azurerm_network_security_rule support for protocol ESP and AH for IPsec traffic

[someoneelsescloud]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

The resource azurerm_network_security_rule currently does not support the Protocols Encapsulating Security Payload (ESP) and Authentication Header (AH) for Encapsulating Security Payload IPSec traffic. As a result an ANY / ANY rule is required on the Network Security Group to allow for these protocols.

These Protocols are also known as ESP Protocol 50 and AH Protocol 51. They cannot be added as ports and must be added as protocols.

Currently the Terraform resource azurerm_network_security_rule has the following configurable protocols (also appears to be the same options for azurerm_network_security_group using the embedded security_rule option):

protocol - (Required) Network protocol this rule applies to. Possible values include Tcp, Udp, Icmp, or * (which matches all).

New or Affected Resource(s)

azurerm_network_security_rule
azurerm_network_security_group (security_rule)

• azurerm_v2.57.0
• Terraform v0.15.1

Potential Terraform Configuration

resource "azurerm_network_security_group" "nsg" {
  name                = "nsg"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name

  security_rule {
  name                        = "allow_esp_protocol"
  priority                    = 101
  direction                   = "Inbound"
  access                      = "Allow"
  protocol                    = "ESP"
  source_port_range           = "*"
  destination_port_range      = "*"
  source_address_prefix       = "*"
  destination_address_prefix  = "*"
  }

}

resource "azurerm_network_security_rule" "nsg_esp" {
  name                        = "allow_esp_protocol"
  priority                    = 100
  direction                   = "Inbound"
  access                      = "Allow"
  protocol                    = "ESP"
  source_port_range           = "*"
  destination_port_range      = "*"
  source_address_prefix       = "*"
  destination_address_prefix  = "*"
  resource_group_name         = azurerm_resource_group.resourcegroup.name
  network_security_group_name = azurerm_network_security_group.nsg.name
}

resource "azurerm_network_security_rule" "nsg_ah" {
  name                        = "allow_ah_protocol"
  priority                    = 101
  direction                   = "Inbound"
  access                      = "Allow"
  protocol                    = "AH"
  source_port_range           = "*"
  destination_port_range      = "*"
  source_address_prefix       = "*"
  destination_address_prefix  = "*"
  resource_group_name         = azurerm_resource_group.resourcegroup.name
  network_security_group_name = azurerm_network_security_group.nsg.name

Example Errors:

│ Error: expected protocol to be one of [* Tcp Udp Icmp], got ESP
│
│   with azurerm_network_security_rule.nsg_esp,
│   on main.tf line 53, in resource "azurerm_network_security_rule" "nsg_esp":
│   53: resource "azurerm_network_security_rule" "nsg_esp" {
│

│ Error: expected protocol to be one of [* Tcp Udp Icmp], got AH
│
│   with azurerm_network_security_rule.nsg_ah,
│   on main.tf line 67, in resource "azurerm_network_security_rule" "nsg_ah":
│   67: resource "azurerm_network_security_rule" "nsg_ah" {

References

Microsoft confirm that these protocols can be configured via Azure CLI: https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview, see below for snippet.

• Protocol | TCP, UDP, ICMP, ESP, AH, or Any.

• #0000

[ghost]

This has been released in version 2.58.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
    version = "~> 2.58.0"
}
# ... other configuration ...

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.