Suggestion: Add warning when deploying rules to existing Azure Firewall Policy

[abdale]

The issue:

When deploying to using an existing Firewall inside of an existing ESLZ setup, if during ESLZ deployment the DNS proxy was not enabled, the data management landing zone deployment fails as it requires the DNS proxy to be enabled. It might be an idea to include a warning here that please ensure DNS proxy is enabled in your existing firewall policy as seen below otherwise deployment will fail.

[marvinbuss]

Thanks @abdale. Can you please submit the exact error message that you are seeing?
Is this a validation error in the portal or something that happens when deploying the template?
Thanks!

[abdale]

I'll re-deploy and grab that error. This is not a validation error, it happened during deployment.

[marvinbuss]

Thanks @abdale! :)

[abdale]

Here's the error:

{"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.","details":[{"code":"BadRequest","message":"{\r\n \"status\": \"Failed\",\r\n \"error\": {\r\n \"code\": \"FirewallPolicyNetworkRuleFqdnNotSupported\",\r\n \"message\": \"Invalid Rule Collection Group /subscriptions/28ff86d9-55b6-417c-9fda-6ff56a59d9ec/resourcegroups/abdale-vnethub-eastus2/providers/Microsoft.Network/firewallPolicies/abdale-azfwpolicy-eastus2/ruleCollectionGroups/networkrules-rulecollection. In order to use Fqdns in Network Rule Azure-NetworkRule-001, DNS Proxy must be enabled in Firewall Policy /subscriptions/28ff86d9-55b6-417c-9fda-6ff56a59d9ec/resourcegroups/abdale-vnethub-eastus2/providers/Microsoft.Network/firewallPolicies/abdale-azfwpolicy-eastus2.\"\r\n }\r\n}"}]}

Screenshot:

[marvinbuss]

Thanks @abdale! I will fix this later today and also introduce some improvements to overcome this issue.

[marvinbuss]

Please track changes here: #178 👍