会看到 "webApplicationFirewallConfiguration" 键本身对标准层无效。

修复： 使用嵌套模板创建应用程序网关模板的子部署，如果禁用防火墙，则不使用 "webApplicationFirewallConfiguration"，否则使用 "webApplicationFirewallConfiguration"如果防火墙与参数文件中的防火墙模式值一起启用。

工作示例： 请在下面找到用于部署的根模板以及启用和禁用防火墙的两个模板。然后，它有两个参数文件 - 一个用于启用防火墙，另一个用于禁用防火墙。

要试用此示例，请按照以下步骤操作：

上传 Blob 存储中的两个子模板。
使上传模板的 Blob 容器 Public 可访问，或者在创建模板的 url.
使用 url 上传的子模板更新根模板中的变量 "appGatewaysTemplateWaffalse" 和 "appGatewaysTemplateWaftrue"。
前往 https://portal.azure.com/#create/Microsoft.Template -> "Build your own template in the editor".
根据需要将此更新后的根模板与 urls 和参数文件（启用或禁用）一起使用。

根模板（VNet + 子部署）：

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "applicationGateway": {
      "type": "object",
      "metadata": {
        "description": "Application gateway specific information"
      }
    },
    "virtualNetworkName": {
      "type": "string",
      "metadata": {
        "description": "virtual network name"
      }
    },
    "vnetAddressPrefix": {
      "type": "string",
      "defaultValue": "10.0.0.0/16",
      "metadata": {
        "description": "virtual network address range"
      }
    },
    "subnetName": {
      "type": "string",
      "defaultValue": "subnet1",
      "metadata": {
        "description": "Subnet Name"
      }
    },
    "subnetPrefix": {
      "type": "string",
      "defaultValue": "10.0.0.0/24",
      "metadata": {
        "description": "Subnet prefix"
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location for all resources."
      }
    }
  },
  "variables": {
    "subnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('subnetName'))]",
    "appGatewaysTemplateWaffalse": "https://da2.blob.core.windows.net/templates/app-gateway-waf-false.json",
    "appGatewaysTemplateWaftrue": "https://da2.blob.core.windows.net/templates/app-gateway-waf-true.json"
  },
  "resources": [
    {
      "apiVersion": "2015-06-15",
      "type": "Microsoft.Network/virtualNetworks",
      "name": "[parameters('virtualNetworkName')]",
      "location": "[parameters('location')]",
      "properties": {
        "addressSpace": {
          "addressPrefixes": [
            "[parameters('vnetAddressPrefix')]"
          ]
        },
        "subnets": [
          {
            "name": "[parameters('subnetName')]",
            "properties": {
              "addressPrefix": "[parameters('subnetPrefix')]"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2015-01-01",
      "name": "azure-appGateways-non-waf-deployment",
      "dependsOn": [
        "[concat('Microsoft.Network/virtualNetworks/', parameters('virtualNetworkName'))]"
      ],
      "properties": {
        "mode": "Incremental",
        "templateLink": {
          "uri": "[variables(concat('appGatewaysTemplateWaf',string(parameters('applicationGateway').firewallEnabled)))]"
        },
        "parameters": {
          "applicationGateway": {
            "value": "[parameters('applicationGateway')]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "subnetRef": {
            "value": "[variables('subnetRef')]"
          }
        }
      }
    }
  ]
}

没有 webApplicationFirewallConfiguration 的子模板：

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "applicationGateway": {
      "type": "object",
      "metadata": {
        "description": "Application gateway specific information"
      }
    },
    "subnetRef": {
      "type": "string",
      "defaultValue": "subnet id",
      "metadata": {
        "description": "Subnet Id"
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location for all resources."
      }
    }
  },
  "variables": {},
  "resources": [
    {
      "apiVersion": "2017-06-01",
      "name": "[parameters('applicationGateway').applicationGatewayName]",
      "type": "Microsoft.Network/applicationGateways",
      "location": "[parameters('location')]",
      "dependsOn": [],
      "properties": {
        "sku": {
          "name": "[parameters('applicationGateway').applicationGatewaySize]",
          "tier": "[parameters('applicationGateway').skuTier]",
          "capacity": "[parameters('applicationGateway').applicationGatewayInstanceCount]"
        },
        "gatewayIPConfigurations": [
          {
            "name": "appGatewayIpConfig",
            "properties": {
              "subnet": {
                "id": "[parameters('subnetRef')]"
              }
            }
          }
        ],
        "frontendIPConfigurations": [
          {
            "name": "appGatewayFrontendIP",
            "properties": {
              "subnet": {
                "id": "[parameters('subnetRef')]"
              }
            }
          }
        ],
        "frontendPorts": [
          {
            "name": "appGatewayFrontendPort",
            "properties": {
              "Port": "[parameters('applicationGateway').frontendPort]"
            }
          }
        ],
        "backendAddressPools": [
          {
            "name": "appGatewayBackendPool",
            "properties": {
              "BackendAddresses": "[parameters('applicationGateway').backendIPAddresses]"
            }
          }
        ],
        "backendHttpSettingsCollection": [
          {
            "name": "appGatewayBackendHttpSettings",
            "properties": {
              "Port": "[parameters('applicationGateway').backendPort]",
              "Protocol": "Http",
              "CookieBasedAffinity": "[parameters('applicationGateway').cookieBasedAffinity]"
            }
          }
        ],
        "httpListeners": [
          {
            "name": "appGatewayHttpListener",
            "properties": {
              "FrontendIpConfiguration": {
                "Id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/frontendIPConfigurations/appGatewayFrontendIP')]"
              },
              "FrontendPort": {
                "Id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/frontendPorts/appGatewayFrontendPort')]"
              },
              "Protocol": "Http",
              "SslCertificate": null
            }
          }
        ],
        "requestRoutingRules": [
          {
            "Name": "rule1",
            "properties": {
              "RuleType": "Basic",
              "httpListener": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/httpListeners/appGatewayHttpListener')]"
              },
              "backendAddressPool": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/backendAddressPools/appGatewayBackendPool')]"
              },
              "backendHttpSettings": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/backendHttpSettingsCollection/appGatewayBackendHttpSettings')]"
              }
            }
          }
        ]
      }
    }
  ]
}

带有 webApplicationFirewallConfiguration 的子模板：

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "applicationGateway": {
      "type": "object",
      "metadata": {
        "description": "Application gateway specific information"
      }
    },
    "subnetRef": {
      "type": "string",
      "defaultValue": "subnet id",
      "metadata": {
        "description": "Subnet Id"
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location for all resources."
      }
    }
  },
  "variables": {},
  "resources": [
    {
      "apiVersion": "2017-06-01",
      "name": "[parameters('applicationGateway').applicationGatewayName]",
      "type": "Microsoft.Network/applicationGateways",
      "location": "[parameters('location')]",
      "dependsOn": [],
      "properties": {
        "sku": {
          "name": "[parameters('applicationGateway').applicationGatewaySize]",
          "tier": "[parameters('applicationGateway').skuTier]",
          "capacity": "[parameters('applicationGateway').applicationGatewayInstanceCount]"
        },
        "gatewayIPConfigurations": [
          {
            "name": "appGatewayIpConfig",
            "properties": {
              "subnet": {
                "id": "[parameters('subnetRef')]"
              }
            }
          }
        ],
        "frontendIPConfigurations": [
          {
            "name": "appGatewayFrontendIP",
            "properties": {
              "subnet": {
                "id": "[parameters('subnetRef')]"
              }
            }
          }
        ],
        "frontendPorts": [
          {
            "name": "appGatewayFrontendPort",
            "properties": {
              "Port": "[parameters('applicationGateway').frontendPort]"
            }
          }
        ],
        "backendAddressPools": [
          {
            "name": "appGatewayBackendPool",
            "properties": {
              "BackendAddresses": "[parameters('applicationGateway').backendIPAddresses]"
            }
          }
        ],
        "backendHttpSettingsCollection": [
          {
            "name": "appGatewayBackendHttpSettings",
            "properties": {
              "Port": "[parameters('applicationGateway').backendPort]",
              "Protocol": "Http",
              "CookieBasedAffinity": "[parameters('applicationGateway').cookieBasedAffinity]"
            }
          }
        ],
        "httpListeners": [
          {
            "name": "appGatewayHttpListener",
            "properties": {
              "FrontendIpConfiguration": {
                "Id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/frontendIPConfigurations/appGatewayFrontendIP')]"
              },
              "FrontendPort": {
                "Id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/frontendPorts/appGatewayFrontendPort')]"
              },
              "Protocol": "Http",
              "SslCertificate": null
            }
          }
        ],
        "webApplicationFirewallConfiguration": {
            "enabled": "[parameters('applicationGateway').firewallEnabled]",
            "firewallMode": "[parameters('applicationGateway').firewallMode]",
            "ruleSetType": "OWASP",
            "ruleSetVersion": "3.0"
        },
        "requestRoutingRules": [
          {
            "Name": "rule1",
            "properties": {
              "RuleType": "Basic",
              "httpListener": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/httpListeners/appGatewayHttpListener')]"
              },
              "backendAddressPool": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/backendAddressPools/appGatewayBackendPool')]"
              },
              "backendHttpSettings": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/backendHttpSettingsCollection/appGatewayBackendHttpSettings')]"
              }
            }
          }
        ]
      }
    }
  ]
}

禁用防火墙的参数：

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "applicationGateway": {
        "value": {
            "firewallEnabled": "false",
            "skuTier": "Standard",
            "applicationGatewayName": "yourappgateway",
            "applicationGatewaySize": "Standard_Small",
            "applicationGatewayInstanceCount": 1,
            "frontendPort": 80,
            "backendPort": 80,
            "backendIPAddresses": [
                {
                "IpAddress": "10.0.0.7"
                },
                {
                "IpAddress": "10.0.0.8"
                },
                {
                "IpAddress": "10.0.0.9"
                }
            ],
            "cookieBasedAffinity": "Disabled"
        }
    },
    "virtualNetworkName": {
      "value": "yourvnetname"
    },
    "vnetAddressPrefix": {
      "value": "10.0.0.0/16"
    },
    "subnetName": {
      "value": "yoursubnet"
    },
    "subnetPrefix": {
      "value": "10.0.0.0/24"
    }
  }
}

启用防火墙的参数：

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "applicationGateway": {
        "value": {
            "firewallEnabled": "true",
            "firewallMode": "Detection",
            "skuTier": "WAF",
            "applicationGatewayName": "yourappgateway",
            "applicationGatewaySize": "WAF_Medium",
            "applicationGatewayInstanceCount": 1,
            "frontendPort": 80,
            "backendPort": 80,
            "backendIPAddresses": [
                {
                "IpAddress": "10.0.0.7"
                },
                {
                "IpAddress": "10.0.0.8"
                },
                {
                "IpAddress": "10.0.0.9"
                }
            ],
            "cookieBasedAffinity": "Disabled"
        }
    },
    "virtualNetworkName": {
      "value": "yourvnetname"
    },
    "vnetAddressPrefix": {
      "value": "10.0.0.0/16"
    },
    "subnetName": {
      "value": "yoursubnet"
    },
    "subnetPrefix": {
      "value": "10.0.0.0/24"
    }
  }
}

应用程序网关 ARM 模板 - 启用防火墙的参数

Application Gateway ARM Template - Parameter for Enabling Firewall

azure

arm-template

azure-application-gateway