mainTemplate.json

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01-preview/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "location": {
        "type": "string",
        "defaultValue": "[resourceGroup().Location]",
        "metadata": {
            "description": "Geo-Location to deploy SonicWall NSv"
        }
    },
    "storageAccount": {
      "type": "string",
      "metadata": {
        "description": "Globally unique lowercase name of your storage account"
      }
    },
    "storageAccountType": {
      "type": "string",
      "metadata": {
        "description": "The type of the Storage Account created"
      },
      "defaultValue": "Standard_LRS"
    },
    "storageAccountNewOrExisting": {
      "type": "string",
      "defaultValue": "new",
      "allowedValues": [
        "new",
        "existing"
      ],
      "metadata": {
        "Description": "Indicates whether the Storage Account is new or existing"
      }
    },
    "existingStorageAccountRG": {
      "type": "string",
      "defaultValue": "[resourceGroup().Name]",
      "metadata": {
        "description": "Storage Resource Group of the Existing VM."
      }
    },
    "vmName": {
      "type": "string",
      "defaultValue": "new",
      "metadata": {
        "description": "Name of SonicWall-NSv VM in the Azure portal"
      }
    },
    "SSHUserName": {
      "type": "string",
      "defaultValue": "management",
      "metadata": {
        "description": "Username for SSH access to SonicWall-NSv console"
      }
    },
    "authenticationType": {
      "type": "string",
      "metadata": {
        "descritpion": "Type of authentication "
      },
      "allowedValues": [
        "sshPublicKey",
        "password"
      ],
      "defaultValue": "password"
    },
    "SSHPassword": {
      "type": "securestring",
      "metadata": {
        "description": "The password for the above SSH user. Password must contain one non alpha-numeric character, one uppercase alpha-numeric character and one numeric character"
      }
    },
    "sshKey": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "SSH rsa public key file as a string."
      }
    },
    "imageSku": {
      "type": "string",
      "defaultValue": "snwl-nsv-scx",
      "metadata": {
        "description": "The name of the Azure product to load"
      }
    },
    "imageVersion": {
      "type": "string",
      "defaultValue": "latest",
      "metadata": {
        "description": "The version of loaded NSv image"
      }
    },
    "managementAccessIPSource": {
      "type": "string",
      "metadata": {
        "description": "Public IP address allowed access SonicWall NSv HTTPS & SSH management "
      }
    },
    "nsvModel": {
      "type": "string",
      "allowedValues": [
        "NSv 270",
        "NSv 470",
        "NSv 870"
      ],
      "metadata": {
        "description": "SonicWall-NSv model, NSv 270 VM size Standard_DS2_v2 or Standard_D2_v2, NSv 470 VM size Standard_DS3_v2 or Standard_D3_v2, NSv 870 VM size Standard_DS4_v2 or Standard_D4_v2, depending on the SKU selected"
      },
      "defaultValue": "NSv 470"
    },
    "virtualNetworkNewOrExisting": {
      "type": "string",
      "defaultValue": "new",
      "metadata": {
        "description": "Determines whether or not a new virtual network should be provisioned."
      }
    },
    "virtualNetworkName": {
      "type": "string",
      "metadata": {
        "description": "Name of the virtual network that the consumer wants to use"
      },
      "defaultValue": "firewallVnet"
    },
    "virtualNetworkAddressPrefix": {
      "type": "array",
      "defaultValue": [
        "192.168.0.0/16"
      ],
      "metadata": {
        "description": "Virtual network address CIDR"
      }
    },
    "virtualNetworkResourceGroupName": {
      "type": "string",
      "defaultValue": "[resourceGroup().name]",
      "metadata": {
        "description": "Name of the resource group for the existing virtual network"
      }
    },
    "subnetWANName": {
      "type": "string",
      "defaultValue": "WAN-X1",
      "metadata": {
        "description": "Subnet for the WAN (X1)"
      }
    },
    "subnetLANName": {
      "type": "string",
      "defaultValue": "LAN-X0",
      "metadata": {
        "description": "Subnet for the LAN (X0)"
      }
    },
    "subnetWANPrefix": {
      "type": "string",
      "defaultValue": "192.168.1.0/24",
      "metadata": {
        "description": "WAN (X1) subnet CIDR"
      }
    },
    "subnetLANPrefix": {
      "type": "string",
      "defaultValue": "192.168.2.0/24",
      "metadata": {
        "description": "LAN (X0) subnet CIDR"
      }
    },
    "publicIpNewOrExisting": {
      "type": "string",
      "defaultValue": "new",
      "metadata": {
        "description": "Determines whether or not a new public ip should be provisioned."
      }
    },
    "publicIpName": {
      "type": "string",
      "defaultValue": "PublicIp",
      "metadata": {
        "description": "Name of the public ip address"
      }
    },
    "publicIpDns": {
      "type": "string",
      "defaultValue": "[concat('sonicwall-nsv-', uniqueString(resourceGroup().id))]",
      "metadata": {
        "description": "DNS of the public ip address for the VM"
      }
    },
    "publicIpResourceGroupName": {
      "type": "string",
      "defaultValue": "[resourceGroup().name]",
      "metadata": {
        "description": "Name of the resource group for the public ip address"
      }
    },
    "publicIpAllocationMethod": {
      "type": "string",
      "defaultValue": "Dynamic",
      "allowedValues": [
        "Dynamic",
        "Static"
      ],
      "metadata": {
        "description": "Allocation method for the public ip address"
      }
    },
    "publicIpSku": {
      "type": "string",
      "defaultValue": "Basic",
      "allowedValues": [
        "Basic",
        "Standard"
      ],
      "metadata": {
        "description": "Name of the resource group for the public ip address"
      }
    }
  },
  "variables": {
    "sshPublicKeyOsProfile": {
      "computerName": "[parameters('vmName')]",
      "adminUserName": "[parameters('SSHUserName')]",
      "linuxConfiguration": {
        "disablePasswordAuthentication": "true",
        "ssh": {
          "publicKeys": [
            {
              "path": "[concat('/home/', parameters('SSHUserName'), '/.ssh/authorized_keys')]",
              "keyData": "[parameters('sshKey')]"
            }
          ]
        }
      }
    },
    "passwordOsProfile": {
      "computerName": "[parameters('vmName')]",
      "adminUserName": "[parameters('SSHUserName')]",
      "adminPassword": "[parameters('SSHPassword')]"
    },
    "trustedLaunchSecurityProfile": {
      "securityType": "TrustedLaunch",
      "uefiSettings": {
        "secureBootEnabled": false,
        "vTpmEnabled": true
      }
    },
    "vmSize": {
      "NSv 270": "[if(sonicwall.isLegacySku(parameters('imageSku')), 'Standard_D2_v2', 'Standard_DS2_v2')]",
      "NSv 470": "[if(sonicwall.isLegacySku(parameters('imageSku')), 'Standard_D3_v2', 'Standard_DS3_v2')]",
      "NSv 870": "[if(sonicwall.isLegacySku(parameters('imageSku')), 'Standard_D4_v2', 'Standard_DS4_v2')]"
    },
    "imagePublisher": "sonicwall-inc",
    "imageOffer" : "sonicwall-nsz-azure",
    "imageVersionNumberPrefix": "[if(equals(indexOf(parameters('imageVersion'), '.'), -1), '0.0.', '')]",
    "imageVersionNumber": "[concat(variables('imageVersionNumberPrefix'), parameters('imageVersion'))]",
    "imageVersion": "[if(equals(parameters('imageVersion'), 'latest'), 'latest', variables('imageVersionNumber'))]",
    "nicName": "[concat(parameters('vmName'), '-interface')]",
    "publicIPAddressType": "Dynamic",
    "nsgname-mgmt": "[concat(parameters('vmName'), '-NSG')]",
    "publicIpAddressId": {
      "id": "[resourceId(parameters('publicIpResourceGroupName'), 'Microsoft.Network/publicIPAddresses', parameters('publicIpName'))]"
    }
  },
  "functions": [
    {
      "namespace": "sonicwall",
      "members": {
        "isLegacySku": {
          "parameters": [
            {
              "name": "sku",
              "type": "string"
            }
          ],
          "output": {
            "type": "bool",
            "value": "[contains(createArray('snwl-nsv-654-beta-r', 'snwl-nsv-beta-i', 'snwl-nsv-beta-p', 'snwl-nsv-beta-q', 'snwl-nsv-byol', 'snwl-nsv-byol-654', 'snwl-nsv-byol-v4'), toLower(parameters('sku')))]"
          }
        }
      }
    }
  ],
  "resources": [
    {
      "condition": "[equals(parameters('storageAccountNewOrExisting'), 'new')]",
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2018-02-01",
      "name": "[parameters('storageAccount')]",
      "location": "[parameters('location')]",
      "kind": "Storage",
      "sku": {
        "name": "[parameters('storageAccountType')]"
      }
    },
    {
      "condition": "[equals(parameters('publicIpNewOrExisting'), 'new')]",
      "type": "Microsoft.Network/publicIPAddresses",
      "apiVersion": "2018-04-01",
      "name": "[parameters('publicIpName')]",
      "location": "[parameters('location')]",
      "sku": {
        "name": "[parameters('publicIpSku')]"
      },
      "properties": {
        "publicIPAllocationMethod": "[parameters('publicIpAllocationMethod')]",
        "dnsSettings": {
          "domainNameLabel": "[parameters('publicIpDns')]"
        }
      }
    },
    {
      "condition": "[equals(parameters('virtualNetworkNewOrExisting'), 'new')]",
      "type": "Microsoft.Network/virtualNetworks",
      "apiVersion": "2018-04-01",
      "name": "[parameters('virtualNetworkName')]",
      "location": "[parameters('location')]",
      "dependsOn": [
        "[concat('Microsoft.Network/networkSecurityGroups/', variables('nsgname-mgmt'))]"
      ],
      "properties": {
        "addressSpace": {
          "addressPrefixes": "[parameters('virtualNetworkAddressPrefix')]"
        },
        "subnets": [
          {
            "name": "[parameters('subnetWANName')]",
            "properties": {
              "addressPrefix": "[parameters('subnetWANPrefix')]",
              "networkSecurityGroup": {
                "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgname-mgmt'))]"
              }
            }
          },
          {
            "name": "[parameters('subnetLANName')]",
            "properties": {
              "addressPrefix": "[parameters('subnetLANPrefix')]"
            }
          }
        ]
      }
    },
    {
      "apiVersion": "2018-04-01",
      "type": "Microsoft.Network/networkSecurityGroups",
      "name": "[concat(parameters('vmName'), '-NSG')]",
      "location": "[parameters('location')]",
      "properties": {
        "securityRules": [
          {
            "name": "Allow-HTTPS-management-from-IP",
            "properties": {
              "description": "Allow management from CIDR",
              "protocol": "TCP",
              "sourcePortRange": "*",
              "destinationPortRange": "443",
              "sourceAddressPrefix": "[parameters('managementAccessIPSource')]",
              "destinationAddressPrefix": "*",
              "access": "Allow",
              "priority": 100,
              "direction": "Inbound"
            }
          },
          {
            "name": "Allow-SSH-management-from-IP",
            "properties": {
              "description": "Allow management from CIDR",
              "protocol": "TCP",
              "sourcePortRange": "*",
              "destinationPortRange": "22",
              "sourceAddressPrefix": "[parameters('managementAccessIPSource')]",
              "destinationAddressPrefix": "*",
              "access": "Allow",
              "priority": 101,
              "direction": "Inbound"
            }
          },
          {
            "name": "Allow-HTTP-management-from-IP",
            "properties": {
              "description": "Allow management from CIDR",
              "protocol": "TCP",
              "sourcePortRange": "*",
              "destinationPortRange": "80",
              "sourceAddressPrefix": "[parameters('managementAccessIPSource')]",
              "destinationAddressPrefix": "*",
              "access": "Allow",
              "priority": 102,
              "direction": "Inbound"
            }
          },
          {
            "name": "Allow-AzureLoadBalancer",
            "properties": {
              "description": "Allow AzureLoadBalancer",
              "protocol": "TCP",
              "sourcePortRange": "*",
              "destinationPortRange": "*",
              "sourceAddressPrefix": "168.63.129.16",
              "destinationAddressPrefix": "*",
              "access": "Allow",
              "priority": 103,
              "direction": "Inbound"
            }
          },
          {
            "name": "Deny-HTTPS-management",
            "properties": {
              "description": "Deny HTTPS",
              "protocol": "TCP",
              "sourcePortRange": "*",
              "destinationPortRange": "443",
              "sourceAddressPrefix": "*",
              "destinationAddressPrefix": "*",
              "access": "Deny",
              "priority": 200,
              "direction": "Inbound"
            }
          },
          {
            "name": "Deny-SSH-management",
            "properties": {
              "description": "Deny SSH",
              "protocol": "TCP",
              "sourcePortRange": "*",
              "destinationPortRange": "22",
              "sourceAddressPrefix": "*",
              "destinationAddressPrefix": "*",
              "access": "Deny",
              "priority": 201,
              "direction": "Inbound"
            }
          },
          {
            "name": "Deny-HTTP-management",
            "properties": {
              "description": "Deny HTTP",
              "protocol": "TCP",
              "sourcePortRange": "*",
              "destinationPortRange": "80",
              "sourceAddressPrefix": "*",
              "destinationAddressPrefix": "*",
              "access": "Deny",
              "priority": 202,
              "direction": "Inbound"
            }
          },
          {
            "name": "Default-Allow",
            "properties": {
              "description": "Allow all other traffic so firewall can do its job",
              "protocol": "*",
              "sourcePortRange": "*",
              "destinationPortRange": "*",
              "sourceAddressPrefix": "*",
              "destinationAddressPrefix": "*",
              "access": "Allow",
              "priority": 300,
              "direction": "Inbound"
            }
          }
        ]
      }
    },
    {
      "apiVersion": "2018-04-01",
      "type": "Microsoft.Network/networkInterfaces",
      "name": "[concat(variables('nicName'), '-X1')]",
      "location": "[parameters('location')]",
      "dependsOn": [
        "[parameters('publicIpName')]",
        "[parameters('virtualNetworkName')]",
        "[variables('nsgname-mgmt')]"
      ],
      "tags": {
        "displayName": "[concat('NetworkInterfaces', '-X1')]"
      },
      "properties": {
        "enableIPForwarding": true,
        "networkSecurityGroup": {
          "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgname-mgmt'))]"
        },
        "ipConfigurations": [
          {
            "name": "[concat('ipconfig', '1')]",
            "properties": {
              "privateIPAllocationMethod": "Dynamic",
	      "publicIPAddress": "[if(not(equals(parameters('publicIpNewOrExisting'), 'none')), variables('publicIpAddressId') , json('null'))]",
              "subnet": {
                "id": "[resourceId(parameters('virtualNetworkResourceGroupName'), 'Microsoft.Network/virtualNetworks/subnets/', parameters('virtualNetworkName'), parameters('subnetWANName'))]" 
              }
            }
          }
        ]
      }
    },
    {
      "apiVersion": "2018-04-01",
      "type": "Microsoft.Network/networkInterfaces",
      "name": "[concat(variables('nicName'), '-X0')]",
      "location": "[parameters('location')]",
      "dependsOn": [
        "[parameters('virtualNetworkName')]"
      ],
      "tags": {
        "displayName": "[concat('NetworkInterfaces', '-X0')]"
      },
      "properties": {
        "enableIPForwarding": true,
        "ipConfigurations": [
          {
            "name": "[concat('ipconfig', '2')]",
            "properties": {
              "privateIPAllocationMethod": "Dynamic",
              "subnet": {
                "id": "[resourceId(parameters('virtualNetworkResourceGroupName'), 'Microsoft.Network/virtualNetworks/subnets/', parameters('virtualNetworkName'), parameters('subnetLANName'))]"  
              }
            }
          }
        ]
      }
    },
    {
      "apiVersion": "2020-12-01",
      "type": "Microsoft.Compute/virtualMachines",
      "name": "[parameters('vmName')]",
      "location": "[parameters('location')]",
      "dependsOn": [
        "[concat(variables('nicName'),'-X1')]",
        "[concat(variables('nicName'),'-X0')]"
      ],
      "plan": {
        "name": "[parameters('imageSku')]",
        "product": "[variables('imageOffer')]",
        "publisher": "[variables('imagePublisher')]"
      },
      "properties": {
        "hardwareProfile": {
          "vmSize": "[variables('vmSize')[parameters('nsvModel')]]"
        },
        "osProfile": "[variables(concat(parameters('authenticationType'), 'OsProfile'))]",
        "securityProfile": "[if(sonicwall.isLegacySku(parameters('imageSku')), json('null'), variables('trustedLaunchSecurityProfile'))]",
        "storageProfile": {
          "imageReference": {
            "publisher": "[variables('imagePublisher')]",
            "offer": "[variables('imageOffer')]",
            "sku": "[parameters('imageSku')]",
            "version": "[variables('imageVersion')]"
          },
          "osDisk": {
            "caching": "ReadWrite",
            "createOption": "FromImage"
          }
        },
        "networkProfile": {
          "networkInterfaces": [
          {
            "id": "[resourceId('Microsoft.Network/networkInterfaces',concat(variables('nicName'),'-X1'))]",
            "properties": {
              "primary": true
            }
          }, {
            "id": "[resourceId('Microsoft.Network/networkInterfaces',concat(variables('nicName'),'-X0'))]",
            "properties": {
              "primary": false
            }
          }]
        }
      }
    }
  ]
}