Skip to content

cyber-scot/terraform-azurerm-virtual-network-gateway

Repository files navigation

resource "azurerm_public_ip" "pip" {
  count = var.create_public_ip == true ? 1 : 0

  name                = var.public_ip_name != null ? var.public_ip_name : "pip-${var.name}"
  location            = var.location
  resource_group_name = var.rg_name
  allocation_method   = var.public_ip_allocation_method != null ? var.public_ip_allocation_method : "Static"
  sku                 = var.public_ip_sku != null ? var.public_ip_sku : "Standard"
  tags                = var.tags
}

resource "azurerm_virtual_network_gateway" "vnet_gw" {
  name                = var.name
  location            = var.location
  resource_group_name = var.rg_name
  tags                = var.tags

  type                                  = var.type
  vpn_type                              = var.vpn_type
  sku                                   = var.sku
  active_active                         = var.sku == "HighPerformance" || var.sku == "UltraPerformance" ? var.active_active : false
  enable_bgp                            = var.enable_bgp
  default_local_network_gateway_id      = var.create_local_network_gateway == true ? azurerm_local_network_gateway.local_gw[0].id : var.default_local_network_gateway_id
  edge_zone                             = var.edge_zone != null ? var.edge_zone : null
  generation                            = var.generation
  private_ip_address_enabled            = var.private_ip_address_enabled != null ? var.private_ip_address_enabled : false
  dns_forwarding_enabled                = var.dns_forwarding_enabled != null ? var.dns_forwarding_enabled : false
  bgp_route_translation_for_nat_enabled = var.bgp_route_translation_for_nat_enabled != null ? var.bgp_route_translation_for_nat_enabled : false
  ip_sec_replay_protection_enabled      = var.ip_sec_replay_protection_enabled != null ? var.ip_sec_replay_protection_enabled : false
  remote_vnet_traffic_enabled           = var.remote_vnet_traffic_enabled != null ? var.remote_vnet_traffic_enabled : false
  virtual_wan_traffic_enabled           = var.virtual_wan_traffic_enabled != null ? var.virtual_wan_traffic_enabled : false

  dynamic "policy_group" {
    for_each = var.policy_group != null ? var.policy_group : null
    content {
      name       = policy_group.value.name
      is_default = policy_group.value.is_default
      priority   = policy_group.value.priority

      dynamic "policy_member" {
        for_each = policy_group.value.policy_member != null ? policy_group.value.policy_member : null
        content {
          name  = policy_member.value.name
          type  = policy_member.value.type
          value = policy_member.value.value
        }
      }
    }
  }

  dynamic "ip_configuration" {
    for_each = var.ip_configuration != null ? var.ip_configuration : null
    content {
      name                          = ip_configuration.value.name != null ? ip_configuration.value.name : "ipconfig-${var.name}"
      public_ip_address_id          = var.create_public_ip == true ? azurerm_public_ip.pip[0].id : ip_configuration.value.public_ip_address_id
      private_ip_address_allocation = ip_configuration.value.private_ip_address_allocation != null ? ip_configuration.value.private_ip_address_allocation : "Dynamic"
      subnet_id                     = ip_configuration.value.subnet_id
    }
  }

  dynamic "bgp_settings" {
    for_each = var.bgp_settings != null ? var.bgp_settings : null
    content {
      asn         = bgp_settings.value.asn
      peer_weight = bgp_settings.value.peer_weight

      dynamic "peering_addresses" {
        for_each = bgp_settings.value.peering_addresses != null ? bgp_settings.value.peering_addresses : null
        content {
          ip_configuration_name = peering_addresses.value.ip_configuration_name
          apipa_addresses       = peering_addresses.value.apipa_addresses != null ? peering_addresses.value.apipa_addresses : null
        }
      }
    }
  }

  dynamic "custom_route" {
    for_each = var.custom_route != null ? var.custom_route : null
    content {
      address_prefixes = custom_route.value.address_prefixes
    }
  }

  dynamic "vpn_client_configuration" {
    for_each = var.vpn_client_configuration
    content {
      address_space         = vpn_client_configuration.value.address_space
      aad_tenant            = vpn_client_configuration.value.aad_tenant_url
      aad_audience          = vpn_client_configuration.value.aad_audience
      aad_issuer            = vpn_client_configuration.value.aad_issuer
      radius_server_address = vpn_client_configuration.value.radius_server_address
      radius_server_secret  = vpn_client_configuration.value.radius_server_secret
      vpn_client_protocols  = vpn_client_configuration.value.vpn_client_protocols
      vpn_auth_types        = vpn_client_configuration.value.vpn_auth_types

      dynamic "virtual_network_gateway_client_connection" {
        for_each = vpn_client_configuration.value.virtual_network_gateway_client_connection
        content {
          name               = virtual_network_gateway_client_connection.value.name
          policy_group_names = virtual_network_gateway_client_connection.value.policy_group_name
          address_prefixes   = virtual_network_gateway_client_connection.value.address_prefixes
        }
      }

      dynamic "radius_server" {
        for_each = vpn_client_configuration.value.radius_server
        content {
          score   = radius_server.value.score
          address = radius_server.value.address
          secret  = radius_server.value.secret
        }
      }

      dynamic "root_certificate" {
        for_each = vpn_client_configuration.value.root_certificate
        content {
          name             = root_certificate.value.name
          public_cert_data = root_certificate.value.data
        }
      }

      dynamic "revoked_certificate" {
        for_each = vpn_client_configuration.value.revoked_certificate
        content {
          name       = revoked_certificate.value.name
          thumbprint = revoked_certificate.value.thumbprint
        }
      }

      dynamic "ipsec_policy" {
        for_each = vpn_client_configuration.value.ipsec_policy
        content {
          sa_lifetime_in_seconds    = ipsec_policy.value.sa_lifetime_in_seconds
          sa_data_size_in_kilobytes = ipsec_policy.value.sa_data_size_in_kilobytes
          ipsec_encryption          = ipsec_policy.value.ipsec_encryption
          ipsec_integrity           = ipsec_policy.value.ipsec_integrity
          ike_encryption            = ipsec_policy.value.ike_encryption
          ike_integrity             = ipsec_policy.value.ike_integrity
          dh_group                  = ipsec_policy.value.dh_group
          pfs_group                 = ipsec_policy.value.pfs_group
        }
      }
    }
  }
}


resource "azurerm_local_network_gateway" "local_gw" {
  count               = var.create_local_network_gateway == true ? 1 : 0
  name                = var.local_network_gateway_name != null ? var.local_network_gateway_name : "local-gw-${var.name}"
  resource_group_name = var.rg_name
  location            = var.location
  gateway_address     = var.local_network_gateway_fqdn == null ? var.gateway_address : null
  gateway_fqdn        = var.local_network_gateway_address == null ? var.gateway_fqdn : null
  address_space       = var.local_network_gateway_address_space

  dynamic "bgp_settings" {
    for_each = var.local_network_gateway_bgp_settings
    content {
      asn                 = bgp_settings.value.asn
      bgp_peering_address = bgp_settings.value.bgp_peering_address
      peer_weight         = bgp_settings.value.peer_weight
    }
  }
}

Requirements

No requirements.

Providers

Name Version
azurerm n/a

Modules

No modules.

Resources

Name Type
azurerm_local_network_gateway.local_gw resource
azurerm_public_ip.pip resource
azurerm_virtual_network_gateway.vnet_gw resource

Inputs

Name Description Type Default Required
active_active Whether to create an active-active gateway or not bool false no
bgp_route_translation_for_nat_enabled Whether BGP route transaltion for NAT is enabled on the VNet gateway bool false no
bgp_settings The BGP settings block, if used
list(object({
asn = optional(number)
peering_address = optional(list(object({
ip_configuration_name = optional(string)
apipa_addresses = optional(list(string))
})))
peer_weight = optional(number, 1)
}))
[] no
create_local_network_gateway Whether to create a local network gateway or not bool false no
create_public_ip Whether to create a public IP, or bring your own bool true no
custom_route The custom route block, if used
list(object({
address_prefixes = optional(list(string))
}))
[] no
default_local_network_gateway_id The ID of the default local network gateway string null no
dns_forwarding_enabled Whether DNS forwarding is enabled on the VNet gateway bool true no
edge_zone The edge zone for the VNet to be deployed string null no
enable_bgp Whether BGP should be enabled on the VNet gateway bool false no
generation The generation of the VNet gateway, can either be Generation1 or Generation2 or None string "Generation2" no
ip_configuration The IP configuration block of the VNet gateway
list(object({
name = optional(string),
public_ip_address_id = optional(string)
private_ip_address_allocation = optional(string, "Dynamic")
subnet_id = optional(string)
}))
n/a yes
ip_sec_replay_protection_enabled Whether IP Sec replay protection is enabled on the VNet gateway bool true no
local_network_gateway_address The address of the local network gateway string null no
local_network_gateway_address_space The address space of the local network gateway list(string) [] no
local_network_gateway_bgp_settings The BGP settings block, if used
list(object({
asn = optional(number)
bgp_peering_address = optional(string)
peer_weight = optional(number, 1)
}))
[] no
local_network_gateway_fqdn The FQDN of the local network gateway string null no
local_network_gateway_name The name of the local network gateway string null no
location The location for this resource to be put in string n/a yes
name The name of the VNet gateway string n/a yes
policy_group The policy group block, if used
list(object({
name = string
policy_member = list(object({
name = string
type = string
value = string
}))
is_default = optional(bool, false)
priority = optional(number, 0)
}))
[] no
private_ip_address_enabled Whether private IP address is enabled on the VNet gateway bool false no
public_ip_allocation_method The allocation method of the public ip string null no
public_ip_name The name of the public IP string null no
public_ip_sku The sku of the public ip string null no
remote_vnet_traffic_enabled Whether remote VNet traffic is enabled on the VNet gateway bool false no
rg_name The name of the resource group, this module does not create a resource group, it is expecting the value of a resource group already exists string n/a yes
sku The SKU of the VNet gateway string n/a yes
tags A map of the tags to use on the resources that are deployed with this module. map(string) n/a yes
type The type of VPN gateway to create, either Vpn or ExpressRoute string n/a yes
virtual_wan_traffic_enabled Whether virtual wan traffic is enabled on the VNet gateway bool false no
vpn_client_configuration The VPN client configuration block, if used
list(object({
address_space = string
aad_tenant_url = optional(string)
aad_audience = optional(string)
aad_issuer = optional(string)

ipsec_policy = optional(object({
sa_data_size_in_kilobytes = number
sa_lifetime_in_seconds = number
ipsec_encryption = string
ipsec_integrity = string
ike_encryption = string
ike_integrity = string
dh_group = string
pfs_group = string
}))
radius_server = optional(list(object({
address = string
secret = string
score = number
})))
radius_server_address = optional(string)
radius_server_secret = optional(string)
root_certificate = optional(list(object({
name = string
public_cert_data = string
})))
revoked_certificate = optional(list(object({
name = string
thumbprint = string
})))
vpn_client_protocols = optional(list(string))
vpn_auth_type = optional(list(string))
virtual_network_gateway_client_connection = optional(list(object({
name = string
policy_group_name = list(string)
address_prefixes = list(string)
})))
}))
[] no
vpn_type The VPN type, can either be RouteBased or PolicyBased string n/a yes

Outputs

Name Description
public_ip_address The actual IP address of the Public IP.
public_ip_id The ID of the Public IP.
public_ip_name The name of the Public IP.
virtual_network_gateway_bgp_peering_addresses A list of peering_addresses for the BGP peer of the Virtual Network Gateway.
virtual_network_gateway_bgp_settings A block of bgp_settings of the Virtual Network Gateway.
virtual_network_gateway_default_addresses A list of peering address assigned to the BGP peer of the Virtual Network Gateway.
virtual_network_gateway_id The ID of the Virtual Network Gateway.
virtual_network_gateway_tunnel_ip_addresses A list of tunnel IP addresses assigned to the BGP peer of the Virtual Network Gateway.

About

A module used to deploy a VNet gateway πŸ”β¬…οΈ

Resources

License

Stars

Watchers

Forks

Packages

No packages published