search

AngleOSaxon / AzureFirewallCalculator

A simple tool to check what rules will be hit in an Azure Firewall
MIT License
1 stars 1 forks source link

Support for non-classic firewall? #1

Open chaoscreater opened 5 months ago

chaoscreater commented 5 months ago

Hi there,

Came across your project and find it very interesting. Tried to import via the generated Powershell script and getting this error:

$ipGroupSubscriptions = New-Object System.Collections.Generic.HashSet[String]]::new([StringComparer]::InvariantCultureIgnoreCase);
New-Object: Cannot find type [System.Collections.Generic.HashSet[String]]::new]: verify that the assembly containing this type is loaded.

I'm not using a classic firewall, so I'm wondering if this is related?

I've also tried to change the above to something like this as well: New-Object System.Collections.Generic.HashSet[String]([StringComparer]::InvariantCultureIgnoreCase)

And while it didn't error out, it didn't find any ipgroups or rule collections etc, even though they exist.

AngleOSaxon commented 5 months ago

The original error is just a Powershell mistake on my part. It not finding any IP Groups or Rule Collections is likely because the firewall isn't Classic. I haven't looked at the representation of a Manager-based firewall, but I imagine it would have an extra Policy layer between the root resource and the Rule Collections, so the script and subsequent mapping logic would need to account for that.

chaoscreater commented 5 months ago

Yeah, I figured as much.

Is there any plans to support manager-based firewall? Considering Microsoft is constantly dropping support for classic resources these days, or even forcing customers to upgrade to a newer platform/version and deprecating the classic ones entirely, it may be a good idea to support the manage-based firewall.

AngleOSaxon commented 4 months ago

If you feel like testing it, commit c1e2718862d562d50c370186e28c66f025fa9d1f adds an updated version of the export script that exports Policy and Rule Collection Group information. The Load From File UI now also expects those files.

Caveats: