az-firewall-start.azcli

# Begin Variables
firewall_name=<Your Azure Firewall Resource Name here>
firewall_resource_group=<Your Azure Firewall's Resource Group here>

# Previously this script used unique resource group variables for different components like VNet, public IPs etc.
# Per the Azure Firewall FAQ, this is unnecessary. The firewall, VNet, and the public IP address all must be in the same resource group.
# https://docs.microsoft.com/en-us/azure/firewall/firewall-faq#are-there-any-firewall-resource-group-restrictions

# For any variable below that doesn't match your scenario, leave the variable undefined

# Scenario: Firewall in an VWAN Secured Hub
virtualwan_hub_name=

# Scenario: Firewall in an Azure VNet
virtual_network_name=

# Provide one or more public IPs to assign to the Firewall
# Each entry in the collection is the resource name of a public IP
public_ip_collection=( 
    #"public_ip_resource_name1" # Example Entry
    #"public_ip_resource_name2" # Example Entry
)

# Scenario: Firewall in an Azure VNet with forced tunneling enabled (also define public IP collection above)
management_ip_name=

## EXAMPLE VARIABLES
    #firewall_name=demo-azfw
    #firewall_resource_group=AzureFirewall-StartStop-demo
    #virtualwan_hub_name=
    #virtual_network_name=demo-azfw-vnet
    #public_ip_collection=(
    #    "demo-azfw-pip"
    #    "demo-azfw-pip2"
    #)
    #management_ip_name=demo-azfw-mgmt-pip
##

# End Variables

# Begin Script

# Make sure az network firewall extension is installed, and upgrade to latest if needed
az extension add --upgrade --name azure-firewall

# Find exact firewall
read firewall_id firewall_sku <<< $(az network firewall show --name $firewall_name --resource-group $firewall_resource_group -o tsv --query "{id:id,sku:sku.name}")
err=$?

# Confirm command success
if [ $err != 0 ]; then
    echo -e "Could not find firewall!"
    exit 1

# Allocate VWan Hub firewall
elif [ "$firewall_sku" == "AZFW_Hub" ]; then

    if [ -z "$virtualwan_hub_name" ]; then
        echo "Must define hub name and resource group for a firewall with SKU AZFW_Hub."
        exit 1
    else
        echo "Allocating firewall \"$firewall_name\" in resource group \"$firewall_resource_group\" to VWAN Hub \"$virtualwan_hub_name\"..."
        vhub_id=$(az network vhub show --name $virtualwan_hub_name --resource-group $firewall_resource_group -o tsv --query "id")
        err=$?
        
        if [ $err == 0 ]; then
            # Found VWan Hub, allocate firewall to it
            az network firewall update --ids $firewall_id --vhub $vhub_id
        else 
            # Something went wrong getting the VWan Hub
            echo "Could not locate vwan hub named \"$virtualwan_hub_name\" in resource group \"$firewall_resource_group\"."
        fi
    fi

# Allocate VNet firewall
else 
    if [ -z "$virtual_network_name" -o -z "$public_ip_collection" ]; then
        # Firewall is not in a VWAN Hub, but VNet or public IPs have not been provided.
        echo "Must define both VNet and public ip collection for a firewall in a VNet."
        exit 1
    else
        # Firewall is not in a VWAN Hub, begin allocation in VNet.
        
        # Make sure we have at least one public IP
        if [[ ${#public_ip_collection[@]} < 1 ]]; then
            echo "Must define at least one public IP resource in public_ip_collection variable."
            exit 1
        fi

        echo -n "Allocating firewall \"$firewall_name\" in resource group \"$firewall_resource_group\" to VNet \"$virtual_network_name\", with public IP(s) \"${public_ip_collection[@]}\", "

        pip_ids=()
        for pip_name in ${public_ip_collection[@]}; do
            # Find the PIP's resource ID and add it to the array
            pip_ids+=( $(az network public-ip show --name $pip_name --resource-group $firewall_resource_group -o tsv --query "id") )

            if [ $? != 0 ]; then
                echo "Could not find public ip resource named \"$pip_name\" in resource group \"$firewall_resource_group\"."
            fi
        done

        if [ -z "$management_ip_name" ]; then
            # No management IP provided, assuming forced tunneling is not in use
            echo "without split tunneling enabled..."
            
            # First ip-config must include VNet info
            az network firewall ip-config create --name "AzureFirewallIpConfiguration0" --firewall-name $firewall_name --resource-group $firewall_resource_group --public-ip-address ${pip_ids[0]} --vnet-name $virtual_network_name

        else
            # Management IP provided, assuming forced tunneling is in use
            echo "with split tunneling enabled using public IP \"$management_ip_name\"..."
            
            mgmt_pip_id=$(az network public-ip show --name $management_ip_name --resource-group $firewall_resource_group -o tsv --query "id")

            # First ip-config must include management IP config and VNet info
            az network firewall ip-config create --name "AzureFirewallIpConfiguration0" --firewall-name $firewall_name --resource-group $firewall_resource_group --public-ip-address ${pip_ids[0]} --vnet-name $virtual_network_name --m-name "AzureFirewallMgmtIpConfiguration" --m-public-ip-address $mgmt_pip_id --m-vnet-name $virtual_network_name
        fi

        # Add remaining ip-configs, if there are any
        for ((i=1; i<${#pip_ids[@]}; i++)); do
            az network firewall ip-config create --name "AzureFirewallIpConfiguration$i" --firewall-name $firewall_name --resource-group $firewall_resource_group --public-ip-address ${pip_ids[$i]}
        done
    fi
        
fi
# End Script