Azure Landing Zone Networking: Hub-Spoke with Firewall

// modules/network/hub-vnet.bicep
// Deploy the hub virtual network with required subnets
 
@description('Azure region for hub deployment')
param location string = 'westeurope'
 
@description('Environment identifier')
param environmentType string = 'prod'
 
@description('Hub VNet address space')
param hubAddressPrefix string = '10.0.0.0/16'
 
resource hubVnet 'Microsoft.Network/virtualNetworks@2023-11-01' = {
  name: 'vnet-hub-${location}-001'
  location: location
  properties: {
    addressSpace: {
      addressPrefixes: [hubAddressPrefix]
    }
    subnets: [
      {
        name: 'AzureFirewallSubnet'
        properties: {
          addressPrefix: '10.0.1.0/26'
        }
      }
      {
        name: 'GatewaySubnet'
        properties: {
          addressPrefix: '10.0.2.0/27'
        }
      }
      {
        name: 'AzureBastionSubnet'
        properties: {
          addressPrefix: '10.0.3.0/26'
        }
      }
      {
        name: 'snet-dns-inbound-${location}'
        properties: {
          addressPrefix: '10.0.4.0/28'
          delegations: [
            {
              name: 'Microsoft.Network.dnsResolvers'
              properties: {
                serviceName: 'Microsoft.Network/dnsResolvers'
              }
            }
          ]
        }
      }
    ]
  }
}
 
output hubVnetId string = hubVnet.id
output hubVnetName string = hubVnet.name
output firewallSubnetId string = hubVnet.properties.subnets[0].id

// modules/network/spoke-vnet.bicep
// Deploy a spoke VNet and configure bidirectional peering with the hub
 
@description('Spoke identifier, e.g. app01, data01')
param spokeName string
 
@description('Hub VNet resource ID for peering')
param hubVnetId string
 
@description('Hub VNet name for peering reference')
param hubVnetName string
 
param location string = 'westeurope'
param spokeAddressPrefix string
 
resource spokeVnet 'Microsoft.Network/virtualNetworks@2023-11-01' = {
  name: 'vnet-spoke-${spokeName}-${location}-001'
  location: location
  properties: {
    addressSpace: {
      addressPrefixes: [spokeAddressPrefix]
    }
    subnets: [
      {
        name: 'snet-default-${spokeName}'
        properties: {
          addressPrefix: spokeAddressPrefix
          routeTable: {
            id: spokeRouteTable.id
          }
        }
      }
    ]
  }
}
 
// Route all traffic through the hub firewall
resource spokeRouteTable 'Microsoft.Network/routeTables@2023-11-01' = {
  name: 'rt-spoke-${spokeName}-${location}'
  location: location
  properties: {
    disableBgpRoutePropagation: true
    routes: [
      {
        name: 'route-to-firewall'
        properties: {
          addressPrefix: '0.0.0.0/0'
          nextHopType: 'VirtualAppliance'
          nextHopIpAddress: '10.0.1.4' // Azure Firewall private IP
        }
      }
    ]
  }
}
 
// Spoke -> Hub peering
resource spokeToHub 'Microsoft.Network/virtualNetworks/virtualNetworkPeerings@2023-11-01' = {
  parent: spokeVnet
  name: 'peer-${spokeName}-to-hub'
  properties: {
    remoteVirtualNetwork: {
      id: hubVnetId
    }
    allowForwardedTraffic: true
    allowGatewayTransit: false
    useRemoteGateways: true
  }
}
 
output spokeVnetId string = spokeVnet.id

// modules/network/firewall.bicep
// Deploy Azure Firewall Basic with application and network rule collections
 
param location string = 'westeurope'
param firewallSubnetId string
param skuTier string = 'Basic'
 
resource fwPublicIp 'Microsoft.Network/publicIPAddresses@2023-11-01' = {
  name: 'pip-fw-hub-${location}-001'
  location: location
  sku: {
    name: 'Standard'
  }
  properties: {
    publicIPAllocationMethod: 'Static'
  }
}
 
resource fwPolicy 'Microsoft.Network/firewallPolicies@2023-11-01' = {
  name: 'fwpol-hub-${location}-001'
  location: location
  properties: {
    sku: {
      tier: skuTier
    }
    threatIntelMode: 'Alert'
  }
}
 
resource networkRuleCollection 'Microsoft.Network/firewallPolicies/ruleCollectionGroups@2023-11-01' = {
  parent: fwPolicy
  name: 'rcg-network-baseline'
  properties: {
    priority: 200
    ruleCollections: [
      {
        ruleCollectionType: 'FirewallPolicyFilterRuleCollection'
        name: 'rc-allow-spoke-to-spoke'
        priority: 210
        action: {
          type: 'Allow'
        }
        rules: [
          {
            ruleType: 'NetworkRule'
            name: 'allow-rfc1918'
            sourceAddresses: ['10.0.0.0/8']
            destinationAddresses: ['10.0.0.0/8']
            destinationPorts: ['*']
            ipProtocols: ['TCP', 'UDP']
          }
        ]
      }
    ]
  }
}
 
resource appRuleCollection 'Microsoft.Network/firewallPolicies/ruleCollectionGroups@2023-11-01' = {
  parent: fwPolicy
  name: 'rcg-application-baseline'
  dependsOn: [networkRuleCollection]
  properties: {
    priority: 300
    ruleCollections: [
      {
        ruleCollectionType: 'FirewallPolicyFilterRuleCollection'
        name: 'rc-allow-azure-management'
        priority: 310
        action: {
          type: 'Allow'
        }
        rules: [
          {
            ruleType: 'ApplicationRule'
            name: 'allow-azure-management'
            sourceAddresses: ['10.0.0.0/8']
            protocols: [
              {
                protocolType: 'Https'
                port: 443
              }
            ]
            targetFqdns: [
              'management.azure.com'
              'login.microsoftonline.com'
              '*.blob.core.windows.net'
            ]
          }
        ]
      }
    ]
  }
}
 
resource firewall 'Microsoft.Network/azureFirewalls@2023-11-01' = {
  name: 'fw-hub-${location}-001'
  location: location
  properties: {
    sku: {
      name: 'AZFW_VNet'
      tier: skuTier
    }
    firewallPolicy: {
      id: fwPolicy.id
    }
    ipConfigurations: [
      {
        name: 'fw-ipconfig'
        properties: {
          subnet: {
            id: firewallSubnetId
          }
          publicIPAddress: {
            id: fwPublicIp.id
          }
        }
      }
    ]
  }
}
 
output firewallPrivateIp string = firewall.properties.ipConfigurations[0].properties.privateIPAddress