Azure / Azure/Azure-Landing-Zones
Create Azure Firewall without the public IP exposed in AzureFirewallSubnet
- Dominant language
- PowerShell
- Stars
- 96
- Forks
- 70
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 7
Description
### Community Note
- Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
- Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
- If you are interested in working on this issue or have submitted a pull request, please leave a comment
### Description
#### Is your feature request related to a problem?
Is there a possibility to create an Azure Firewall without the public IP exposed in the AzureFirewallSubnet?
#### Describe the solution you'd like
We have some situations where we need to deploy an Azure Firewall solution but there is already an existing proxy that will act as an entry point exposed to the public, therefore the public IP created in the AzureFirewallSubnet should not be needed as the comunication is expected to be internal, and as explained in the documentation to the question "Can I deploy Azure Firewall without a public IP address?": "Yes, but you must configure the firewall in Forced Tunneling Mode. This configuration creates a management interface with a public IP address that is used by Azure Firewall for its operations. This public IP address is for management traffic. It is used exclusively by the Azure platform and can't be used for any other purpose. The tenant data path network can be configured without a public IP address, and Internet traffic can be forced tunneled to another Firewall or completely blocked."
Contributor guide
Research direction
Start by reviewing the Azure Firewall forced-tunneling behavior described in the issue and the repository's current Azure Firewall deployment entry point. Done means determining whether the data-path public IP can be omitted while preserving the required management interface, and documenting or implementing the supported deployment behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- cloud, networking
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100