Feature azure firewall packet capture operation by nikhilpadhye1 · Pull Request #9274 · Azure/azure-cli-extensions

nikhilpadhye1 · 2025-10-07T14:54:04Z

This adds the packet capture operation for azure firewall. Enabling support for start/status/stop packet capture. This feature is looking to be taken to GA in the coming weeks. Used the UI to generate the command as per the rest-api spec and added descriptions and tests to ensure functionality.

This checklist is used to make sure that common guidelines for a pull request are followed.

Related command

az network azure-firewall packetcaptureoperation

General Guidelines

Have you run azdev style <YOUR_EXT> locally? (pip install azdev required)
Have you run python scripts/ci/test_index.py -q locally? (pip install wheel==0.30.0 required)
My extension version conforms to the Extension version schema

For new extensions:

My extension description/summary conforms to the Extension Summary Guidelines.

About Extension Publish

There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update src/index.json automatically.
You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify src/index.json.

azure-client-tools-bot-prd · 2025-10-07T14:54:07Z

⚠️Azure CLI Extensions Breaking Change Test

⚠️azure-firewall

rule cmd_name rule_message suggest_message

⚠️ 1011 - SubgroupAdd network azure-firewall sub group network azure-firewall added

azure-client-tools-bot-prd · 2025-10-07T14:54:10Z

Hi @nikhilpadhye1,
Please write the description of changes which can be perceived by customers into HISTORY.rst.
If you want to release a new extension version, please update the version in setup.py as well.

yonzhan · 2025-10-07T14:54:23Z

Thank you for your contribution! We will review the pull request and get back to you soon.

github-actions · 2025-10-07T14:54:23Z

The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR.

Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions).
After that please run the following commands to enable git hooks:

pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>

github-actions · 2025-10-07T14:55:21Z

CodeGen Tools Feedback Collection

Thank you for using our CodeGen tool. We value your feedback, and we would like to know how we can improve our product. Please take a few minutes to fill our codegen survey

Copilot

Pull Request Overview

Adds Azure Firewall packet capture command supporting start, status, and stop operations, along with associated test coverage and a raised minimum CLI core version.

Introduces new command: network azure-firewall packet-capture-operation
Adds end-to-end scenario test for packet capture
Updates extension minimum CLI core version to 2.75.0

Reviewed Changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
azext_firewall/tests/latest/test_azure_firewall_scenario.py	Adds scenario test for packet capture (start/status/stop) workflow.
azext_firewall/azext_metadata.json	Raises required az cli core version.
aaz/latest/network/azure_firewall/_packet_capture_operation.py	Implements the new packet capture operation command.
aaz/latest/network/azure_firewall/init.py	Exposes new command module.
aaz/latest/network/azure_firewall/__cmd_group.py	Command group definition (no functional logic change).

Copilot · 2025-10-07T14:56:47Z

+        self.cmd('storage account create -g {rg} -n {storageaccountname} --sku Standard_LRS --https-only true --kind StorageV2 --access-tier Hot')
+        self.cmd('storage container create -n {containername} --account-name {storageaccountname} --public-access off')
+        storage_account = self.cmd('az storage account show -g {rg} -n {storageaccountname}').get_output_in_json()
+        sas_response = self.cmd('az storage container generate-sas --account-name {storageaccountname} --name {containername} --permissions acdlrw --expiry {expirystring}').get_output_in_json()


generate-sas returns a SAS token string (TSV/plain) rather than JSON; using get_output_in_json() will fail to parse. Use .output (optionally with -o tsv) and avoid JSON parsing, e.g. self.cmd('... -o tsv').output.strip().

Suggested change

sas_response = self.cmd('az storage container generate-sas --account-name {storageaccountname} --name {containername} --permissions acdlrw --expiry {expirystring}').get_output_in_json()

sas_response = self.cmd('az storage container generate-sas --account-name {storageaccountname} --name {containername} --permissions acdlrw --expiry {expirystring}').output.strip()

Copilot · 2025-10-07T14:56:47Z

+            'rg' : resource_group,
+            'sub_id': "020a3f33-bdd2-4ddc-9275-6041363e2876",
+            'location': "centralus",
+            'storageaccountname': f"azfwcontainerpcaptestcli",


Storage account names must be globally unique; this hard-coded value increases risk of collisions/flaky tests in parallel runs. Recommend generate a randomized name (e.g. self.create_random_name('fwpcap', 20).lower()) and ensure it meets naming constraints.

Suggested change

'storageaccountname': f"azfwcontainerpcaptestcli",

'storageaccountname': self.create_random_name('fwpcap', 20).lower(),

Copilot · 2025-10-07T14:56:48Z

+            "public_ip_name": self.create_random_name("public-ip-", 16),
+            "m_public_ip_name": self.create_random_name("mpublic-ip-", 16),
+            'rg' : resource_group,
+            'sub_id': "020a3f33-bdd2-4ddc-9275-6041363e2876",


Hard-coded subscription ID is not used elsewhere in this test function and can cause confusion; remove it or reference the dynamic test subscription if needed (e.g. self.get_subscription_id()).

Suggested change

'sub_id': "020a3f33-bdd2-4ddc-9275-6041363e2876",

Copilot · 2025-10-07T14:56:48Z

+    _aaz_info = {
+        "version": "2024-10-01",
+        "resources": [
+            ["mgmt-plane", "/subscriptions/{}/resourcegroups/{}/providers/microsoft.network/azurefirewalls/{}/packetcaptureoperation", "2024-10-01"],


Resource path casing in _aaz_info differs from the actual request URL (resourcegroups vs resourceGroups, microsoft.network vs Microsoft.Network, azurefirewalls vs azureFirewalls, packetcaptureoperation vs packetCaptureOperation). This inconsistency can break tooling relying on _aaz_info for resource ID normalization; align casing with the canonical path used in the request (line 206).

Suggested change

["mgmt-plane", "/subscriptions/{}/resourcegroups/{}/providers/microsoft.network/azurefirewalls/{}/packetcaptureoperation", "2024-10-01"],

["mgmt-plane", "/subscriptions/{}/resourceGroups/{}/providers/Microsoft.Network/azureFirewalls/{}/packetCaptureOperation", "2024-10-01"],

Should i make this change?

Copilot · 2025-10-07T14:56:48Z

+        _args_schema.sas_url = AAZStrArg(
+            options=["--sas-url"],
+            arg_group="Parameters",
+            help="Upload capture location",


Help text for --sas-url is vague; clarify it (e.g. 'SAS URL of the destination blob container where the packet capture file will be uploaded').

Suggested change

help="Upload capture location",

help="SAS URL of the destination blob container where the packet capture file will be uploaded.",

github-actions · 2025-10-07T14:58:02Z

Hi @nikhilpadhye1

⚠️ Release Requirements

Module: azure-firewall

⚠️ Please update VERSION to be 1.6.0 in src/azure-firewall/setup.py

Notes

For more info about extension versioning, please refer to Extension version schema

This reverts commit 85427a7.

…-packets-to-capture as num-packets and fixing hard coded elements in the test and updated version/history as per pr bot

necusjz · 2025-10-08T23:35:04Z

/azp run

azure-pipelines · 2025-10-08T23:35:17Z

Azure Pipelines successfully started running 2 pipeline(s).

nikhilpadhye1 added 3 commits September 29, 2025 16:55

Adding cli support for packet capture feature for azure firewall

f8a5b44

Merge branch 'Azure:main' into feature-azureFirewallPacketCapture

e2d0015

packet capture tests + recording

5f3d4d9

Copilot AI review requested due to automatic review settings October 7, 2025 14:54

nikhilpadhye1 requested review from jsntcy, kairu-ms and necusjz as code owners October 7, 2025 14:54

azure-client-tools-bot-prd bot added this to the November 2025 (2025-11-04) milestone Oct 7, 2025

Copilot AI reviewed Oct 7, 2025

View reviewed changes

yonzhan assigned necusjz Oct 7, 2025

nikhilpadhye1 added 4 commits October 7, 2025 17:37

Adding suggested changes from pr bot

85427a7

Revert "Adding suggested changes from pr bot"

f54d2e2

This reverts commit 85427a7.

Fixing lint diff by introducing a abbreviated parameter for number-of…

fbdf5e1

…-packets-to-capture as num-packets and fixing hard coded elements in the test and updated version/history as per pr bot

Merge branch 'main' into feature-azureFirewallPacketCapture

ef3f5da

github-actions bot added the release-version-block Updates do not qualify release version rules. NOTE: please do not edit it manually. label Oct 8, 2025

necusjz added skip-cal-version and removed release-version-block Updates do not qualify release version rules. NOTE: please do not edit it manually. labels Oct 8, 2025

nikhilpadhye1 closed this Oct 20, 2025

	sas_response = self.cmd('az storage container generate-sas --account-name {storageaccountname} --name {containername} --permissions acdlrw --expiry {expirystring}').get_output_in_json()
	sas_response = self.cmd('az storage container generate-sas --account-name {storageaccountname} --name {containername} --permissions acdlrw --expiry {expirystring}').output.strip()

	'storageaccountname': f"azfwcontainerpcaptestcli",
	'storageaccountname': self.create_random_name('fwpcap', 20).lower(),

	["mgmt-plane", "/subscriptions/{}/resourcegroups/{}/providers/microsoft.network/azurefirewalls/{}/packetcaptureoperation", "2024-10-01"],
	["mgmt-plane", "/subscriptions/{}/resourceGroups/{}/providers/Microsoft.Network/azureFirewalls/{}/packetCaptureOperation", "2024-10-01"],

	help="Upload capture location",
	help="SAS URL of the destination blob container where the packet capture file will be uploaded.",

Conversation

nikhilpadhye1 commented Oct 7, 2025

Related command

General Guidelines

About Extension Publish

Uh oh!

azure-client-tools-bot-prd bot commented Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

azure-client-tools-bot-prd bot commented Oct 7, 2025

Uh oh!

yonzhan commented Oct 7, 2025

Uh oh!

github-actions bot commented Oct 7, 2025

Uh oh!

github-actions bot commented Oct 7, 2025

CodeGen Tools Feedback Collection

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Oct 7, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 7, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 7, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 7, 2025

Choose a reason for hiding this comment

Uh oh!

nikhilpadhye1 Oct 8, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 7, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Release Requirements

Module: azure-firewall

Notes

Uh oh!

necusjz commented Oct 8, 2025

Uh oh!

azure-pipelines bot commented Oct 8, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

azure-client-tools-bot-prd bot commented Oct 7, 2025 •

edited

Loading

github-actions bot commented Oct 7, 2025 •

edited

Loading