部署 Azure 防火墙 IP 组更改失败并出现冲突

Question

我正在尝试使用策略、规则和一组 IPGroup 部署 Azure 防火墙。当我部署 ARM 模板以开始一切正常时。稍后如果我想更改其中一个 IPGroup 中的某些内容，并尝试部署该 IPGroup 更改，Azure 部署将失败并显示状态：与消息冲突：

{
    "status": "Failed",
    "error": {
        "code": "ResourceDeploymentFailure",
        "message": "The resource operation completed with terminal provisioning state 'Failed'."
    }
}

我尝试在它们自己的 ARM 模板中清楚地管理 IPGroups，并将它们放在带有 DependsOn 的 Azure Policy Rule Collection ARM 模板中，看看将它们全部部署在一起是否会有所帮助，但无论哪种方式，我们都会得到“冲突”.. 我想我想知道更新作为防火墙网络规则一部分的 IPGroup 的适当方法是什么？如果我不能简单地更新 IPGroup？

这是我的完整 ARM 模板的示例，用于我的 IPGroups 策略。

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
      "firewallPolicyName": {
            "defaultValue": "[concat('onelucki-fw-parent-policy', uniqueString(resourceGroup().id))]",
            "type": "String"
        },
        "DevSubnets": {
            "defaultValue": "DevSubnets",
            "type": "String"
        },
        "AzureSubnets": {
            "defaultValue": "AzureSubnets",
            "type": "String"
        }
    },
    "variables": {
        "fwPolicyName": "[parameters('firewallPolicyName')]"
    },
    "resources": [
          {
            "type": "Microsoft.Network/ipGroups",
            "apiVersion": "2020-05-01",
            "name": "AzureSubnets",
            "location": "centralus",
            "tags": { "Zone": "MixedZones" },
            "properties": {
                "ipAddresses": [
                    "10.99.1.1"
                ]
            }
        },
        {
            "type": "Microsoft.Network/ipGroups",
            "apiVersion": "2020-05-01",
            "name": "DevSubnets",
            "location": "centralus",
            "tags": { "Zone": "Dev" },
            "properties": {
                "ipAddresses": [
                    "10.99.2.2"
                ]
            }
        },
        {
            "type": "Microsoft.Network/firewallPolicies",
            "apiVersion": "2020-11-01",
            "name": "[parameters('firewallPolicyName')]",
            "location": "centralus",
            "properties": {
                "sku": {
                    "tier": "Standard"
                },
                "threatIntelMode": "Alert"
            }
        },
        {
            "type": "Microsoft.Network/firewallPolicies/ruleCollectionGroups",
            "apiVersion": "2020-11-01",
            "name": "[concat(parameters('firewallPolicyName'), '/DefaultNetworkRuleCollectionGroup')]",
            "location": "westus",
            "dependsOn": [
                "[resourceId('Microsoft.Network/ipGroups', parameters('AzureSubnets'))]",
                "[resourceId('Microsoft.Network/ipGroups', parameters('DevSubnets'))]",
                "[resourceId('Microsoft.Network/firewallPolicies', parameters('firewallPolicyName'))]"
            ],
            "properties": {
                "priority": 200,
                "ruleCollections": [
                    {
                        "ruleCollectionType": "FirewallPolicyFilterRuleCollection",
                        "action": {
                            "type": "Allow"
                        },
                        "rules": [
                            {
                                "ruleType": "NetworkRule",
                                "name": "DemoRule",
                                "ipProtocols": [
                                    "TCP"
                                ],
                                "sourceAddresses": [],
                                "sourceIpGroups": [
                                    "/subscriptions/<subscriptionIDHere>/resourceGroups/onelucki-fw/providers/Microsoft.Network/ipGroups/DevSubnets"
                                ],
                                "destinationAddresses": [],
                                "destinationIpGroups": [
                                     "/subscriptions/<subscriptionIDHere>/resourceGroups/onelucki-fw/providers/Microsoft.Network/ipGroups/AzureSubnets"
                                ],
                                "destinationFqdns": [],
                                "destinationPorts": [
                                    "135",
                                    "445"
                                ]
                            }
                        ],
                        "name": "DemoDeployRuleCollection",
                        "priority": 1300
                    }
                ]
            }
        }
    ]
}

Answer 1

需要一次部署一个 IP 组。此外，防火墙策略需要依赖于正在使用的 IP 组，尽管它没有列出它们。

IP 组的部署似乎在部署期间对防火墙策略进行了一些验证/更新。