Skip to content

Commit 02d89d9

Browse files
ttorblettorble
authored
Merge pull request #284269 from asudbring/sfi-us295036
SFI-ROPC Remove ROPC from filter traffic CLI tutorial
2 parents bca5617 + eda756d commit 02d89d9

File tree

1 file changed

+96
-71
lines changed

1 file changed

+96
-71
lines changed

‎articles/virtual-network/tutorial-filter-network-traffic-cli.md

Lines changed: 96 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,10 @@
11
---
22
title: Filter network traffic - Azure CLI
33
description: In this article, you learn how to filter network traffic to a subnet, with a network security group, using the Azure CLI.
4-
services: virtual-network
54
author: asudbring
6-
75
ms.service: azure-virtual-network
8-
ms.devlang: azurecli
96
ms.topic: how-to
10-
ms.tgt_pltfrm: virtual-network
11-
ms.date: 03/30/2018
7+
ms.date: 08/09/2024
128
ms.author: allensu
139
ms.custom: devx-track-azurecli
1410
# Customer intent: I want to filter network traffic to virtual machines that perform similar functions, such as web servers.
@@ -35,175 +31,201 @@ A network security group contains security rules. Security rules specify a sourc
3531

3632
### Create application security groups
3733

38-
First create a resource group for all the resources created in this article with [az group create](/cli/azure/group). The following example creates a resource group in the *eastus* location:
34+
First create a resource group for all the resources created in this article with [az group create](/cli/azure/group). The following example creates a resource group in the *westus2* location:
3935

4036
```azurecli-interactive
4137
az group create \
42-
--name myResourceGroup \
43-
--location eastus
38+
--name test-rg \
39+
--location westus2
4440
```
4541

4642
Create an application security group with [az network asg create](/cli/azure/network/asg). An application security group enables you to group servers with similar port filtering requirements. The following example creates two application security groups.
4743

4844
```azurecli-interactive
4945
az network asg create \
50-
--resource-group myResourceGroup \
51-
--name myAsgWebServers \
52-
--location eastus
46+
--resource-group test-rg \
47+
--name asg-web-servers \
48+
--location westus2
5349
5450
az network asg create \
55-
--resource-group myResourceGroup \
56-
--name myAsgMgmtServers \
57-
--location eastus
51+
--resource-group test-rg \
52+
--name asg-mgmt-servers \
53+
--location westus2
5854
```
5955

6056
### Create a network security group
6157

62-
Create a network security group with [az network nsg create](/cli/azure/network/nsg). The following example creates a network security group named *myNsg*:
58+
Create a network security group with [az network nsg create](/cli/azure/network/nsg). The following example creates a network security group named *nsg-1*:
6359

6460
```azurecli-interactive
6561
# Create a network security group
6662
az network nsg create \
67-
--resource-group myResourceGroup \
68-
--name myNsg
63+
--resource-group test-rg \
64+
--name nsg-1
6965
```
7066

7167
### Create security rules
7268

73-
Create a security rule with [az network nsg rule create](/cli/azure/network/nsg/rule). The following example creates a rule that allows traffic inbound from the internet to the *myWebServers* application security group over ports 80 and 443:
69+
Create a security rule with [az network nsg rule create](/cli/azure/network/nsg/rule). The following example creates a rule that allows traffic inbound from the internet to the *asg-web-servers* application security group over ports 80 and 443:
7470

7571
```azurecli-interactive
7672
az network nsg rule create \
77-
--resource-group myResourceGroup \
78-
--nsg-name myNsg \
73+
--resource-group test-rg \
74+
--nsg-name nsg-1 \
7975
--name Allow-Web-All \
8076
--access Allow \
8177
--protocol Tcp \
8278
--direction Inbound \
8379
--priority 100 \
8480
--source-address-prefix Internet \
8581
--source-port-range "*" \
86-
--destination-asgs "myAsgWebServers" \
82+
--destination-asgs "asg-web-servers" \
8783
--destination-port-range 80 443
8884
```
8985

90-
The following example creates a rule that allows traffic inbound from the Internet to the *myMgmtServers* application security group over port 22:
86+
The following example creates a rule that allows traffic inbound from the Internet to the *asg-mgmt-servers* application security group over port 22:
9187

9288
```azurecli-interactive
9389
az network nsg rule create \
94-
--resource-group myResourceGroup \
95-
--nsg-name myNsg \
90+
--resource-group test-rg \
91+
--nsg-name nsg-1 \
9692
--name Allow-SSH-All \
9793
--access Allow \
9894
--protocol Tcp \
9995
--direction Inbound \
10096
--priority 110 \
10197
--source-address-prefix Internet \
10298
--source-port-range "*" \
103-
--destination-asgs "myAsgMgmtServers" \
99+
--destination-asgs "asg-mgmt-servers" \
104100
--destination-port-range 22
105101
```
106102

107-
In this article, SSH (port 22) is exposed to the internet for the *myAsgMgmtServers* VM. For production environments, instead of exposing port 22 to the internet, it's recommended that you connect to Azure resources that you want to manage using a [VPN](../vpn-gateway/vpn-gateway-about-vpngateways.md?toc=%2fazure%2fvirtual-network%2ftoc.json) or [private](../expressroute/expressroute-introduction.md?toc=%2fazure%2fvirtual-network%2ftoc.json) network connection.
103+
In this article, the *asg-mgmt-servers* asg exposes SSH (port 22) to the internet. For production environments, use a [VPN](../vpn-gateway/vpn-gateway-about-vpngateways.md?toc=%2fazure%2fvirtual-network%2ftoc.json) or [private](../expressroute/expressroute-introduction.md?toc=%2fazure%2fvirtual-network%2ftoc.json) network connection to manage Azure resources instead of exposing port 22 to the internet.
108104

109105
## Create a virtual network
110106

111-
Create a virtual network with [az network vnet create](/cli/azure/network/vnet). The following example creates a virtual named *myVirtualNetwork*:
107+
Create a virtual network with [az network vnet create](/cli/azure/network/vnet). The following example creates a virtual named *vnet-1*:
112108

113109
```azurecli-interactive
114110
az network vnet create \
115-
--name myVirtualNetwork \
116-
--resource-group myResourceGroup \
111+
--name vnet-1 \
112+
--resource-group test-rg \
117113
--address-prefixes 10.0.0.0/16
118114
```
119115

120-
Add a subnet to a virtual network with [az network vnet subnet create](/cli/azure/network/vnet/subnet). The following example adds a subnet named *mySubnet* to the virtual network and associates the *myNsg* network security group to it:
116+
Add a subnet to a virtual network with [az network vnet subnet create](/cli/azure/network/vnet/subnet). The following example adds a subnet named *subnet-1* to the virtual network and associates the *nsg-1* network security group to it:
121117

122118
```azurecli-interactive
123119
az network vnet subnet create \
124-
--vnet-name myVirtualNetwork \
125-
--resource-group myResourceGroup \
126-
--name mySubnet \
120+
--vnet-name vnet-1 \
121+
--resource-group test-rg \
122+
--name subnet-1 \
127123
--address-prefix 10.0.0.0/24 \
128-
--network-security-group myNsg
124+
--network-security-group nsg-1
129125
```
130126

131127
## Create virtual machines
132128

133129
Create two VMs in the virtual network so you can validate traffic filtering in a later step.
134130

135-
Create a VM with [az vm create](/cli/azure/vm). The following example creates a VM that will serve as a web server. The `--asgs myAsgWebServers` option causes Azure to make the network interface it creates for the VM a member of the *myAsgWebServers* application security group.
136-
137-
The `--nsg ""` option is specified to prevent Azure from creating a default network security group for the network interface Azure creates when it creates the VM. To streamline this article, a password is used. Keys are typically used in production deployments. If you use keys, you must also configure SSH agent forwarding for the remaining steps. For more information, see the documentation for your SSH client. Replace `<replace-with-your-password>` in the following command with a password of your choosing.
131+
Create a VM with [az vm create](/cli/azure/vm). The following example creates a VM that serves as a web server. The `--asgs asg-web-servers` option causes Azure to make the network interface it creates for the VM a member of the *asg-web-servers* application security group. The `--nsg ""` option is specified to prevent Azure from creating a default network security group for the network interface Azure creates when it creates the VM. The command prompts you to create a password for the VM. SSH keys aren't used in this example to facilitate the later steps in this article. In a production environment, use SSH keys for security.
138132

139133
```azurecli-interactive
140-
adminPassword="<replace-with-your-password>"
141-
142134
az vm create \
143-
--resource-group myResourceGroup \
144-
--name myVmWeb \
135+
--resource-group test-rg \
136+
--name vm-web \
145137
--image Ubuntu2204 \
146-
--vnet-name myVirtualNetwork \
147-
--subnet mySubnet \
138+
--vnet-name vnet-1 \
139+
--subnet subnet-1 \
148140
--nsg "" \
149-
--asgs myAsgWebServers \
141+
--asgs asg-web-servers \
150142
--admin-username azureuser \
151-
--admin-password $adminPassword
143+
--authentication-type password \
144+
--assign-identity
152145
```
153146

154147
The VM takes a few minutes to create. After the VM is created, output similar to the following example is returned:
155148

156149
```output
157150
{
158151
"fqdns": "",
159-
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVmWeb",
160-
"location": "eastus",
152+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.Compute/virtualMachines/vm-web",
153+
"location": "westus2",
161154
"macAddress": "00-0D-3A-23-9A-49",
162155
"powerState": "VM running",
163156
"privateIpAddress": "10.0.0.4",
164-
"publicIpAddress": "13.90.242.231",
165-
"resourceGroup": "myResourceGroup"
157+
"publicIpAddress": "203.0.113.24",
158+
"resourceGroup": "test-rg"
166159
}
167160
```
168161

169-
Take note of the **publicIpAddress**. This address is used to access the VM from the internet in a later step. Create a VM to serve as a management server:
162+
Create a VM with [az vm create](/cli/azure/vm). The following example creates a VM that serves as a management server. The `--asgs asg-mgmt-servers` option causes Azure to make the network interface it creates for the VM a member of the *asg-mgmt-servers* application security group.
163+
164+
The following example creates a VM and adds a user account. The `--generate-ssh-keys` parameter causes the CLI to look for an available ssh key in `~/.ssh`. If one is found, that key is used. If not, one is generated and stored in `~/.ssh`. Finally, we deploy the latest `Ubuntu 22.04` image.
170165

171166
```azurecli-interactive
172167
az vm create \
173-
--resource-group myResourceGroup \
174-
--name myVmMgmt \
168+
--resource-group test-rg \
169+
--name vm-mgmt \
175170
--image Ubuntu2204 \
176-
--vnet-name myVirtualNetwork \
177-
--subnet mySubnet \
171+
--vnet-name vnet-1 \
172+
--subnet subnet-1 \
178173
--nsg "" \
179-
--asgs myAsgMgmtServers \
174+
--asgs asg-mgmt-servers \
180175
--admin-username azureuser \
181-
--admin-password $adminPassword
176+
--generate-ssh-keys \
177+
--assign-identity
182178
```
183179

184-
The VM takes a few minutes to create. After the VM is created, note the **publicIpAddress** in the returned output. This address is used to access the VM in the next step. Don't continue with the next step until Azure finishes creating the VM.
180+
The VM takes a few minutes to create. Don't continue with the next step until Azure finishes creating the VM.
181+
182+
## Enable Microsoft Entra ID sign in for the virtual machines
183+
184+
The following code example the extension to enable a Microsoft Entra ID sign-in for a Linux VM. VM extensions are small applications that provide post-deployment configuration and automation tasks on Azure virtual machines.
185+
186+
```bash
187+
az vm extension set \
188+
--publisher Microsoft.Azure.ActiveDirectory \
189+
--name AADSSHLoginForLinux \
190+
--resource-group test-rg \
191+
--vm-name vm-web
192+
193+
az vm extension set \
194+
--publisher Microsoft.Azure.ActiveDirectory \
195+
--name AADSSHLoginForLinux \
196+
--resource-group test-rg \
197+
--vm-name vm-mgmt
198+
```
185199

186200
## Test traffic filters
187201

188-
Use the command that follows to create an SSH session with the *myVmMgmt* VM. Replace *\<publicIpAddress>* with the public IP address of your VM. In the example above, the IP address is *13.90.242.231*.
202+
Using an SSH client of your choice, connect to the VMs created previously. For example, the following command can be used from a command line interface such as [Windows Subsystem for Linux](/windows/wsl/install) to create an SSH session with the *vm-mgmt* VM. In the previous steps, we enabled Microsoft Entra ID sign-in for the VMs. You can sign-in to the virtual machines using your Microsoft Entra ID credentials or you can use the SSH key that you used to create the VMs. In the following example, we use the SSH key to sign in to management VM and then sign in to the web VM from the management VM with a password.
189203

190-
```bash
191-
ssh azureuser@<publicIpAddress>
204+
For more information about how to SSH to a Linux VM and sign in with Microsoft Entra ID, see [Sign in to a Linux virtual machine in Azure by using Microsoft Entra ID and OpenSSH](/entra/identity/devices/howto-vm-sign-in-azure-ad-linux).
205+
206+
### Store IP address of VM in order to SSH
207+
208+
Run the following command to store the IP address of the VM as an environment variable:
209+
210+
```bash
211+
export IP_ADDRESS=$(az vm show --show-details --resource-group test-rg --name vm-mgmt --query publicIps --output tsv)
192212
```
193213

194-
When prompted for a password, enter the password you entered in [Create VMs](#create-virtual-machines).
214+
```bash
215+
ssh -o StrictHostKeyChecking=no azureuser@$IP_ADDRESS
216+
```
195217

196-
The connection succeeds, because port 22 is allowed inbound from the Internet to the *myAsgMgmtServers* application security group that the network interface attached to the *myVmMgmt* VM is in.
218+
The connection succeeds because the network interface attached to the *vm-mgmt* VM is in the *asg-mgmt-servers* application security group, which allows port 22 inbound from the Internet.
197219

198-
Use the following command to SSH to the *myVmWeb* VM from the *myVmMgmt* VM:
220+
Use the following command to SSH to the *vm-web* VM from the *vm-mgmt* VM:
199221

200222
```bash
201-
ssh azureuser@myVmWeb
223+
ssh -o StrictHostKeyChecking=no azureuser@vm-web
202224
```
203225

204-
The connection succeeds because a default security rule within each network security group allows traffic over all ports between all IP addresses within a virtual network. You can't SSH to the *myVmWeb* VM from the Internet because the security rule for the *myAsgWebServers* doesn't allow port 22 inbound from the Internet.
226+
The connection succeeds because a default security rule within each network security group allows traffic over all ports between all IP addresses within a virtual network. You can't SSH to the *vm-web* VM from the Internet because the security rule for the *asg-web-servers* doesn't allow port 22 inbound from the Internet.
205227

206-
Use the following commands to install the nginx web server on the *myVmWeb* VM:
228+
Use the following commands to install the nginx web server on the *vm-web* VM:
207229

208230
```bash
209231
# Update package source
@@ -213,24 +235,27 @@ sudo apt-get -y update
213235
sudo apt-get -y install nginx
214236
```
215237

216-
The *myVmWeb* VM is allowed outbound to the Internet to retrieve nginx because a default security rule allows all outbound traffic to the Internet. Exit the *myVmWeb* SSH session, which leaves you at the `username@myVmMgmt:~$` prompt of the *myVmMgmt* VM. To retrieve the nginx welcome screen from the *myVmWeb* VM, enter the following command:
238+
The *vm-web* VM is allowed outbound to the Internet to retrieve nginx because a default security rule allows all outbound traffic to the Internet. Exit the *vm-web* SSH session, which leaves you at the `username@vm-mgmt:~$` prompt of the *vm-mgmt* VM. To retrieve the nginx welcome screen from the *vm-web* VM, enter the following command:
217239

218240
```bash
219-
curl myVmWeb
241+
curl vm-web
220242
```
221243

222-
Logout of the *myVmMgmt* VM. To confirm that you can access the *myVmWeb* web server from outside of Azure, enter `curl <publicIpAddress>` from your own computer. The connection succeeds, because port 80 is allowed inbound from the Internet to the *myAsgWebServers* application security group that the network interface attached to the *myVmWeb* VM is in.
244+
Sign out of the *vm-mgmt* VM. To confirm that you can access the *vm-web* web server from outside of Azure, enter `curl <publicIpAddress>` from your own computer. The connection succeeds because the *asg-web-servers* application security group, which the network interface attached to the *vm-web* VM is in, allows port 80 inbound from the Internet.
223245

224246
## Clean up resources
225247

226248
When no longer needed, use [az group delete](/cli/azure/group) to remove the resource group and all of the resources it contains.
227249

228250
```azurecli-interactive
229-
az group delete --name myResourceGroup --yes
251+
az group delete \
252+
--name test-rg \
253+
--yes \
254+
--no-wait
230255
```
231256

232257
## Next steps
233258

234259
In this article, you created a network security group and associated it to a virtual network subnet. To learn more about network security groups, see [Network security group overview](./network-security-groups-overview.md) and [Manage a network security group](manage-network-security-group.md).
235260

236-
Azure routes traffic between subnets by default. You may instead, choose to route traffic between subnets through a VM, serving as a firewall, for example. To learn how, see [Create a route table](tutorial-create-route-table-cli.md).
261+
Azure routes traffic between subnets by default. You can instead, choose to route traffic between subnets through a VM, serving as a firewall, for example. To learn how, see [Create a route table](tutorial-create-route-table-cli.md).

0 commit comments

Comments
 (0)