文档建议反馈控制台
首页
学习
活动
专区
圈层
工具
MCP广场
文章/答案/技术大牛
发布
社区首页 >问答首页 >应用网关ARM模板.启用防火墙的参数

问应用网关ARM模板.启用防火墙的参数
EN

Stack Overflow用户
提问于 2019-03-21 00:39:07
回答 2查看 1.3K关注 0票数 2

我有一个工作的ARM模板来部署一个启用WAF的应用程序网关，这目前总是启用防火墙并根据参数设置防火墙模式。

我们希望参数化启用WAF，以便可以在没有WAF的情况下部署AGW。

属性中的对象如下所示：

代码语言：javascript
复制
"webApplicationFirewallConfiguration": {
                "enabled": "[parameters('applicationGateway').firewallEnabled]",
                "firewallMode": "[parameters('applicationGateway').firewallMode]",
                "ruleSetType": "OWASP",
                "ruleSetVersion": "3.0"
            }

参数文件具有以下设置：

代码语言：javascript
复制
                "firewallEnabled": false,
                "Tier": "Standard",
                "skuSize": "Standard_Medium",

但是，在部署时，它错误地试图启用防火墙。

代码语言：javascript
复制
New-AzResourceGroupDeployment : 11:28:27 AM - Error:
Code=ApplicationGatewayFirewallCannotBeEnabledForSelectedSku;
Message=Application Gateway 
/subscriptions//providers/Microsoft.Network/applicationGatewa
ys/EXAMPLE-AGW does not support WebApplicationFirewall with the
selected SKU tier Standard

看起来它仍然在尝试启用防火墙，尽管“启用：”属性将是假的，我假设它会忽略对象中的其他属性，但显然不会。有人能看到我做错了什么吗？

azure
arm-template
azure-application-gateway
EN

回答 2

Stack Overflow用户

回答已采纳

发布于 2019-03-21 11:11:21

失败原因:标准层AppGateway不支持 As WebApplicationFirewall，即使已启用的模板验证设置为false，因为验证将"webApplicationFirewallConfiguration“键本身视为标准层无效。

修补程序：使用嵌套模板创建应用程序网关模板的子部署，如果禁用防火墙，则不使用"webApplicationFirewallConfiguration“，如果在参数文件中启用防火墙模式值，则使用"webApplicationFirewallConfiguration”的模板。

工作示例:请在根模板下面找到用于部署的，以及启用和禁用防火墙的两个模板。然后，它有两个参数文件-一个用于启用防火墙，另一个用于禁用的。

要试用此示例，请执行以下步骤：

  1. 将两个子模板上载到Blob存储中。
  2. 使这个Blob容器，其中的模板被上传，可访问或使用SAS令牌，同时创建模板的网址。
  3. 用上传子模板的urls更新根模板中的变量"appGatewaysTemplateWaffalse“和"appGatewaysTemplateWaftrue”。
  4. Go https://portal.azure.com/#create/Microsoft.Template ->“在编辑器中构建自己的模板”。
  5. 在urls和参数文件(已启用或禁用)中按需要使用此更新的根模板。

根模板(VNet +子部署)：

代码语言：javascript
复制
{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "applicationGateway": {
      "type": "object",
      "metadata": {
        "description": "Application gateway specific information"
      }
    },
    "virtualNetworkName": {
      "type": "string",
      "metadata": {
        "description": "virtual network name"
      }
    },
    "vnetAddressPrefix": {
      "type": "string",
      "defaultValue": "10.0.0.0/16",
      "metadata": {
        "description": "virtual network address range"
      }
    },
    "subnetName": {
      "type": "string",
      "defaultValue": "subnet1",
      "metadata": {
        "description": "Subnet Name"
      }
    },
    "subnetPrefix": {
      "type": "string",
      "defaultValue": "10.0.0.0/24",
      "metadata": {
        "description": "Subnet prefix"
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location for all resources."
      }
    }
  },
  "variables": {
    "subnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('subnetName'))]",
    "appGatewaysTemplateWaffalse": "https://da2.blob.core.windows.net/templates/app-gateway-waf-false.json",
    "appGatewaysTemplateWaftrue": "https://da2.blob.core.windows.net/templates/app-gateway-waf-true.json"
  },
  "resources": [
    {
      "apiVersion": "2015-06-15",
      "type": "Microsoft.Network/virtualNetworks",
      "name": "[parameters('virtualNetworkName')]",
      "location": "[parameters('location')]",
      "properties": {
        "addressSpace": {
          "addressPrefixes": [
            "[parameters('vnetAddressPrefix')]"
          ]
        },
        "subnets": [
          {
            "name": "[parameters('subnetName')]",
            "properties": {
              "addressPrefix": "[parameters('subnetPrefix')]"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2015-01-01",
      "name": "azure-appGateways-non-waf-deployment",
      "dependsOn": [
        "[concat('Microsoft.Network/virtualNetworks/', parameters('virtualNetworkName'))]"
      ],
      "properties": {
        "mode": "Incremental",
        "templateLink": {
          "uri": "[variables(concat('appGatewaysTemplateWaf',string(parameters('applicationGateway').firewallEnabled)))]"
        },
        "parameters": {
          "applicationGateway": {
            "value": "[parameters('applicationGateway')]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "subnetRef": {
            "value": "[variables('subnetRef')]"
          }
        }
      }
    }
  ]
}

没有webApplicationFirewallConfiguration的子模板：

代码语言：javascript
复制
{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "applicationGateway": {
      "type": "object",
      "metadata": {
        "description": "Application gateway specific information"
      }
    },
    "subnetRef": {
      "type": "string",
      "defaultValue": "subnet id",
      "metadata": {
        "description": "Subnet Id"
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location for all resources."
      }
    }
  },
  "variables": {},
  "resources": [
    {
      "apiVersion": "2017-06-01",
      "name": "[parameters('applicationGateway').applicationGatewayName]",
      "type": "Microsoft.Network/applicationGateways",
      "location": "[parameters('location')]",
      "dependsOn": [],
      "properties": {
        "sku": {
          "name": "[parameters('applicationGateway').applicationGatewaySize]",
          "tier": "[parameters('applicationGateway').skuTier]",
          "capacity": "[parameters('applicationGateway').applicationGatewayInstanceCount]"
        },
        "gatewayIPConfigurations": [
          {
            "name": "appGatewayIpConfig",
            "properties": {
              "subnet": {
                "id": "[parameters('subnetRef')]"
              }
            }
          }
        ],
        "frontendIPConfigurations": [
          {
            "name": "appGatewayFrontendIP",
            "properties": {
              "subnet": {
                "id": "[parameters('subnetRef')]"
              }
            }
          }
        ],
        "frontendPorts": [
          {
            "name": "appGatewayFrontendPort",
            "properties": {
              "Port": "[parameters('applicationGateway').frontendPort]"
            }
          }
        ],
        "backendAddressPools": [
          {
            "name": "appGatewayBackendPool",
            "properties": {
              "BackendAddresses": "[parameters('applicationGateway').backendIPAddresses]"
            }
          }
        ],
        "backendHttpSettingsCollection": [
          {
            "name": "appGatewayBackendHttpSettings",
            "properties": {
              "Port": "[parameters('applicationGateway').backendPort]",
              "Protocol": "Http",
              "CookieBasedAffinity": "[parameters('applicationGateway').cookieBasedAffinity]"
            }
          }
        ],
        "httpListeners": [
          {
            "name": "appGatewayHttpListener",
            "properties": {
              "FrontendIpConfiguration": {
                "Id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/frontendIPConfigurations/appGatewayFrontendIP')]"
              },
              "FrontendPort": {
                "Id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/frontendPorts/appGatewayFrontendPort')]"
              },
              "Protocol": "Http",
              "SslCertificate": null
            }
          }
        ],
        "requestRoutingRules": [
          {
            "Name": "rule1",
            "properties": {
              "RuleType": "Basic",
              "httpListener": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/httpListeners/appGatewayHttpListener')]"
              },
              "backendAddressPool": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/backendAddressPools/appGatewayBackendPool')]"
              },
              "backendHttpSettings": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/backendHttpSettingsCollection/appGatewayBackendHttpSettings')]"
              }
            }
          }
        ]
      }
    }
  ]
}

带有webApplicationFirewallConfiguration的子模板：

代码语言：javascript
复制
{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "applicationGateway": {
      "type": "object",
      "metadata": {
        "description": "Application gateway specific information"
      }
    },
    "subnetRef": {
      "type": "string",
      "defaultValue": "subnet id",
      "metadata": {
        "description": "Subnet Id"
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location for all resources."
      }
    }
  },
  "variables": {},
  "resources": [
    {
      "apiVersion": "2017-06-01",
      "name": "[parameters('applicationGateway').applicationGatewayName]",
      "type": "Microsoft.Network/applicationGateways",
      "location": "[parameters('location')]",
      "dependsOn": [],
      "properties": {
        "sku": {
          "name": "[parameters('applicationGateway').applicationGatewaySize]",
          "tier": "[parameters('applicationGateway').skuTier]",
          "capacity": "[parameters('applicationGateway').applicationGatewayInstanceCount]"
        },
        "gatewayIPConfigurations": [
          {
            "name": "appGatewayIpConfig",
            "properties": {
              "subnet": {
                "id": "[parameters('subnetRef')]"
              }
            }
          }
        ],
        "frontendIPConfigurations": [
          {
            "name": "appGatewayFrontendIP",
            "properties": {
              "subnet": {
                "id": "[parameters('subnetRef')]"
              }
            }
          }
        ],
        "frontendPorts": [
          {
            "name": "appGatewayFrontendPort",
            "properties": {
              "Port": "[parameters('applicationGateway').frontendPort]"
            }
          }
        ],
        "backendAddressPools": [
          {
            "name": "appGatewayBackendPool",
            "properties": {
              "BackendAddresses": "[parameters('applicationGateway').backendIPAddresses]"
            }
          }
        ],
        "backendHttpSettingsCollection": [
          {
            "name": "appGatewayBackendHttpSettings",
            "properties": {
              "Port": "[parameters('applicationGateway').backendPort]",
              "Protocol": "Http",
              "CookieBasedAffinity": "[parameters('applicationGateway').cookieBasedAffinity]"
            }
          }
        ],
        "httpListeners": [
          {
            "name": "appGatewayHttpListener",
            "properties": {
              "FrontendIpConfiguration": {
                "Id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/frontendIPConfigurations/appGatewayFrontendIP')]"
              },
              "FrontendPort": {
                "Id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/frontendPorts/appGatewayFrontendPort')]"
              },
              "Protocol": "Http",
              "SslCertificate": null
            }
          }
        ],
        "webApplicationFirewallConfiguration": {
            "enabled": "[parameters('applicationGateway').firewallEnabled]",
            "firewallMode": "[parameters('applicationGateway').firewallMode]",
            "ruleSetType": "OWASP",
            "ruleSetVersion": "3.0"
        },
        "requestRoutingRules": [
          {
            "Name": "rule1",
            "properties": {
              "RuleType": "Basic",
              "httpListener": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/httpListeners/appGatewayHttpListener')]"
              },
              "backendAddressPool": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/backendAddressPools/appGatewayBackendPool')]"
              },
              "backendHttpSettings": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('applicationGateway').applicationGatewayName), '/backendHttpSettingsCollection/appGatewayBackendHttpSettings')]"
              }
            }
          }
        ]
      }
    }
  ]
}

禁用防火墙的参数：

代码语言：javascript
复制
{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "applicationGateway": {
        "value": {
            "firewallEnabled": "false",
            "skuTier": "Standard",
            "applicationGatewayName": "yourappgateway",
            "applicationGatewaySize": "Standard_Small",
            "applicationGatewayInstanceCount": 1,
            "frontendPort": 80,
            "backendPort": 80,
            "backendIPAddresses": [
                {
                "IpAddress": "10.0.0.7"
                },
                {
                "IpAddress": "10.0.0.8"
                },
                {
                "IpAddress": "10.0.0.9"
                }
            ],
            "cookieBasedAffinity": "Disabled"
        }
    },
    "virtualNetworkName": {
      "value": "yourvnetname"
    },
    "vnetAddressPrefix": {
      "value": "10.0.0.0/16"
    },
    "subnetName": {
      "value": "yoursubnet"
    },
    "subnetPrefix": {
      "value": "10.0.0.0/24"
    }
  }
}

启用防火墙的参数：

代码语言：javascript
复制
{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "applicationGateway": {
        "value": {
            "firewallEnabled": "true",
            "firewallMode": "Detection",
            "skuTier": "WAF",
            "applicationGatewayName": "yourappgateway",
            "applicationGatewaySize": "WAF_Medium",
            "applicationGatewayInstanceCount": 1,
            "frontendPort": 80,
            "backendPort": 80,
            "backendIPAddresses": [
                {
                "IpAddress": "10.0.0.7"
                },
                {
                "IpAddress": "10.0.0.8"
                },
                {
                "IpAddress": "10.0.0.9"
                }
            ],
            "cookieBasedAffinity": "Disabled"
        }
    },
    "virtualNetworkName": {
      "value": "yourvnetname"
    },
    "vnetAddressPrefix": {
      "value": "10.0.0.0/16"
    },
    "subnetName": {
      "value": "yoursubnet"
    },
    "subnetPrefix": {
      "value": "10.0.0.0/24"
    }
  }
}
票数 0
EN

Stack Overflow用户

发布于 2019-03-21 06:18:11

不知道为什么会发生这种情况，但您可以始终这样做：

代码语言：javascript
复制
"variables": {
    "waffalse": {
        "enabled": false
    },
    "waftrue": {
        "enabled": true,
        "firewallMode": "[parameters('applicationGateway').firewallMode]",
        "ruleSetType": "OWASP",
        "ruleSetVersion": "3.0"
    }
}
...
"webApplicationFirewallConfiguration": "[variables(concat('waf', string(parameters('applicationGateway').firewallEnabled)))]"

因此，根据条件使用一个变量或另一个变量。

票数 0
EN
页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：

https://stackoverflow.com/questions/55272127

复制
相关文章

相似问题

领券

腾讯云开发者

扫码关注腾讯云开发者

扫码关注腾讯云开发者

领取腾讯云代金券

热门产品

热门推荐

更多推荐

Copyright © 2013 - 2026 Tencent Cloud. All Rights Reserved. 腾讯云 版权所有 

深圳市腾讯计算机系统有限公司 ICP备案/许可证号：粤B2-20090059 粤公网安备44030502008569号

腾讯云计算（北京）有限责任公司 京ICP证150476号 |  京ICP备11018762号

问题归档专栏文章快讯文章归档关键词归档开发者手册归档开发者手册 Section 归档