Microsoft.Network firewallPolicies/ruleCollectionGroups

Bicep 資源定義

firewallPolicies/ruleCollectionGroups 資源類型可以使用目標作業來部署：

有關每個 API 版本中已更改屬性的清單，請參閱 更改紀錄。

資源格式

若要建立 Microsoft.Network/firewallPolicies/ruleCollectionGroups 資源，請將下列 Bicep 新增至範本。

resource symbolicname 'Microsoft.Network/firewallPolicies/ruleCollectionGroups@2025-03-01' = {
  parent: resourceSymbolicName
  name: 'string'
  properties: {
    priority: int
    ruleCollections: [
      {
        name: 'string'
        priority: int
        ruleCollectionType: 'string'
        // For remaining properties, see FirewallPolicyRuleCollection objects
      }
    ]
  }
}

FirewallPolicyRule 物件

設定 ruleType 屬性，以指定物件的類型。

針對 ApplicationRule，請使用：

{
  destinationAddresses: [
    'string'
  ]
  fqdnTags: [
    'string'
  ]
  httpHeadersToInsert: [
    {
      headerName: 'string'
      headerValue: 'string'
    }
  ]
  protocols: [
    {
      port: int
      protocolType: 'string'
    }
  ]
  ruleType: 'ApplicationRule'
  sourceAddresses: [
    'string'
  ]
  sourceIpGroups: [
    'string'
  ]
  targetFqdns: [
    'string'
  ]
  targetUrls: [
    'string'
  ]
  terminateTLS: bool
  webCategories: [
    'string'
  ]
}

針對 NatRule，請使用：

{
  destinationAddresses: [
    'string'
  ]
  destinationPorts: [
    'string'
  ]
  ipProtocols: [
    'string'
  ]
  ruleType: 'NatRule'
  sourceAddresses: [
    'string'
  ]
  sourceIpGroups: [
    'string'
  ]
  translatedAddress: 'string'
  translatedFqdn: 'string'
  translatedPort: 'string'
}

針對 NetworkRule，請使用：

{
  destinationAddresses: [
    'string'
  ]
  destinationFqdns: [
    'string'
  ]
  destinationIpGroups: [
    'string'
  ]
  destinationPorts: [
    'string'
  ]
  ipProtocols: [
    'string'
  ]
  ruleType: 'NetworkRule'
  sourceAddresses: [
    'string'
  ]
  sourceIpGroups: [
    'string'
  ]
}

FirewallPolicyRuleCollection 物件

設定 ruleCollectionType 屬性 ruleCollectionType，以指定物件的類型。

針對 FirewallPolicyFilterRuleCollection，請使用：

{
  action: {
    type: 'string'
  }
  ruleCollectionType: 'FirewallPolicyFilterRuleCollection'
  rules: [
    {
      description: 'string'
      name: 'string'
      ruleType: 'string'
      // For remaining properties, see FirewallPolicyRule objects
    }
  ]
}

針對 FirewallPolicyNatRuleCollection，請使用：

{
  action: {
    type: 'string'
  }
  ruleCollectionType: 'FirewallPolicyNatRuleCollection'
  rules: [
    {
      description: 'string'
      name: 'string'
      ruleType: 'string'
      // For remaining properties, see FirewallPolicyRule objects
    }
  ]
}

屬性值

Microsoft.Network/firewallPolicies/ruleCollectionGroups

ApplicationRule

FirewallPolicyFilterRuleCollection

FirewallPolicyFilterRuleCollectionAction

FirewallPolicyHttpHeaderToInsert

FirewallPolicyNatRuleCollection

FirewallPolicyNatRuleCollectionAction

FirewallPolicyRule

FirewallPolicyRuleApplicationProtocol

FirewallPolicyRuleCollection

FirewallPolicyRuleCollectionGroupProperties

NatRule

NetworkRule

使用範例

Azure 快速入門範例

下列 Azure 快速入門範本 包含用於部署此資源類型的 Bicep 範例。

ARM 樣本資源定義

firewallPolicies/ruleCollectionGroups 資源類型可以使用目標作業來部署：

有關每個 API 版本中已更改屬性的清單，請參閱 更改紀錄。

資源格式

若要建立 Microsoft.Network/firewallPolicies/ruleCollectionGroups 資源，請將下列 JSON 新增至範本。

{
  "type": "Microsoft.Network/firewallPolicies/ruleCollectionGroups",
  "apiVersion": "2025-03-01",
  "name": "string",
  "properties": {
    "priority": "int",
    "ruleCollections": [ {
      "name": "string",
      "priority": "int",
      "ruleCollectionType": "string"
      // For remaining properties, see FirewallPolicyRuleCollection objects
    } ]
  }
}

FirewallPolicyRule 物件

設定 ruleType 屬性，以指定物件的類型。

針對 ApplicationRule，請使用：

{
  "destinationAddresses": [ "string" ],
  "fqdnTags": [ "string" ],
  "httpHeadersToInsert": [
    {
      "headerName": "string",
      "headerValue": "string"
    }
  ],
  "protocols": [
    {
      "port": "int",
      "protocolType": "string"
    }
  ],
  "ruleType": "ApplicationRule",
  "sourceAddresses": [ "string" ],
  "sourceIpGroups": [ "string" ],
  "targetFqdns": [ "string" ],
  "targetUrls": [ "string" ],
  "terminateTLS": "bool",
  "webCategories": [ "string" ]
}

針對 NatRule，請使用：

{
  "destinationAddresses": [ "string" ],
  "destinationPorts": [ "string" ],
  "ipProtocols": [ "string" ],
  "ruleType": "NatRule",
  "sourceAddresses": [ "string" ],
  "sourceIpGroups": [ "string" ],
  "translatedAddress": "string",
  "translatedFqdn": "string",
  "translatedPort": "string"
}

針對 NetworkRule，請使用：

{
  "destinationAddresses": [ "string" ],
  "destinationFqdns": [ "string" ],
  "destinationIpGroups": [ "string" ],
  "destinationPorts": [ "string" ],
  "ipProtocols": [ "string" ],
  "ruleType": "NetworkRule",
  "sourceAddresses": [ "string" ],
  "sourceIpGroups": [ "string" ]
}

FirewallPolicyRuleCollection 物件

設定 ruleCollectionType 屬性 ruleCollectionType，以指定物件的類型。

針對 FirewallPolicyFilterRuleCollection，請使用：

{
  "action": {
    "type": "string"
  },
  "ruleCollectionType": "FirewallPolicyFilterRuleCollection",
  "rules": [ {
    "description": "string",
    "name": "string",
    "ruleType": "string"
    // For remaining properties, see FirewallPolicyRule objects
  } ]
}

針對 FirewallPolicyNatRuleCollection，請使用：

{
  "action": {
    "type": "string"
  },
  "ruleCollectionType": "FirewallPolicyNatRuleCollection",
  "rules": [ {
    "description": "string",
    "name": "string",
    "ruleType": "string"
    // For remaining properties, see FirewallPolicyRule objects
  } ]
}

屬性值

Microsoft.Network/firewallPolicies/ruleCollectionGroups

ApplicationRule

FirewallPolicyFilterRuleCollection

FirewallPolicyFilterRuleCollectionAction

FirewallPolicyHttpHeaderToInsert

FirewallPolicyNatRuleCollection

FirewallPolicyNatRuleCollectionAction

FirewallPolicyRule

FirewallPolicyRuleApplicationProtocol

FirewallPolicyRuleCollection

FirewallPolicyRuleCollectionGroupProperties

NatRule

NetworkRule

使用範例

Azure 快速入門範本

下列 Azure 快速入門範本 會部署此資源類型。

Template	Description
使用規則和 Ipgroups 建立防火牆和 FirewallPolicy	此範本會部署具有防火牆原則的 Azure 防火牆（包括多個應用程式和網路規則），以參考應用程式和網路規則中的 IP 群組。
受保護的虛擬中樞	此範本會使用 Azure 防火牆建立安全的虛擬中樞，以保護目的地為因特網的雲端網路流量。
SharePoint 訂閱 / 2019 / 2016 已完全設定	建立 DC、SQL Server 2022，以及 1 到 5 部裝載 SharePoint 訂用帳戶/2019/2016 伺服器陣列的伺服器，並具有廣泛的設定，包括受信任的驗證、具有個人網站的使用者設定檔、OAuth 信任 （使用憑證）、用於裝載高信任增益集的專用 IIS 網站等...安裝了最新版本的關鍵軟體（包括Fiddler、vscode、np++、7zip、ULS Viewer）。 SharePoint 機器具有額外的微調，使其可立即使用（遠端管理工具、Edge 和 Chrome 的自訂策略、捷徑等）。
適用於 Azure 防火牆進階 測試環境	此範本會建立具有進階功能的 Azure 防火牆進階和防火牆原則，例如入侵檢測 （IDPS）、TLS 檢查和 Web 類別篩選
在中樞和輪輻拓撲中使用 Azure 防火牆作為 DNS Proxy	此範例示範如何使用 Azure 防火牆在 Azure 中部署中樞輪輻拓撲。 中樞虛擬網路可作為透過虛擬網路對等互連連線到中樞虛擬網路之許多輪輻虛擬網路的中央點。

Terraform （AzAPI 提供者） 資源定義

firewallPolicies/ruleCollectionGroups 資源類型可以使用目標作業來部署：

有關每個 API 版本中已更改屬性的清單，請參閱 更改紀錄。

資源格式

若要建立 Microsoft.Network/firewallPolicies/ruleCollectionGroups 資源，請將下列 Terraform 新增至範本。

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.Network/firewallPolicies/ruleCollectionGroups@2025-03-01"
  name = "string"
  parent_id = "string"
  body = {
    properties = {
      priority = int
      ruleCollections = [
        {
          name = "string"
          priority = int
          ruleCollectionType = "string"
          // For remaining properties, see FirewallPolicyRuleCollection objects
        }
      ]
    }
  }
}

FirewallPolicyRule 物件

設定 ruleType 屬性，以指定物件的類型。

針對 ApplicationRule，請使用：

{
  destinationAddresses = [
    "string"
  ]
  fqdnTags = [
    "string"
  ]
  httpHeadersToInsert = [
    {
      headerName = "string"
      headerValue = "string"
    }
  ]
  protocols = [
    {
      port = int
      protocolType = "string"
    }
  ]
  ruleType = "ApplicationRule"
  sourceAddresses = [
    "string"
  ]
  sourceIpGroups = [
    "string"
  ]
  targetFqdns = [
    "string"
  ]
  targetUrls = [
    "string"
  ]
  terminateTLS = bool
  webCategories = [
    "string"
  ]
}

針對 NatRule，請使用：

{
  destinationAddresses = [
    "string"
  ]
  destinationPorts = [
    "string"
  ]
  ipProtocols = [
    "string"
  ]
  ruleType = "NatRule"
  sourceAddresses = [
    "string"
  ]
  sourceIpGroups = [
    "string"
  ]
  translatedAddress = "string"
  translatedFqdn = "string"
  translatedPort = "string"
}

針對 NetworkRule，請使用：

{
  destinationAddresses = [
    "string"
  ]
  destinationFqdns = [
    "string"
  ]
  destinationIpGroups = [
    "string"
  ]
  destinationPorts = [
    "string"
  ]
  ipProtocols = [
    "string"
  ]
  ruleType = "NetworkRule"
  sourceAddresses = [
    "string"
  ]
  sourceIpGroups = [
    "string"
  ]
}

FirewallPolicyRuleCollection 物件

設定 ruleCollectionType 屬性 ruleCollectionType，以指定物件的類型。

針對 FirewallPolicyFilterRuleCollection，請使用：

{
  action = {
    type = "string"
  }
  ruleCollectionType = "FirewallPolicyFilterRuleCollection"
  rules = [
    {
      description = "string"
      name = "string"
      ruleType = "string"
      // For remaining properties, see FirewallPolicyRule objects
    }
  ]
}

針對 FirewallPolicyNatRuleCollection，請使用：

{
  action = {
    type = "string"
  }
  ruleCollectionType = "FirewallPolicyNatRuleCollection"
  rules = [
    {
      description = "string"
      name = "string"
      ruleType = "string"
      // For remaining properties, see FirewallPolicyRule objects
    }
  ]
}

屬性值

Microsoft.Network/firewallPolicies/ruleCollectionGroups

ApplicationRule

FirewallPolicyFilterRuleCollection

FirewallPolicyFilterRuleCollectionAction

FirewallPolicyHttpHeaderToInsert

FirewallPolicyNatRuleCollection

FirewallPolicyNatRuleCollectionAction

FirewallPolicyRule

FirewallPolicyRuleApplicationProtocol

FirewallPolicyRuleCollection

FirewallPolicyRuleCollectionGroupProperties

NatRule

NetworkRule

使用範例

Terraform 範例

部署防火牆原則規則集合群組的基本範例。

terraform {
  required_providers {
    azapi = {
      source = "Azure/azapi"
    }
  }
}

provider "azapi" {
  skip_provider_registration = false
}

variable "resource_name" {
  type    = string
  default = "acctest0001"
}

variable "location" {
  type    = string
  default = "westeurope"
}

resource "azapi_resource" "resourceGroup" {
  type     = "Microsoft.Resources/resourceGroups@2020-06-01"
  name     = var.resource_name
  location = var.location
}

resource "azapi_resource" "firewallPolicy" {
  type      = "Microsoft.Network/firewallPolicies@2022-07-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = var.location
  body = {
    properties = {
      threatIntelMode = "Alert"
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

resource "azapi_resource" "ruleCollectionGroup" {
  type      = "Microsoft.Network/firewallPolicies/ruleCollectionGroups@2022-07-01"
  parent_id = azapi_resource.firewallPolicy.id
  name      = var.resource_name
  body = {
    properties = {
      priority        = 500
      ruleCollections = []
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}