Investigate if Basic Azure Firewall SKU can be used

[marrobi]

No description provided.

[tamirkamara]

Looks like there're a few requirements we need to meet:

1. Use a management subnet (aka forced tunneling)
2. Use Firewall Policy (migration from classic rules)

[marrobi]

@tamirkamara think 1 could be covered by adding an additional address space for the shared service as we are now doing with workspace services.

[tamirkamara]

think 1 could be covered by adding an additional address space for the shared service as we are now doing with workspace services.

If we want things organized then this subnet should be in the core segment and not general-purpose TRE segment. @marrobi

[marrobi]

As the core infra doesn't have TRE state wouldn't be able to add the additional address space to core vnet anyway.

I don't think we should be precious about the address space being in the core pieces, as firewall is actually a shared service.

[tamirkamara]

Not sure I understand what you meant, but it isn't possible today to get another address space in a shared service.

[tamirkamara]

At any case, I'm going to deal with this in an upcoming PR but must say I was surprised since one can't deallocated a Basic firewall like with the other SKUs. This means that for most non-24/7 deployments a Standard SKU is the cheapest option.