Skip to main content

Palo Alto Networks VNet Peering Module for Azure

A terraform module for deploying a Virtual Network Peering and its components required for the VM-Series firewalls in Azure.

GitHub Logo Terraform Logo

Usage

Simple usage example:

local_peer_config = {
name = "peer-local_vnet-to-remote_vnet"
resource_group_name = "local_resourcegroup_name"
vnet_name = "local_vnet_name"
}

remote_peer_config = {
name = "peer-remote_vnet-to-local_vnet"
resource_group_name = "remote_resourcegroup_name"
vnet_name = "remote_vnet_name"
}

Reference

Requirements

  • terraform, version: >= 1.5, < 2.0
  • azurerm, version: ~> 3.98

Providers

  • azurerm, version: ~> 3.98

Resources

  • virtual_network_peering (managed)
  • virtual_network_peering (managed)
  • virtual_network (data)
  • virtual_network (data)

Required Inputs

NameTypeDescription
local_peer_configobjectA map that contains the local peer configuration.
remote_peer_configobjectA map that contains the remote peer configuration.

Outputs

NameDescription
local_peering_nameThe name of the local VNET peering.
remote_peering_nameThe name of the remote VNET peering.
local_peering_idThe ID of the local VNET peering.
remote_peering_idThe ID of the remote VNET peering.

Required Inputs details

local_peer_config

A map that contains the local peer configuration. Mandatory Values:

  • name - (string, required) the name of the local VNET peering.
  • resource_group_name - (string, required) the resource group name of the local peer.
  • vnet_name - (string, required) the local peer VNET name.
  • allow_virtual_network_access - (bool, optional, defaults to true) allows communication between the two peering VNETs.
  • allow_forwarded_traffic - (bool, optional, defaults to true) allows traffic forwarded from the remote VNET but not originated from within it.
  • allow_gateway_transit - (bool, optional, defaults to false) controls the learning of routes from local VNET (gateway or route server) into the remote VNET. Must be true if use_remote_gateways is true for remote peer.
  • use_remote_gateways - (bool, optional, defaults to false) controls the learning of routes from the remote VNET (gateway or route server) into the local VNET.

Type:

object({
name = string
resource_group_name = string
vnet_name = string
allow_virtual_network_access = optional(bool, true)
allow_forwarded_traffic = optional(bool, true)
allow_gateway_transit = optional(bool, false)
use_remote_gateways = optional(bool, false)
})
[back to list](#modules-required-inputs)

remote_peer_config

A map that contains the remote peer configuration. Mandatory Values:

  • name - (string, required) the name of the remote VNET peering.
  • resource_group_name - (string, required) the resource group name of the remote peer.
  • vnet_name - (string, required) the remote peer VNET name.
  • allow_virtual_network_access - (bool, optional, defaults to true) allows communication between the two peering VNETs.
  • allow_forwarded_traffic - (bool, optional, defaults to true) allows traffic forwarded from the local VNET but not originated from within it.
  • allow_gateway_transit - (bool, optional, defaults to false) controls the learning of routes from remote VNET (gateway or route server) into the local VNET. Must be true if use_remote_gateways is true for remote peer.
  • use_remote_gateways - (bool, optional, defaults to false) controls the learning of routes from the local VNET (gateway or route server) into the remote VNET.

Type:

object({
name = string
resource_group_name = string
vnet_name = string
allow_virtual_network_access = optional(bool, true)
allow_forwarded_traffic = optional(bool, true)
allow_gateway_transit = optional(bool, false)
use_remote_gateways = optional(bool, false)
})
[back to list](#modules-required-inputs)