Support for Azure Firewall Premium never implemented

[capdragon]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Important Factoids

I believe this issue was closed by mistake.

Expected Behaviour

There should be code related to premium firewall features.

Actual Behaviour

There is no code or documentation on enabling premium firewall features.

Steps to Reproduce

1. navigate to this PR which claims to have fixed 11438.
   

2. Inspect the files changed

3. You will notice the changes have nothing to do the firewall premium features such as TLS Inspection. Instead the change addresses features of azurerm_firewall_policy_rule_collection_group such as TLS Termination.

References

• Support for Azure Firewall Premium (preview) #11438

[capdragon]

@gro1m: Am I correct in this or am I missing something? Looks like the issue may have been tagged by mistake.

[mybayern1974]

@capdragon thank you for opening this issue. Firstly I must acknowledge I'm not the expert of the Azure Firewall premium story in TF, while from its naming, I found a similar feature that's already supported in TF by noticing sku, Premium wordings on that doc, and PR 12769 contributed to it. Could you please check whether this is your expectation?

[gro1m]

Hi @capdragon
It is indeed implemented, we use it at the company I work for successfully.
The thing is the Azure Firewall Premium needs an azurerm_firewall_policy. Without azurerm_firewall_policy resource, even if you set the sku to Premium in the resource configuration nothing will happen.
Check also here: https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/firewall_policy and search for intrusion detection. Furthermore also check https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/firewall_policy_rule_collection_group on how to specify destination urls (i.e. paths of websites which is a bit more general than FQDNs)

[capdragon]

Thank you guys, I'll make more of an effort to learn the ins and outs of these repos.

[capdragon]

I can't find the TLS inspection feature anywhere. I see intrusion detection, but not TLS inspection. Where is it?

Even on PR 12769, I don't see they implemented TLS inspection.

Perhaps that feature simply got overlooked?

[gro1m]

No it did not get overlooked.
You can specify a tls_certificate, see https://github.com/hashicorp/terraform-provider-azurerm/blob/1650e06cd8f55000f9bc0b91fd913155af413638/website/docs/r/firewall_policy.html.markdown.
and you can specify terminate_tls: https://github.com/hashicorp/terraform-provider-azurerm/blob/4eaf7e71e70ce6e07b7d89c41b354381f7d4ccc6/website/docs/r/firewall_policy_rule_collection_group.html.markdown.
Note that you need an Application Gateway, see also here: https://docs.microsoft.com/en-us/azure/firewall/premium-features#tls-inspection.

By the way, the naming is not synchronous with the Azure terms, as the maintainers here (which I am not part of!) prefer to use descriptive names and thus might change the naming.

Also realize that there is a still open (why?) issue here: #12140. So maybe you can try out the above and verify if it works or not and post your result there - thanks!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.