Noinbound port rule to access firewall from external IP.

[checkpointsw]

Noinbound port rule to access firewall from external IP.

[chkp-arielto]

Hi @rajeev-cloud
After investigation, we are indeed configuring these security groups.
Can you please ensure that you use the latest Azure HA terraform template in this repository?
Thanks,
Ariel

[rajeev-cloud]

Yes, I am using latest Azure HA template and after investigation I found missing NSG.

[chkp-arielto]

I suggest doing a remote session.
Please contact me offline ([email protected]), then we can go over this together.

[rajeev-cloud]

Thank you for your time for discussion,

Here is the solution for firewall external IP access -

resource "azurerm_network_security_group" "nsg" {

name = var.network_sg_name
location = var.location
resource_group_name = data.azurerm_resource_group.rg.name

security_rule = [

//Place all Inbound rule here
{access = "Allow", description = "AllowInBound" , destination_address_prefix = "", destination_address_prefixes = null
destination_application_security_group_ids = null, destination_port_range = "", destination_port_ranges = null
direction = "Inbound", name = "AllowAllInbound", priority = 100, protocol = "", source_address_prefix = ""
source_address_prefixes = null, source_application_security_group_ids = null, source_port_range = "*",
source_port_ranges = null},

//Place all Outbound rule here
{access = "Allow", description = "AllowInBound" , destination_address_prefix = "", destination_address_prefixes = null
destination_application_security_group_ids = null, destination_port_range = "", destination_port_ranges = null
direction = "Outbound", name = "AllowAllOutbound", priority = 100, protocol = "", source_address_prefix = ""
source_address_prefixes = null, source_application_security_group_ids = null, source_port_range = "*",
source_port_ranges = null},

]

[chkp-arielto]

Hi @rajeev-cloud
After further investigation, the existing VNET was not deployed either with inbound rule or with NSGs on the GW NICs.
When customers deploy using an existing VNET, they are responsible for the NSGs and UDRs.
Thanks,
Ariel