There is a command group 'az_network_firewall'. This group of commands could 'manage and configure azure firewalls'. The group of commands has global parameter '--debug' which means 'Increase logging verbosity to show all debug logs.'. The group of commands has global parameter '--help -h' which means 'Show this help message and exit.'. The group of commands has global parameter '--only-show-errors' which means 'Only show errors, suppressing warnings.'. The group of commands has global parameter '--output -o' which means 'Output format.'. The group of commands has global parameter '--query' which means 'JMESPath query string. See <a href="http://jmespath.org/">http://jmespath.org/</a> for more information and examples.'. The group of commands has global parameter '--subscription' which means 'Name or ID of subscription. You can configure the default subscription using `az account set -s NAME_OR_ID`.'. The group of commands has global parameter '--verbose' which means 'Increase logging verbosity. Use --debug for full debug logs.'. This group contains a child command 'az_network_firewall_create'.The syntax is: az network firewall create --name
                           --resource-group
                           [--allow-active-ftp {0, 1, f, false, n, no, t, true, y, yes}]
                           [--conf-name]
                           [--count]
                           [--dns-servers]
                           [--enable-dns-proxy {0, 1, f, false, n, no, t, true, y, yes}]
                           [--enable-explicit-proxy {0, 1, f, false, n, no, t, true, y, yes}]
                           [--enable-fat-flow-logging {0, 1, f, false, n, no, t, true, y, yes}]
                           [--enable-pac-file {0, 1, f, false, n, no, t, true, y, yes}]
                           [--enable-udp-log-optimization {0, 1, f, false, n, no, t, true, y, yes}]
                           [--firewall-policy]
                           [--http-port]
                           [--https-port {0, 1, f, false, n, no, t, true, y, yes}]
                           [--location]
                           [--m-conf-name]
                           [--m-public-ip]
                           [--no-wait {0, 1, f, false, n, no, t, true, y, yes}]
                           [--pac-file]
                           [--pac-file-port]
                           [--private-ranges]
                           [--public-ip]
                           [--route-server-id]
                           [--sku {azfw_hub, azfw_vnet}]
                           [--tags]
                           [--threat-intel-mode {alert, deny, off}]
                           [--tier {basic, premium, standard}]
                           [--vhub]
                           [--vnet-name]
                           [--zones]. The 1th example of the child command would be to use it to 'create a azure firewall with private ranges', the syntax is: az network firewall create -g MyResourceGroup -n MyFirewall --private-ranges 10.0.0.0 10.0.0.0/16 IANAPrivateRanges. The 2th example of the child command would be to use it to 'create a virtual wan secure hub firewall', the syntax is: az network firewall create -g MyResourceGroup -n MyFirewall --sku AZFW_Hub --tier Standard --virtual-hub MyVirtualHub1 --public-ip-count 1. The 3th example of the child command would be to use it to 'create a basic sku firewall with management ip configuration', the syntax is: az network firewall create -g MyResourceGroup -n MyFirewall --sku AZFW_VNet --tier Basic --vnet-name MyVNet --conf-name MyIpConfig --m-conf-name MyManagementIpConfig --m-public-ip MyPublicIp. The 4th example of the child command would be to use it to 'create a basic sku firewall with virtual hub', the syntax is: az network firewall create -g MyResourceGroup -n MyFirewall --sku AZFW_Hub --tier Basic --vhub MyVHub --public-ip-count 2. The parameter '--name -n' is required. It is used to azure firewall name.. The parameter '--resource-group -g' is required. It is used to name of resource group. you can configure the default group using `az configure --defaults group=<name>`.. The parameter '--allow-active-ftp' is optional. allow active ftp. by default it is false. it's only allowed for azure firewall on virtual network.. The parameter '--conf-name' is optional. name of the ip configuration.. The parameter '--count --public-ip-count' is optional. number of public ip address associated with azure firewall. it's used to add public ip addresses into this firewall.. The parameter '--dns-servers' is optional. space-separated list of dns server ip addresses.  support shorthand-syntax, json-file and yaml-file. try "??" to show more.. The parameter '--enable-dns-proxy' is optional. enable dns proxy.. The parameter '--enable-explicit-proxy' is optional. when set to true, explicit proxy mode is enabled.. The parameter '--enable-fat-flow-logging --fat-flow-logging' is optional. allow fat flow logging. by default it is false.. The parameter '--enable-pac-file' is optional. when set to true, pac file port and url needs to be provided.. The parameter '--enable-udp-log-optimization --udp-log-optimization' is optional. allow udp log optimization. by default it is false.. The parameter '--firewall-policy --policy' is optional. name or id of the firewallpolicy associated with this azure firewall.. The parameter '--http-port' is optional. port number for explicit proxy http protocol, cannot be greater than 64000.. The parameter '--https-port' is optional. port number for explicit proxy https protocol, cannot be greater than 64000.. The parameter '--location -l' is optional. resource location.. The parameter '--m-conf-name' is optional. name of the management ip configuration.. The parameter '--m-public-ip' is optional. name or id of the public ip to use for management ip configuration.. The parameter '--no-wait' is optional. do not wait for the long-running operation to finish.. The parameter '--pac-file' is optional. sas url for pac file.. The parameter '--pac-file-port' is optional. port number for firewall to serve pac file.. The parameter '--private-ranges' is optional. space-separated list of snat privaterange. validate values are single ip, ipprefixes or a single special value "ianaprivateranges".  support shorthand-syntax, json-file and yaml-file. try "??" to show more.. The parameter '--public-ip' is optional. name or id of the public ip to use.. The parameter '--route-server-id' is optional. the route server id for the firewall.. The parameter '--sku' is optional. sku of azure firewall. this field cannot be updated after the creation. the default sku in server end is azfw_vnet. if you want to attach azure firewall to  vhub, you should set sku to azfw_hub.. The parameter '--tags' is optional. resource tags.  support shorthand-syntax, json-file and yaml-file. try "??" to show more.. The parameter '--threat-intel-mode' is optional. the operation mode for threat intelligence.. The parameter '--tier' is optional. tier of an azure firewall. --tier will take effect only when --sku is set.. The parameter '--vhub --virtual-hub' is optional. name or id of the virtualhub to which the firewall belongs.. The parameter '--vnet-name' is optional. the virtual network (vnet) name. it should contain one subnet called "azurefirewallsubnet".. The parameter '--zones -z' is optional. space-separated list of availability zones into which to provision the resource. allowed values: 1, 2, 3.  support shorthand-syntax, json-file and yaml-file. try "??" to show more.. 