Skip to content

Commit

Permalink
Azure vWAN | Added Terraform templates
Browse files Browse the repository at this point in the history
  • Loading branch information
@chkp-yairra
chkp-yairra committed Jan 24, 2024
1 parent 97cb1b8 commit 8bf91b1
Show file tree
Hide file tree
Showing 8 changed files with 183 additions and 149 deletions.
103 changes: 53 additions & 50 deletions terraform/azure/nva-into-existing-hub/README.md
View file

Large diffs are not rendered by default.

23 changes: 14 additions & 9 deletions terraform/azure/nva-into-existing-hub/main.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -32,15 +32,15 @@ locals {

data "http" "image-versions" {
method = "GET"
url = "https://management.azure.com/subscriptions/${var.subscription_id}/providers/Microsoft.Network/networkVirtualApplianceSKUs/checkpoint${strcontains(var.cloudguard-version, "NGTX") ? "-ngtx" : ""}?api-version=2020-05-01"
url = "https://management.azure.com/subscriptions/${var.subscription_id}/providers/Microsoft.Network/networkVirtualApplianceSKUs/checkpoint${var.license-type == "Full Package (NGTX + S1C)" ? "-ngtx" : ""}?api-version=2020-05-01"
request_headers = {
Accept = "application/json"
"Authorization" = "Bearer ${local.access_token}"
}
}

locals {
image_versions = tolist([for version in jsondecode(data.http.image-versions.response_body).properties.availableVersions : version if substr(version, 0, 4) == lower(substr(replace(var.cloudguard-version, ".", ""), 1, 4))])
image_versions = tolist([for version in jsondecode(data.http.image-versions.response_body).properties.availableVersions : version if substr(version, 0, 4) == substr(lower(var.os-version), 1, 4)])
routing_intent-internet-policy = {
"name": "InternetTraffic",
"destinations": [
Expand All @@ -63,17 +63,17 @@ locals {
//********************** Marketplace Terms & Solution Registration **************************//
data "http" "accept-marketplace-terms-existing-agreement" {
method = "GET"
url = "https://management.azure.com/subscriptions/${var.subscription_id}/providers/Microsoft.MarketplaceOrdering/agreements/checkpoint/offers/azure-vwan/plans/vwan-app?api-version=2021-01-01"
url = "https://management.azure.com/subscriptions/${var.subscription_id}/providers/Microsoft.MarketplaceOrdering/agreements/checkpoint/offers/cp-vwan-managed-app/plans/vwan-app?api-version=2021-01-01"
request_headers = {
Accept = "application/json"
"Authorization" = "Bearer ${local.access_token}"
}
}

resource "azurerm_marketplace_agreement" "accept-marketplace-terms" {
count = can(jsondecode(data.http.accept-marketplace-terms-existing-agreement.response_body).id) && jsondecode(data.http.accept-marketplace-terms-existing-agreement.response_body).properties.state == "Active" ? 0 : 1
count = can(jsondecode(data.http.accept-marketplace-terms-existing-agreement.response_body).id) ? (jsondecode(data.http.accept-marketplace-terms-existing-agreement.response_body).properties.state == "Active" ? 0 : 1) : 1
publisher = "checkpoint"
offer = "azure-vwan"
offer = "cp-vwan-managed-app"
plan = "vwan-app"
}

Expand All @@ -91,6 +91,7 @@ resource "azurerm_resource_provider_registration" "solutions" {
name = "Microsoft.Solutions"
}


//********************** Managed Application Configuration **************************//
resource "azurerm_managed_application" "nva" {
depends_on = [azurerm_marketplace_agreement.accept-marketplace-terms, azurerm_resource_provider_registration.solutions]
Expand All @@ -102,9 +103,9 @@ resource "azurerm_managed_application" "nva" {

plan {
name = "vwan-app"
product = "azure-vwan"
product = "cp-vwan-managed-app"
publisher = "checkpoint"
version = "1.0.7"
version = "1.0.8"
}
parameter_values = jsonencode({
location = {
Expand All @@ -113,8 +114,11 @@ resource "azurerm_managed_application" "nva" {
hubId = {
value = data.azurerm_virtual_hub.vwan-hub.id
},
cloudGuardVersion = {
value = var.cloudguard-version
osVersion = {
value = var.os-version
},
LicenseType = {
value = var.license-type
},
imageVersion = {
value = element(local.image_versions, length(local.image_versions) -1)
Expand Down Expand Up @@ -169,6 +173,7 @@ resource "azurerm_managed_application" "nva" {

//********************** Routing Intent **************************//


data "external" "update-routing-intent" {
count = length(local.routing-intent-policies) != 0 ? 1 : 0
depends_on = [azurerm_managed_application.nva]
Expand Down
55 changes: 28 additions & 27 deletions terraform/azure/nva-into-existing-hub/terraform.tfvars
View file
Original file line number Diff line number Diff line change
@@ -1,28 +1,29 @@
#PLEASE refer to the README.md for accepted values for the variables below
authentication_method = "PLEASE ENTER AUTHENTICATION METHOD" # "Service Principal"
client_secret = "PLEASE ENTER CLIENT SECRET" # "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
client_id = "PLEASE ENTER CLIENT ID" # "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
tenant_id = "PLEASE ENTER TENANT ID" # "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
subscription_id = "PLEASE ENTER SUBSCRIPTION ID" # "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
resource-group-name = "PLEASE ENTER RESOURCE GROUP NAME" # "tf-managed-app-resource-group"
location = "PLEASE ENTER LOCATION" # "westcentralus"
vwan-hub-name = "PLEASE ENTER VWAN HUB NAME" # "tf-vwan-hub"
vwan-hub-resource-group = "PLEASE ENTER VWAN HUB RESOURCE GROUP" # "tf-vwan-hub-rg"
managed-app-name = "PLEASE ENTER MANAGED APPLICATION NAME" # "tf-vwan-managed-app-nva"
nva-rg-name = "PLEASE ENTER NVA RESOURCE GROUP NAME" # "tf-vwan-nva-rg"
nva-name = "PLEASE ENTER NVA NAME" # "tf-vwan-nva"
cloudguard-version = "PLEASE ENTER CLOUDGUARD VERSION" # "R81.10 - Pay As You Go (NGTP)"
scale-unit = "PLEASE ENTER SCALE UNIT" # "2"
bootstrap-script = "PLEASE ENTER CUSTOM SCRIPT OR LEAVE EMPTY DOUBLE QUOTES" # "touch /home/admin/bootstrap.txt; echo 'hello_world' > /home/admin/bootstrap.txt"
admin-shell = "PLEASE ENTER ADMIN SHELL" # "/etc/cli.sh"
sic-key = "PLEASE ENTER SIC KEY" # "xxxxxxxxxx"
ssh-public-key = "PLEASE ENTER SSH PUBLIC KEY" # "ssh-rsa xxxxxxxxxxxxxxxxxxxxxxxx imported-openssh-key"
bgp-asn = "PLEASE ENTER BGP AUTONOMOUS SYSTEM NUMBER" # "64512"
custom-metrics = "PLEASE ENTER yes or no" # "yes"
routing-intent-internet-traffic = "PLEASE ENTER yes or no" # "yes"
routing-intent-private-traffic = "PLEASE ENTER yes or no" # "yes"
smart1-cloud-token-a = "PASTE TOKEN FROM SMART-1 CLOUD PORTAL FOR INSTANCE A OR LEAVE EMPTY DOUBLE QUOTES" # "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
smart1-cloud-token-b = "PASTE TOKEN FROM SMART-1 CLOUD PORTAL FOR INSTANCE B OR LEAVE EMPTY DOUBLE QUOTES" # "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
smart1-cloud-token-c = "PASTE TOKEN FROM SMART-1 CLOUD PORTAL FOR INSTANCE C OR LEAVE EMPTY DOUBLE QUOTES" # "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
smart1-cloud-token-d = "PASTE TOKEN FROM SMART-1 CLOUD PORTAL FOR INSTANCE D OR LEAVE EMPTY DOUBLE QUOTES" # "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
smart1-cloud-token-e = "PASTE TOKEN FROM SMART-1 CLOUD PORTAL FOR INSTANCE E OR LEAVE EMPTY DOUBLE QUOTES" # "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
authentication_method = "PLEASE ENTER AUTHENTICATION METHOD" # "Service Principal"
client_secret = "PLEASE ENTER CLIENT SECRET" # "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
client_id = "PLEASE ENTER CLIENT ID" # "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
tenant_id = "PLEASE ENTER TENANT ID" # "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
subscription_id = "PLEASE ENTER SUBSCRIPTION ID" # "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
resource-group-name = "PLEASE ENTER RESOURCE GROUP NAME" # "tf-managed-app-resource-group"
location = "PLEASE ENTER LOCATION" # "westcentralus"
vwan-hub-name = "PLEASE ENTER VWAN HUB NAME" # "tf-vwan-hub"
vwan-hub-resource-group = "PLEASE ENTER VWAN HUB RESOURCE GROUP" # "tf-vwan-hub-rg"
managed-app-name = "PLEASE ENTER MANAGED APPLICATION NAME" # "tf-vwan-managed-app-nva"
nva-rg-name = "PLEASE ENTER NVA RESOURCE GROUP NAME" # "tf-vwan-nva-rg"
nva-name = "PLEASE ENTER NVA NAME" # "tf-vwan-nva"
os-version = "PLEASE ENTER GAIA OS VERSION" # "R8120"
license-type = "PLEASE ENTER LICENSE TYPE" # "Security Enforcement (NGTP)"
scale-unit = "PLEASE ENTER SCALE UNIT" # "2"
bootstrap-script = "PLEASE ENTER CUSTOM SCRIPT OR LEAVE EMPTY DOUBLE QUOTES" # "touch /home/admin/bootstrap.txt; echo 'hello_world' > /home/admin/bootstrap.txt"
admin-shell = "PLEASE ENTER ADMIN SHELL" # "/etc/cli.sh"
sic-key = "PLEASE ENTER SIC KEY" # "xxxxxxxxxx"
ssh-public-key = "PLEASE ENTER SSH PUBLIC KEY" # "ssh-rsa xxxxxxxxxxxxxxxxxxxxxxxx imported-openssh-key"
bgp-asn = "PLEASE ENTER BGP AUTONOMOUS SYSTEM NUMBER" # "64512"
custom-metrics = "PLEASE ENTER yes or no" # "yes"
routing-intent-internet-traffic = "PLEASE ENTER yes or no" # "yes"
routing-intent-private-traffic = "PLEASE ENTER yes or no" # "yes"
smart1-cloud-token-a = "PASTE TOKEN FROM SMART-1 CLOUD PORTAL FOR INSTANCE A OR LEAVE EMPTY DOUBLE QUOTES" # "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
smart1-cloud-token-b = "PASTE TOKEN FROM SMART-1 CLOUD PORTAL FOR INSTANCE B OR LEAVE EMPTY DOUBLE QUOTES" # "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
smart1-cloud-token-c = "PASTE TOKEN FROM SMART-1 CLOUD PORTAL FOR INSTANCE C OR LEAVE EMPTY DOUBLE QUOTES" # "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
smart1-cloud-token-d = "PASTE TOKEN FROM SMART-1 CLOUD PORTAL FOR INSTANCE D OR LEAVE EMPTY DOUBLE QUOTES" # "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
smart1-cloud-token-e = "PASTE TOKEN FROM SMART-1 CLOUD PORTAL FOR INSTANCE E OR LEAVE EMPTY DOUBLE QUOTES" # "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
17 changes: 13 additions & 4 deletions terraform/azure/nva-into-existing-hub/variables.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -60,12 +60,21 @@ variable "nva-name" {
default = "tf-vwan-nva"
}

variable "cloudguard-version" {
variable "os-version" {
description = "GAIA OS version"
type = string
validation {
condition = contains(["R8110", "R8120"], var.os-version)
error_message = "Allowed values for os-version are 'R8110', 'R8120'"
}
}

variable "license-type" {
type = string
default = "R81.10 - Pay As You Go (NGTP)"
default = "Security Enforcement (NGTP)"
validation {
condition = contains(["R81.10 - Pay As You Go (NGTP)", "R81.20 - Pay As You Go (NGTP)", "R81.10 - Pay As You Go (NGTX)", "R81.20 - Pay As You Go (NGTX)"], var.cloudguard-version)
error_message = "Valid values for CloudGuard version are 'R81.10 - Pay As You Go (NGTP)','R81.20 - Pay As You Go (NGTP)','R81.10 - Pay As You Go (NGTX)' and 'R81.20 - Pay As You Go (NGTX)'"
condition = contains(["Security Enforcement (NGTP)", "Full Package (NGTX + S1C)"], var.license-type)
error_message = "Allowed values for License Type are 'Security Enforcement (NGTP)','Full Package (NGTX + S1C)'"
}
}

Expand Down
Loading

0 comments on commit 8bf91b1

Please sign in to comment.