New-AzFirewallPolicy

Module:

Az.Network Module

Creates a new Azure Firewall Policy

New-AzFirewallPolicy
 -Name <String>
 -ResourceGroupName <String>
 -Location <String>
 [-ThreatIntelMode <String>]
 [-ThreatIntelWhitelist <PSAzureFirewallPolicyThreatIntelWhitelist>]
 [-BasePolicy <String>]
 [-DnsSetting <PSAzureFirewallPolicyDnsSettings>]
 [-SqlSetting <PSAzureFirewallPolicySqlSetting>]
 [-Tag <Hashtable>]
 [-Force]
 [-AsJob]
 [-IntrusionDetection <PSAzureFirewallPolicyIntrusionDetection>]
 [-TransportSecurityName <String>]
 [-TransportSecurityKeyVaultSecretId <String>]
 [-SkuTier <String>]
 [-UserAssignedIdentityId <String[]>]
 [-Identity <PSManagedServiceIdentity>]
 [-PrivateRange <String[]>]
 [-ExplicitProxy <PSAzureFirewallPolicyExplicitProxy>]
 [-Snat <PSAzureFirewallPolicySNAT>]
 [-DefaultProfile <IAzureContextContainer>]
 [-WhatIf]
 [-Confirm]
 [<CommonParameters>]

The New-AzFirewallPolicy cmdlet creates an Azure Firewall Policy.

New-AzFirewallPolicy -Name fp1 -ResourceGroupName TestRg

This example creates an azure firewall policy

New-AzFirewallPolicy -Name fp1 -ResourceGroupName TestRg -ThreatIntelMode "Deny"

This example creates an azure firewall policy with a threat intel mode

$threatIntelWhitelist = New-AzFirewallPolicyThreatIntelWhitelist -IpAddress 23.46.72.91,192.79.236.79 -FQDN microsoft.com
New-AzFirewallPolicy -Name fp1 -ResourceGroupName TestRg -ThreatIntelWhitelist $threatIntelWhitelist

This example creates an azure firewall policy with a threat intel allowlist

$bypass = New-AzFirewallPolicyIntrusionDetectionBypassTraffic -Name "bypass-setting" -Protocol "TCP" -DestinationPort "80" -SourceAddress "10.0.0.0" -DestinationAddress "*"
$signatureOverride = New-AzFirewallPolicyIntrusionDetectionSignatureOverride -Id "123456798" -Mode "Deny"
$intrusionDetection = New-AzFirewallPolicyIntrusionDetection -Mode "Alert" -SignatureOverride $signatureOverride -BypassTraffic $bypass
$userAssignedIdentity = '/subscriptions/9e223dbe-3399-4e19-88eb-0975f02ac87f/resourcegroups/TestRg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/user-assign-identity'
New-AzFirewallPolicy -Name fp1 -Location "westus2" -ResourceGroupName TestRg -SkuTier "Premium" -IntrusionDetection $intrusionDetection -TransportSecurityName tsName -TransportSecurityKeyVaultSecretId "https://<keyvaultname>.vault.azure.net/secrets/cacert" -UserAssignedIdentityId $userAssignedIdentity

This example creates an azure firewall policy with a intrusion detection in mode alert, user assigned identity and transport security

New-AzFirewallPolicy -Name fp1 -ResourceGroupName TestRg -PrivateRange @("99.99.99.0/24", "66.66.0.0/16")

This example creates a Firewall that treats "99.99.99.0/24" and "66.66.0.0/16" as private ip ranges and won't snat traffic to those addresses

$exProxy = New-AzFirewallPolicyExplicitProxy -EnableExplicitProxy -HttpPort 100 -HttpsPort 101 -EnablePacFile -PacFilePort 130 -PacFile "sampleurlfortesting.blob.core.windowsnet/nothing"
New-AzFirewallPolicy -Name fp1 -ResourceGroupName TestRg -ExplicitProxy $exProxy

BasePolicy	 : null
		DnsSettings 	 : null
		Etag	 : null
		ExplicitProxy
			EnableExplicitProxy	 : true
			EnablePacFile	 : true
			HttpPort	 : 100
			HttpsPort	 : 101
			PacFile : "sampleurlfortesting.blob.core.windowsnet/nothing"
			PacFilePort	 : 130
		Id	 : null
		Identity	 : null
		IntrusionDetection	 : null
		Location	 : "westus2"
		Name	 : "fp1"
		PrivateRange	 : null
		PrivateRangeText	 : "[]"
		ProvisioningState	 : null
		ResourceGroupName	 : "TestRg"
		ResourceGuid	 : null
		RuleCollectionGroups	 : null
		Sku
			Tier	 : "Standard"
		Snat
			AutoLearnPrivateRanges	: null
			PrivateRanges	 : null
		SqlSetting	 : null
		Tag	 : null
		TagsTable	 : null
		ThreatIntelMode	 : "Alert"
		ThreatIntelWhitelist	 : null
		TransportSecurity	 : null
		Type	 : null

This example creates a firewall policy with explicit proxy settings

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.