Share via


az network firewall policy

Note

This reference is part of the azure-firewall extension for the Azure CLI (version 2.67.0 or higher). The extension will automatically install the first time you run an az network firewall policy command. Learn more about extensions.

Manage and configure Azure firewall policy.

Commands

Name Description Type Status
az network firewall policy create

Create an Azure firewall policy.

Extension GA
az network firewall policy delete

Delete an Azure firewall policy.

Extension GA
az network firewall policy deploy

Deploys the firewall policy draft and child rule collection group drafts.

Extension Preview
az network firewall policy draft

Manage and configure Azure firewall policy draft,.

Extension GA
az network firewall policy draft create

Create a draft Firewall Policy.

Extension Preview
az network firewall policy draft delete

Delete a draft policy.

Extension GA
az network firewall policy draft intrusion-detection

Manage intrusion signature rules and bypass rules.

Extension GA
az network firewall policy draft intrusion-detection add

Update a draft Firewall Policy.

Extension Preview
az network firewall policy draft intrusion-detection list

List all intrusion detection configuration.

Extension Preview
az network firewall policy draft intrusion-detection remove

Update a draft Firewall Policy.

Extension Preview
az network firewall policy draft rule-collection-group Extension GA
az network firewall policy draft rule-collection-group wait

Place the CLI in a waiting state until a condition is met.

Extension GA
az network firewall policy draft show

Get a draft Firewall Policy.

Extension Preview
az network firewall policy draft update

Update a draft Firewall Policy.

Extension Preview
az network firewall policy draft wait

Place the CLI in a waiting state until a condition is met.

Extension GA
az network firewall policy intrusion-detection

Manage intrusion signature rules and bypass rules.

Extension GA
az network firewall policy intrusion-detection add

Update an Azure firewall policy.

Extension GA
az network firewall policy intrusion-detection list

List all intrusion detection configuration.

Extension GA
az network firewall policy intrusion-detection remove

Update an Azure firewall policy.

Extension GA
az network firewall policy list

List all Azure firewall policies.

Extension GA
az network firewall policy rule-collection-group

Manage and configure Azure firewall policy rule collection group.

Extension GA
az network firewall policy rule-collection-group collection

Manage and configure Azure firewall policy rule collections in the rule collection group.

Extension GA
az network firewall policy rule-collection-group collection add-filter-collection

Add a filter collection into an Azure firewall policy rule collection group.

Extension Preview
az network firewall policy rule-collection-group collection add-nat-collection

Add a NAT collection into an Azure firewall policy rule collection group.

Extension Preview
az network firewall policy rule-collection-group collection list

List all rule collections of an Azure firewall policy rule collection group.

Extension Preview
az network firewall policy rule-collection-group collection remove

Remove a rule collection from an Azure firewall policy rule collection group.

Extension Preview
az network firewall policy rule-collection-group collection rule

Manage and configure the rule of a filter collection in the rule collection group of Azure firewall policy.

Extension GA
az network firewall policy rule-collection-group collection rule add

Add a rule into an Azure firewall policy rule collection.

Extension Preview
az network firewall policy rule-collection-group collection rule remove

Remove a rule from an Azure firewall policy rule collection.

Extension Preview
az network firewall policy rule-collection-group collection rule update

Update a rule of an Azure firewall policy rule collection.

Extension Preview
az network firewall policy rule-collection-group create

Create an Azure firewall policy rule collection group.

Extension Preview
az network firewall policy rule-collection-group delete

Delete an Azure Firewall policy rule collection group.

Extension Preview
az network firewall policy rule-collection-group draft

Manage and configure Azure firewall policy rule-collection-group draft.

Extension GA
az network firewall policy rule-collection-group draft collection

Manage and configure Azure firewall policy rule collections in the rule collection group draft.

Extension GA
az network firewall policy rule-collection-group draft collection add-filter-collection

Add a filter collection into an Azure firewall policy rule collection group draft.

Extension Preview
az network firewall policy rule-collection-group draft collection add-nat-collection

Add a NAT collection into an Azure firewall policy rule collection group draft.

Extension Preview
az network firewall policy rule-collection-group draft collection list

List all rule collections of an Azure firewall policy rule collection group draft.

Extension Preview
az network firewall policy rule-collection-group draft collection remove

Remove a rule collection from an Azure firewall policy rule collection group draft.

Extension Preview
az network firewall policy rule-collection-group draft collection rule

Manage and configure the rule of a filter collection in the rule collection group of Azure firewall policy.

Extension GA
az network firewall policy rule-collection-group draft collection rule add

Add a rule into an Azure firewall policy draft rule collection.

Extension Preview
az network firewall policy rule-collection-group draft collection rule remove

Remove a rule from an Azure firewall policy rule collection draft.

Extension Preview
az network firewall policy rule-collection-group draft collection rule update

Update a rule of an Azure firewall policy rule collection.

Extension Preview
az network firewall policy rule-collection-group draft create

Create an Azure firewall policy rule collection group draft.

Extension Preview
az network firewall policy rule-collection-group draft delete

Delete Rule Collection Group Draft.

Extension Preview
az network firewall policy rule-collection-group draft show

Get Rule Collection Group Draft.

Extension Preview
az network firewall policy rule-collection-group draft update

Update an Azure firewall policy rule collection group.

Extension GA
az network firewall policy rule-collection-group list

List all Azure firewall policy rule collection groups.

Extension Preview
az network firewall policy rule-collection-group show

Show an Azure firewall policy rule collection group.

Extension Preview
az network firewall policy rule-collection-group update

Update an Azure firewall policy rule collection group.

Extension Preview
az network firewall policy rule-collection-group wait

Place the CLI in a waiting state until a condition is met.

Extension GA
az network firewall policy show

Show an Azure firewall policy.

Extension GA
az network firewall policy update

Update an Azure firewall policy.

Extension GA
az network firewall policy wait

Place the CLI in a waiting state until a condition is met.

Extension GA

az network firewall policy create

Create an Azure firewall policy.

az network firewall policy create --name
                                  --resource-group
                                  [--auto-learn-private-ranges --learn-ranges {Disabled, Enabled}]
                                  [--base-policy]
                                  [--cert-name]
                                  [--dns-servers]
                                  [--enable-dns-proxy {0, 1, f, false, n, no, t, true, y, yes}]
                                  [--explicit-proxy]
                                  [--fqdns]
                                  [--identity]
                                  [--idps-mode {Alert, Deny, Off}]
                                  [--idps-profile {Advanced, Basic, Standard}]
                                  [--ip-addresses]
                                  [--key-vault-secret-id]
                                  [--location]
                                  [--no-wait {0, 1, f, false, n, no, t, true, y, yes}]
                                  [--private-ranges]
                                  [--sku {Basic, Premium, Standard}]
                                  [--sql {0, 1, f, false, n, no, t, true, y, yes}]
                                  [--tags]
                                  [--threat-intel-mode {Alert, Deny, Off}]

Required Parameters

--name -n

The name of the Firewall Policy.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--auto-learn-private-ranges --learn-ranges

The operation mode for automatically learning private ranges to not be SNAT.

Property Value
Parameter group: Snat Arguments
Accepted values: Disabled, Enabled
--base-policy

The name or ID of parent firewall policy from which rules are inherited.

--cert-name
Preview

Name of the CA certificate.

Property Value
Parameter group: TLS Inspection Arguments
--dns-servers

Space-separated list of DNS server IP addresses. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property Value
Parameter group: DNS Arguments
--enable-dns-proxy

Enable DNS Proxy.

Property Value
Parameter group: DNS Arguments
Accepted values: 0, 1, f, false, n, no, t, true, y, yes
--explicit-proxy

Explicit Proxy Settings definition. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property Value
Parameter group: Explicit Proxy Arguments
--fqdns

Space-separated list of FQDNs. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property Value
Parameter group: Threat Intel Allowlist Arguments
--identity

Name or ID of the ManagedIdentity Resource.

--idps-mode
Preview

IDPS mode.

Property Value
Parameter group: Intrustion Detection Arguments
Accepted values: Alert, Deny, Off
--idps-profile
Preview

IDPS mode.

Property Value
Parameter group: Intrusion Detection Arguments
Accepted values: Advanced, Basic, Standard
--ip-addresses

Space-separated list of IPv4 addresses. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property Value
Parameter group: Threat Intel Allowlist Arguments
--key-vault-secret-id
Preview

Secret Id of (base-64 encoded unencrypted pfx) Secret or Certificate object stored in KeyVault.

Property Value
Parameter group: TLS Inspection Arguments
--location -l

Location. Values from: az account list-locations. You can configure the default location using az configure --defaults location=<location>.

--no-wait

Do not wait for the long-running operation to finish.

Property Value
Accepted values: 0, 1, f, false, n, no, t, true, y, yes
--private-ranges

List of private IP addresses/IP address ranges to not be SNAT. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property Value
Parameter group: Snat Arguments
--sku
Preview

SKU of Firewall policy.

Property Value
Accepted values: Basic, Premium, Standard
--sql
Preview

A flag to indicate if SQL Redirect traffic filtering is enabled.

Property Value
Accepted values: 0, 1, f, false, n, no, t, true, y, yes
--tags

Space-separated tags: key[=value] [key[=value] ...]. Use "" to clear existing tags. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--threat-intel-mode

The operation mode for Threat Intelligence.

Property Value
Accepted values: Alert, Deny, Off
Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False

az network firewall policy delete

Delete an Azure firewall policy.

az network firewall policy delete [--ids]
                                  [--name]
                                  [--no-wait {0, 1, f, false, n, no, t, true, y, yes}]
                                  [--resource-group]
                                  [--subscription]

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

Property Value
Parameter group: Resource Id Arguments
--name -n

The name of the Firewall Policy.

Property Value
Parameter group: Resource Id Arguments
--no-wait

Do not wait for the long-running operation to finish.

Property Value
Accepted values: 0, 1, f, false, n, no, t, true, y, yes
--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Property Value
Parameter group: Resource Id Arguments
--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Property Value
Parameter group: Resource Id Arguments
Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False

az network firewall policy deploy

Preview

This command is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus

Deploys the firewall policy draft and child rule collection group drafts.

az network firewall policy deploy [--ids]
                                  [--name]
                                  [--no-wait {0, 1, f, false, n, no, t, true, y, yes}]
                                  [--resource-group]
                                  [--subscription]

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

Property Value
Parameter group: Resource Id Arguments
--name -n

The name of the Firewall Policy.

Property Value
Parameter group: Resource Id Arguments
--no-wait

Do not wait for the long-running operation to finish.

Property Value
Accepted values: 0, 1, f, false, n, no, t, true, y, yes
--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Property Value
Parameter group: Resource Id Arguments
--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Property Value
Parameter group: Resource Id Arguments
Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False

az network firewall policy list

List all Azure firewall policies.

az network firewall policy list [--max-items]
                                [--next-token]
                                [--resource-group]

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--max-items

Total number of items to return in the command's output. If the total number of items available is more than the value specified, a token is provided in the command's output. To resume pagination, provide the token value in --next-token argument of a subsequent command.

Property Value
Parameter group: Pagination Arguments
--next-token

Token to specify where to start paginating. This is the token value from a previously truncated response.

Property Value
Parameter group: Pagination Arguments
--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False

az network firewall policy show

Show an Azure firewall policy.

az network firewall policy show [--expand]
                                [--ids]
                                [--name]
                                [--resource-group]
                                [--subscription]

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--expand

Expands referenced resources. Default value is None.

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

Property Value
Parameter group: Resource Id Arguments
--name -n

The name of the Firewall Policy.

Property Value
Parameter group: Resource Id Arguments
--resource-group -g

The name of the resource group.

Property Value
Parameter group: Resource Id Arguments
--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Property Value
Parameter group: Resource Id Arguments
Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False

az network firewall policy update

Update an Azure firewall policy.

az network firewall policy update [--add]
                                  [--auto-learn-private-ranges --learn-ranges {Disabled, Enabled}]
                                  [--cert-name]
                                  [--dns-servers]
                                  [--enable-dns-proxy {0, 1, f, false, n, no, t, true, y, yes}]
                                  [--explicit-proxy]
                                  [--force-string {0, 1, f, false, n, no, t, true, y, yes}]
                                  [--fqdns]
                                  [--identity]
                                  [--idps-mode {Alert, Deny, Off}]
                                  [--idps-profile {Advanced, Basic, Standard}]
                                  [--ids]
                                  [--ip-addresses]
                                  [--key-vault-secret-id]
                                  [--name]
                                  [--no-wait {0, 1, f, false, n, no, t, true, y, yes}]
                                  [--private-ranges]
                                  [--remove]
                                  [--resource-group]
                                  [--set]
                                  [--sku {Basic, Premium, Standard}]
                                  [--sql {0, 1, f, false, n, no, t, true, y, yes}]
                                  [--subscription]
                                  [--tags]
                                  [--threat-intel-mode {Alert, Deny, Off}]

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--add

Add an object to a list of objects by specifying a path and key value pairs. Example: --add property.listProperty <key=value, string or JSON string>.

Property Value
Parameter group: Generic Update Arguments
--auto-learn-private-ranges --learn-ranges

The operation mode for automatically learning private ranges to not be SNAT.

Property Value
Parameter group: Snat Arguments
Accepted values: Disabled, Enabled
--cert-name
Preview

Name of the CA certificate.

Property Value
Parameter group: TLS Inspection Arguments
--dns-servers

Space-separated list of DNS server IP addresses. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property Value
Parameter group: DNS Arguments
--enable-dns-proxy

Enable DNS Proxy.

Property Value
Parameter group: DNS Arguments
Accepted values: 0, 1, f, false, n, no, t, true, y, yes
--explicit-proxy

Explicit Proxy Settings definition. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property Value
Parameter group: Explicit Proxy Arguments
--force-string

When using 'set' or 'add', preserve string literals instead of attempting to convert to JSON.

Property Value
Parameter group: Generic Update Arguments
Accepted values: 0, 1, f, false, n, no, t, true, y, yes
--fqdns

Space-separated list of FQDNs. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property Value
Parameter group: Threat Intel Allowlist Arguments
--identity

Name or ID of the ManagedIdentity Resource.

--idps-mode

IDPS mode.

Property Value
Parameter group: Intrusion Detection Arguments
Accepted values: Alert, Deny, Off
--idps-profile
Preview

IDPS mode.

Property Value
Parameter group: Intrusion Detection Arguments
Accepted values: Advanced, Basic, Standard
--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

Property Value
Parameter group: Resource Id Arguments
--ip-addresses

Space-separated list of IPv4 addresses. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property Value
Parameter group: Threat Intel Allowlist Arguments
--key-vault-secret-id
Preview

Secret Id of (base-64 encoded unencrypted pfx) Secret or Certificate object stored in KeyVault.

Property Value
Parameter group: TLS Inspection Arguments
--name -n

The name of the Firewall Policy.

Property Value
Parameter group: Resource Id Arguments
--no-wait

Do not wait for the long-running operation to finish.

Property Value
Accepted values: 0, 1, f, false, n, no, t, true, y, yes
--private-ranges

List of private IP addresses/IP address ranges to not be SNAT. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property Value
Parameter group: Snat Arguments
--remove

Remove a property or an element from a list. Example: --remove property.list <indexToRemove> OR --remove propertyToRemove.

Property Value
Parameter group: Generic Update Arguments
--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Property Value
Parameter group: Resource Id Arguments
--set

Update an object by specifying a property path and value to set. Example: --set property1.property2=<value>.

Property Value
Parameter group: Generic Update Arguments
--sku

SKU of Firewall policy.

Property Value
Accepted values: Basic, Premium, Standard
--sql
Preview

A flag to indicate if SQL Redirect traffic filtering is enabled.

Property Value
Accepted values: 0, 1, f, false, n, no, t, true, y, yes
--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Property Value
Parameter group: Resource Id Arguments
--tags

Space-separated tags: key[=value] [key[=value] ...]. Use "" to clear existing tags. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--threat-intel-mode

The operation mode for Threat Intelligence.

Property Value
Accepted values: Alert, Deny, Off
Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False

az network firewall policy wait

Place the CLI in a waiting state until a condition is met.

az network firewall policy wait [--created]
                                [--custom]
                                [--deleted]
                                [--exists]
                                [--expand]
                                [--ids]
                                [--interval]
                                [--name]
                                [--resource-group]
                                [--subscription]
                                [--timeout]
                                [--updated]

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--created

Wait until created with 'provisioningState' at 'Succeeded'.

Property Value
Parameter group: Wait Condition Arguments
Default value: False
--custom

Wait until the condition satisfies a custom JMESPath query. E.g. provisioningState!='InProgress', instanceView.statuses[?code=='PowerState/running'].

Property Value
Parameter group: Wait Condition Arguments
--deleted

Wait until deleted.

Property Value
Parameter group: Wait Condition Arguments
Default value: False
--exists

Wait until the resource exists.

Property Value
Parameter group: Wait Condition Arguments
Default value: False
--expand

Expands referenced resources. Default value is None.

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

Property Value
Parameter group: Resource Id Arguments
--interval

Polling interval in seconds.

Property Value
Parameter group: Wait Condition Arguments
Default value: 30
--name -n

The name of the Firewall Policy.

Property Value
Parameter group: Resource Id Arguments
--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Property Value
Parameter group: Resource Id Arguments
--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Property Value
Parameter group: Resource Id Arguments
--timeout

Maximum wait in seconds.

Property Value
Parameter group: Wait Condition Arguments
Default value: 3600
--updated

Wait until updated with provisioningState at 'Succeeded'.

Property Value
Parameter group: Wait Condition Arguments
Default value: False
Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False