Backup Azure Firewall with virtual wan #Azure #SDWAN #Backup #Runbook

Azure Backup can't backup the Azure firewall directly additional steps need to be done before you can backup the Firewall rules. If you create all the rules with PowerShell or an ARM / bicep template then it is easy to add all the rules again, but often in time manual rules are changed or added. There for a good backup is needed of the rules to make sure the latest setup is been backuped.

Azure Firewall is a managed stateful security service

Organizations can leverage Premium stock-keeping unit (SKU) features like IDPS and TLS inspection to prevent malware and viruses from spreading across networks in both lateral and horizontal directions. To meet the increased performance demands of IDPS and TLS inspection, Azure Firewall Premium uses a more powerful virtual machine SKU. Like the Standard SKU, the Premium SKU can seamlessly scale up to 30 Gbps and integrate with availability zones to support the service level agreement (SLA) of 99.99 percent. The Premium SKU complies with Payment Card Industry Data Security Standard (PCI DSS) environment needs.

Details about the Azure firewall can be found here on the microsoft doc site Azure Firewall documentation | Microsoft Docs

A setup in my testlab with some rules and keep in mind the current runbook works only if the Firewall , policys, and the storage account is in the same resource group. In this blog post I may use different naming across the screenshots, it is the method that you need and the things that can go wrong.

Requirements

  • Automation account
  • Storage Account
  • Runbook

Overview of my demo lab empty shell with rules.

When you are in need to get quickly all the firewall rules and settings you can export the template in the policy manager. as below on my policy's for the Azure Virtual Machines

Manual is the quick and easy when we want to do this automatically we need an automation account and some runbook that will create a full backup on a storage account, and the storage account can be backup-ed with Azure backup

First we need to setup an Automation Account

Now that the Automation Account is created we can configure it to our needs.

Go to the Automation account and in the Settings blade, under Account settings, create a “Run As” account. This provide the service principal access that will be used to auto-login.

adding the run-as account

This provide the service principal access that will be used to auto-login into the runbook.

The runbook is a PowerShell module and we need to confirm that we have access to and resources modules. It is important to check if the AZ modules are there else the PowerShell script won't run. But all you need is already available

The modules that we need are Az.Account, Az., Az.Resources

As you can see all the Az modules are there with the +model from the menu you can add your own modules that you may need.

When running the PowerShell script it needs a storage location, A storage account will be used as storage, keep in mind that the storage account needs to be globally unique It can be also on a storage account that you already have for backup or management then that account can be used.

Create a account.

This can be done with PowerShell or manual

#Create new RG for the firewall backup

  • $location=”west europe”
  • $ResourceGroupName=”name”

#Create new RG for the firewall backup
New-AzResourceGroup -Name $ResourceGroupName -Location $Location

#Create new Storage account for the firewall backup
New-AzStorageAccount -ResourceGroupName $ResourceGroupName -Name $saname
-Location $location -SkuName Standard_LRS
-Kind BlobStorage

Now we save the account name and storagekey and we create a blobcontainer

Press on show keys to make the key visible

Now that the blob is created we create a folder in the blob, you can also do this in the runbook

Now that the Storage account is created we go back to our automation account created earlier and create a runbook, this runbook is used for backup all the firewall rules to the storage account.

create a runbook

just give it a name and choose powershell 5

We are using the Runbook that is on the github page

Select the just created runbook and copy the text into the runbook section https://raw.githubusercontent.com/Azure/Azure-Network-Security/master/Azure Firewall/Runbook – Back Up Azure Firewall/Runbook.txt

Into the new created runbook and click save.

We need to test the runbook to see if it works.

Here we use the created resource group and storage account that we have created for this. you can also make this fixed in the runbook but this is better and also very handy if you want to backup more firewall policy's

In my case I played to much, if if the folder already exist you will see an error in the test. Also I like to show what kind of errors you could get.

Starting database backup...
Logging in to Azure...
Creating 'firewallbackup' blob container space for storage...
Container 'firewallbackup' already exists
Starting Azure Firewall current configuration export in json...
Starting database backup...
Logging in to Azure...
Creating 'firewallbackup1' blob container space for storage...

CloudBlobContainer : Microsoft.WindowsAzure.Storage.Blob.CloudBlobContainer
Permission         : Microsoft.WindowsAzure.Storage.Blob.BlobContainerPermissions
PublicAccess       : Off
LastModified       : 2/8/2022 11:33:12 AM +00:00
ContinuationToken  : 
Context            : Microsoft.WindowsAzure.Commands.Common.Storage.AzureStorageContext
Name               : firewallbackup1
Container 'firewallbackup1' created
Starting Azure Firewall current configuration export in json...

Second error that could be there

Failed
The running command stopped because the preference variable “ErrorActionPreference” or common parameter is set to Stop: The remote server returned an error: (403) Forbidden. HTTP Status Code: 403 – HTTP Error Message: Server failed to the request. Make sure the value of Authorization header is formed correctly including the signature.

you probably need to change the storage key that is used, or change the access to that storage account .

But when it all run's

Starting database backup...
Logging in to Azure...
Creating 'firewallbackup' blob container space for storage...

CloudBlobContainer : Microsoft.WindowsAzure.Storage.Blob.CloudBlobContainer
Permission         : Microsoft.WindowsAzure.Storage.Blob.BlobContainerPermissions
PublicAccess       : Off
LastModified       : 2/8/2022 1:05:04 PM +00:00
ContinuationToken  : 
Context            : Microsoft.WindowsAzure.Commands.Common.Storage.AzureStorageContext
Name               : firewallbackup
Container 'firewallbackup' created
Starting Azure Firewall current configuration export in json...

Path                                                          
----                                                          
C:UsersClientTempAzureFirewall_MVPCentral202202081305.json
Submitting request to dump Azure Firewall configuration
Removing backups older than '7' days from blob: 'firewallbackup'
Azure Firewall current configuration back up completed.

Now that the testing is complete and working we can publish the runbook

Remember if you don't publish the runbook it won't work.

As you run the test runbook it will keep asking would you like to save etc when you want to switch to the schedule blade. just say no save. Our final step is to schedule the backup of the firewall

Create the schedule and the retention time

We create a new schedule

Noe we need to fill in all the parameters just as in the test

ok

if you want to turn this off just click on the line on

Looking into the storage blob we see all the json files

With this json file you can redeploy the firewall rules or use it for a new deployment with a different name.

Hope it was helpfull thanks for visiting my blog.

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Http://nl.linkedin.com/in/robertsmit

Author: Robert Smit [MVP]

Robert Smit is Senior Technical Evangelist and is a current Microsoft MVP in Clustering as of 2009.
Robert has over 20 years experience in IT with experience in the educational, health-care and finance industries.
Robert's past IT experience in the trenches of IT gives him the knowledge and insight that allows him to communicate effectively with IT professionals
who are trying to address real concerns around business continuity, disaster and regulatory compliance issues. Robert holds the following certifications:
MCT – Microsoft Certified Trainer, MCTS – Windows Server Virtualization, MCSE, MCSA and MCPS. He is an active participant in the Microsoft newsgroup community and is currently focused on Hyper-V, Clustering, , Azure and all things related to Cloud Computing and Infrastructure Optimalization.
Follow Robert on Twitter @ClusterMVP
Or follow his blog https://robertsmit.wordpress.com
Linkedin Profile Http://nl.linkedin.com/in/robertsmit

Robert is also capable of transferring his knowledge to others which is a rare feature in the field of IT. He makes a point of not only solving issues but also of giving on the job training of his colleagues.

A customer says ” Robert has been a big influence on our technical staff and I have to come to know him as a brilliant specialist concerning Microsoft Products. He was Capable with his in-depth knowledge of Microsoft products to problems and develop our infrastructure to a higher level. I would certainly hire him again in the future. ”

Details of the Recommendation: “I have been coordinating with Robert implementing a very complex system. Although he was primarily a Microsoft infrastructure specialist; he was able to understand and debug .Net based complext Windows applications and websites. His input to improve performance of applications proved very helpful for the success of our project

 

This article was originally published by The Windows Server HA Blog. You can find the original article here.