Repository navigation
GeoIp Feature changes - #30197
GeoIp Feature changes#30197Ethan Yang (necusjz) merged 1 commit into
Conversation
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
|
Thank you for your contribution kshitizmathur-max! We will review the pull request and get back to you soon. |
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
|
Looks good to me |
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Make SourceGeoLocation mandatory in its parameter set to prevent source-less syntax.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 1
Open (1)
What changed in this PR
Adds Geo IP source and destination filters to Azure Firewall Policy network rules.
Changes:
- Added Geo Location model properties and cmdlet parameters.
- Added mutual-exclusivity validation.
- Added unit and scenario test coverage.
- Updated help documentation and changelog.
| File | Summary |
|---|---|
src/Network/Network/Models/AzureFirewallPolicy/PSAzureFirewallPolicyNetworkRule.cs |
Adds Geo Location properties and display getters. |
src/Network/Network/help/New-AzFirewallPolicyNetworkRule.md |
Documents the new parameters. |
src/Network/Network/ChangeLog.md |
Records the feature. |
src/Network/Network/AzureFirewallPolicy/NetworkRuleCondition/NewAzureFirewallPolicyNetworkRuleCommand.cs |
Adds parameters and validation. |
src/Network/Network/AzureFirewallPolicy/AzureFirewallPolicyRuleSourceParameterSets.cs |
Adds the Geo Location source parameter set. |
src/Network/Network.Test/ScenarioTests/AzureFirewallPolicyTests.ps1 |
Adds CRUD scenario coverage. |
src/Network/Network.Test/ScenarioTests/AzureFirewallPolicyTests.cs |
Adds validation and acceptance tests. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| public string[] Protocol { get; set; } | ||
|
|
||
| [Parameter( | ||
| Mandatory = false, |
There was a problem hiding this comment.
SourceGeoLocation is optional because it is an alternative to SourceAddress and SourceIpGroup, rather than a required field for every network rule. This preserves backward compatibility for existing scenarios and allows the PowerShell changes to ship independently of the feature-gated NFVRP rollout. When Geo IP is explicitly used, service-side feature validation still applies.
e431fa8
into
Azure:release-network-2026-01-01
Rebuild on new release-branch tip after PR Azure#30197 (GeoIp Feature changes) merged. Same 3 conflicts as the prior attempt, resolved identically: * src/Network/Network/ChangeLog.md - union of both sides' 'Upcoming Release' bullets. Release-branch entries first (including PR Azure#30197's new SourceGeoLocation / DestinationGeoLocation bullet on New-AzFirewallPolicyNetworkRule), then main's 2 entries appended. * src/Network/NetworkSecurityPerimeter.Autorest/generate-info.json - kept release-branch GUID 046fadd9-... (authoritative NSP.Autorest state). * generated/Network/NetworkSecurityPerimeter.Autorest/generate-info.json - same, kept release-branch GUID for consistency with the src-side file.
🤖 PR Validation —⚠️ Review suggested
️✔️Az.Accounts
️✔️Az.ApplicationInsights
️✔️Az.CognitiveServices
️✔️Az.Compute
️✔️Az.Dns
️✔️Az.Maintenance
️✔️Az.ManagedServiceIdentity
️✔️Az.Monitor
️✔️Az.OperationalInsights
️✔️Az.PrivateDns
️✔️Az.RecoveryServices
️✔️Az.Resources
️✔️Az.Security
️✔️Az.ServiceBus
️✔️Az.Sql
️✔️Az.Storage
️✔️Az.Websites
Description
Adds support for the two new Geo IP filter properties on Azure Firewall Policy network rules, introduced in the
2026-01-01Network API (firewallPolicy.json):sourceGeoLocationsanddestinationGeoLocations. These allow filtering network rule traffic by geographic location using ISO 3166-1 alpha-2 country codes (e.g. "US", "CA").Changes
New-AzFirewallPolicyNetworkRule: Added two new optional parameters:-SourceGeoLocation <String[]>-DestinationGeoLocation <String[]>PSAzureFirewallPolicyNetworkRule): AddedSourceGeoLocations/DestinationGeoLocationsproperties (with[JsonProperty]mappings and display-text getters) so the values serialize correctly to the SDKNetworkRuletype.SourceAddress,SourceIpGroup,SourceGeoLocation) are mutually exclusive.DestinationAddress,DestinationIpGroup,DestinationFqdn,DestinationGeoLocation) are mutually exclusive.2026-01-01spec (already contains the new properties).Test-AzureFirewallPolicyCRUDWithNetworkRuleGeoLocations) inAzureFirewallPolicyTests.New-AzFirewallPolicyNetworkRule.mdhelp and added aChangeLog.mdentry.Notes
AzureFirewall_EnableGeoIpValidation). The scenario-test recording requires a subscription/region where this flag is enabled.Related API PR
https://github.com/Azure/azure-rest-api-specs-pr/pull/29936/changes#diff-2b9eb04c4f38c9aaa644b102e304e488ad4726bc9ae8a23a694a25452cfcc77a
Mandatory Checklist
Please choose the target release of Azure PowerShell. (⚠️ Target release is a different concept from API readiness. Please click below links for details.)
Check this box to confirm: I have read the Submitting Changes section of
CONTRIBUTING.mdand reviewed the following information:ChangeLog.mdfile(s) appropriatelysrc/{{SERVICE}}/{{SERVICE}}/ChangeLog.md.## Upcoming Releaseheader in the past tense.ChangeLog.mdif no new release is required, such as fixing test case only.