Skip to content

Commit 0b79c94

Browse files
authored
Merge pull request #115283 from MicrosoftDocs/release-build-virtual-network
Build 2020 Release Virtual Networks
2 parents 9635f25 + 69c5f2c commit 0b79c94

20 files changed

+805
-1
lines changed

articles/networking/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,8 @@
4747
items:
4848
- name: Azure network latency
4949
href: azure-network-latency.md
50+
- name: Internet routing preference in Azure
51+
href: ../virtual-network/routing-preference-overview.md
5052
- name: Virtual networks
5153
href: ../virtual-network/virtual-networks-overview.md?toc=%2fazure%2fnetworking%2ftoc.json
5254
- name: Network load balancing

articles/storage/blobs/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,8 @@
150150
href: ../common/storage-security-controls.md?toc=%2fazure%2fstorage%2fblobs%2ftoc.json
151151
- name: Use Azure Private Endpoints
152152
href: ../common/storage-private-endpoints.md?toc=%2fazure%2fstorage%2fblobs%2ftoc.json
153+
- name: Configure network routing preference
154+
href: ../common/network-routing-preference.md?toc=%2fazure%2fstorage%2fblobs%2ftoc.json
153155
- name: Data redundancy
154156
href: ../common/storage-redundancy.md?toc=%2fazure%2fstorage%2fblobs%2ftoc.json
155157
- name: Data protection
196 KB
Loading
Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
---
2+
title: Configure network routing preference (preview)
3+
titleSuffix: Azure Storage
4+
description: Configure network routing preference (preview) for your Azure storage account to specify how network traffic is routed to your account from clients over the Internet.
5+
services: storage
6+
author: santoshc
7+
8+
ms.service: storage
9+
ms.topic: article
10+
ms.date: 05/12/2020
11+
ms.author: santoshc
12+
ms.reviewer: tamram
13+
ms.subservice: common
14+
---
15+
16+
# Configure network routing preference for Azure Storage (preview)
17+
18+
You can configure network [routing preference](../../virtual-network/routing-preference-overview.md) (preview) for your Azure storage account to specify how network traffic is routed to your account from clients over the Internet. By default, traffic from the Internet is routed to the public endpoint of your storage account over the [Microsoft global network](../../networking/microsoft-global-network.md). Azure Storage provides additional options for configuring how traffic is routed to your storage account.
19+
20+
Configuring routing preference gives you the flexibility to optimize your traffic either for premium network performance or for cost. When you configure a routing preference, you specify how traffic will be directed to the public endpoint for your storage account by default. You can also publish route-specific endpoints for your storage account.
21+
22+
## Microsoft global network versus Internet routing
23+
24+
By default, clients outside of the Azure environment access your storage account over the Microsoft global network. The Microsoft global network is optimized for low-latency path selection to deliver premium network performance with high reliability. Both inbound and outbound traffic are routed through the point of presence (POP) that is closest to the client. This default routing configuration ensures that traffic to and from your storage account traverses over the Microsoft global network for the bulk of its path, maximizing network performance.
25+
26+
You can change the routing configuration for your storage account so that both inbound and outbound traffic are routed to and from clients outside of the Azure environment through the POP closest to the storage account. This route minimizes the traversal of your traffic over the Microsoft global network, handing it off to the transit ISP at the earliest opportunity. Utilizing this routing configuration lowers networking costs.
27+
28+
The following diagram shows how traffic flows between the client and the storage account for each routing preference:
29+
30+
![Overview of routing options for Azure Storage](media/network-routing-preference/routing-options-diagram.png)
31+
32+
For more information on routing preference in Azure, see [What is routing preference (preview)?](../../virtual-network/routing-preference-overview.md).
33+
34+
## Routing configuration
35+
36+
You can choose between the Microsoft global network and Internet routing as the default routing preference for the public endpoint of your storage account. The default routing preference applies to all traffic from clients outside Azure and affects the endpoints for Azure Data Lake Storage Gen2, Blob storage, Azure Files, and static websites. Configuring routing preference is not supported for Azure Queues or Azure Tables.
37+
38+
You can also publish route-specific endpoints for your storage account. When you publish route-specific endpoints, Azure Storage creates new public endpoints for your storage account that route traffic over the desired path. This flexibility enables you to direct traffic to your storage account over a specific route without changing your default routing preference.
39+
40+
For example, publishing an Internet route-specific endpoint for the 'StorageAccountA' will publish the following endpoints for your storage account:
41+
42+
| Storage service | Route-specific endpoint |
43+
| :--------------------- | :------------------------------------------------------- |
44+
| Blob service | `StorageAccountA-internetrouting.blob.core.windows.net` |
45+
| Data Lake Storage Gen2 | `StorageAccountA-internetrouting.dfs.core.windows.net` |
46+
| File service | `StorageAccountA-internetrouting.file.core.windows.net` |
47+
| Static Websites | `StorageAccountA-internetrouting.web.core.windows.net` |
48+
49+
If you have a read-access geo-redundant storage (RA-GRS) or a read-access geo-zone-redundant storage (RA-GZRS) storage account, publishing route-specific endpoints also automatically creates the corresponding endpoints in the secondary region for read access.
50+
51+
| Storage service | Route-specific read-only secondary endpoint |
52+
| :--------------------- | :----------------------------------------------------------------- |
53+
| Blob service | `StorageAccountA-internetrouting-secondary.blob.core.windows.net` |
54+
| Data Lake Storage Gen2 | `StorageAccountA-internetrouting-secondary.dfs.core.windows.net` |
55+
| File service | `StorageAccountA-internetrouting-secondary.file.core.windows.net` |
56+
| Static Websites | `StorageAccountA-internetrouting-secondary.web.core.windows.net` |
57+
58+
The connection strings for the published route-specific endpoints can be copied via the [Azure portal](https://portal.azure.com). These connection strings can be used for Shared Key authorization with all existing Azure Storage SDKs and APIs.
59+
60+
## About the preview
61+
62+
Routing preference for Azure Storage is available in the following regions:
63+
64+
- France South
65+
- North Central US
66+
- West Central US
67+
68+
The following known issues affect the routing preference preview for Azure Storage:
69+
70+
- Access requests for the route-specific endpoint for the Microsoft global network fail with HTTP error 404 or equivalent. Routing over the Microsoft global network works as expected when it is set as the default routing preference for the public endpoint.
71+
72+
## Pricing and billing
73+
74+
For pricing and billing details, see the **Pricing** section in [What is routing preference (preview)?](../../virtual-network/routing-preference-overview.md#pricing).
75+
76+
## Next steps
77+
78+
- [What is routing preference (preview)?](../../virtual-network/routing-preference-overview.md)
79+
- [Configure Azure Storage firewalls and virtual networks](storage-network-security.md)
80+
- [Security recommendations for Blob storage](../blobs/security-recommendations.md)

articles/storage/files/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,8 @@
4848
items:
4949
- name: Customer-managed keys with Azure Key Vault
5050
href: ../common/encryption-customer-managed-keys.md?toc=%2fazure%2fstorage%2ffiles%2ftoc.json
51+
- name: Configure network routing preference
52+
href: ../common/network-routing-preference.md?toc=%2fazure%2fstorage%2ffiles%2ftoc.json
5153
- name: Compliance offerings
5254
href: ../common/storage-compliance-offerings.md?toc=%2fazure%2fstorage%2ffiles%2ftoc.json
5355
- name: Development
Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
---
2+
title: Configure routing preference for a VM - Azure CLI
3+
description: Learn how to create a VM with a public IP address with routing preference choice using the Azure command-line interface (CLI).
4+
services: virtual-network
5+
documentationcenter: na
6+
author: KumudD
7+
manager: mtillman
8+
ms.service: virtual-network
9+
ms.devlang: na
10+
ms.topic: conceptual
11+
ms.tgt_pltfrm: na
12+
ms.workload: infrastructure-services
13+
ms.date: 05/18/2020
14+
ms.author: mnayak
15+
16+
---
17+
# Configure routing preference for a VM using Azure CLI
18+
19+
This article shows you how to configure routing preference for a virtual machine. Internet bound traffic from the VM will be routed via the ISP network when you choose **Internet** as your routing preference option . The default routing is via the Microsoft global network.
20+
21+
This article shows you how to create a virtual machine with a public IP that is set to route traffic via the public internet using Azure CLI.
22+
23+
> [!IMPORTANT]
24+
> Routing preference is currently in public preview.
25+
> This preview version is provided without a service level agreement, and it's not recommended for production workloads. Certain features might not be supported or might have constrained capabilities.
26+
> For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
27+
28+
## Register the feature for your subscription
29+
The Routing Preference feature is currently in preview. Register the feature for your subscription as follows:
30+
```azurecli
31+
az feature register --namespace Microsoft.Network --name AllowRoutingPreferenceFeature
32+
```
33+
## Create a resource group
34+
1. If using the Cloud Shell, skip to step 2. Open a command session and sign into Azure with `az login`.
35+
2. Create a resource group with the [az group create](/cli/azure/group#az-group-create) command. The following example creates a resource group in the East US Azure region:
36+
37+
```azurecli
38+
az group create --name myResourceGroup --location eastus
39+
```
40+
41+
## Create a public IP address
42+
To access your virtual machines from the Internet, you need to create a public IP address. Create a public IP address with [az network public-ip create](/cli/azure/network/public-ip). The following example creates a public ip of routing preference type *Internet* in the *East US* region:
43+
44+
```azurecli
45+
az network public-ip create \
46+
--name MyRoutingPrefIP \
47+
--resource-group MyResourceGroup \
48+
--location eastus \
49+
--ip-tags 'RoutingPreference=Internet' \
50+
--sku STANDARD \
51+
--allocation-method static \
52+
--version IPv4
53+
```
54+
55+
## Create network resources
56+
57+
Before you deploy a VM, you must create supporting network resources - network security group, virtual network, and virtual NIC.
58+
59+
### Create a network security group
60+
61+
Create a network security group for the rules that will govern inbound and outbound communication in your VNet with [az network nsg create](https://docs.microsoft.com/cli/azure/network/nsg?view=azure-cli-latest#az-network-nsg-create)
62+
63+
```azurecli
64+
az network nsg create \
65+
--name myNSG \
66+
--resource-group MyResourceGroup \
67+
--location eastus
68+
```
69+
70+
### Create a virtual network
71+
72+
Create a virtual network with [az network vnet create](https://docs.microsoft.com/cli/azure/network/vnet?view=azure-cli-latest#az-network-vnet-create). The following example creates a virtual network named *myVNET* with subnets *mySubNet*:
73+
74+
```azurecli
75+
# Create a virtual network
76+
az network vnet create \
77+
--name myVNET \
78+
--resource-group MyResourceGroup \
79+
--location eastus
80+
81+
# Create a subnet
82+
az network vnet subnet create \
83+
--name mySubNet \
84+
--resource-group MyResourceGroup \
85+
--vnet-name myVNET \
86+
--address-prefixes "10.0.0.0/24" \
87+
--network-security-group myNSG
88+
```
89+
90+
### Create a NIC
91+
92+
Create a virtual NIC for the VM with [az network nic create](https://docs.microsoft.com/cli/azure/network/nic?view=azure-cli-latest#az-network-nic-create). The following example creates a virtual NIC, which will be attached to the VM.
93+
94+
```azurecli-interactive
95+
# Create a NIC
96+
az network nic create \
97+
--name mynic \
98+
--resource-group MyResourceGroup \
99+
--network-security-group myNSG \
100+
--vnet-name myVNET \
101+
--subnet mySubNet \
102+
--private-ip-address-version IPv4 \
103+
--public-ip-address MyRoutingPrefIP
104+
```
105+
106+
## Create a virtual machine
107+
108+
Create a VM with [az vm create](https://docs.microsoft.com/cli/azure/vm?view=azure-cli-latest#az-vm-create). The following example creates a windows server 2019 VM and the required virtual network components if they do not already exist.
109+
110+
```azurecli
111+
az vm create \
112+
--name myVM \
113+
--resource-group MyResourceGroup \
114+
--nics mynic \
115+
--size Standard_A2 \
116+
--image MicrosoftWindowsServer:WindowsServer:2019-Datacenter:latest \
117+
--admin-username myUserName
118+
```
119+
120+
## Clean up resources
121+
122+
When no longer needed, you can use [az group delete](/cli/azure/group#az-group-delete) to remove the resource group and all of the resources it contains:
123+
124+
```azurecli
125+
az group delete --name myResourceGroup --yes
126+
```
127+
128+
## Next steps
129+
130+
- Learn more about [routing preference in public IP addresses](routing-preference-overview.md).
131+
- Learn more about [public IP addresses](virtual-network-ip-addresses-overview-arm.md#public-ip-addresses) in Azure.
132+
- Learn more about [public IP address settings](virtual-network-public-ip-address.md#create-a-public-ip-address).
Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
---
2+
title: Configure routing preference for a VM - Azure PowerShell
3+
description: Learn how to create a VM with a public IP address with routing preference choice using the Azure PowerShell.
4+
services: virtual-network
5+
documentationcenter: na
6+
author: KumudD
7+
manager: mtillman
8+
ms.service: virtual-network
9+
ms.devlang: na
10+
ms.topic: conceptual
11+
ms.tgt_pltfrm: na
12+
ms.workload: infrastructure-services
13+
ms.date: 05/18/2020
14+
ms.author: mnayak
15+
16+
---
17+
# Configure routing preference for a VM using Azure PowerShell
18+
19+
This article shows you how to configure routing preference for a virtual machine. Internet bound traffic from the VM will be routed via the ISP network when you choose **Internet** as your routing preference option . The default routing is via the Microsoft global network.
20+
21+
This article shows you how to create a virtual machine with a public IP that is set to route traffic via the ISP network using Azure PowerShell.
22+
23+
> [!IMPORTANT]
24+
> Routing preference is currently in public preview.
25+
> This preview version is provided without a service level agreement, and it's not recommended for production workloads. Certain features might not be supported or might have constrained capabilities.
26+
> For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
27+
28+
## Register the feature for your subscription
29+
The Routing Preference feature is currently in preview. Register the feature for your subscription as follows:
30+
```azurepowershell
31+
Register-AzProviderFeature -FeatureName AllowRoutingPreferenceFeature ProviderNamespace Microsoft.Network
32+
```
33+
34+
## Create a resource group
35+
1. If using the Cloud Shell, skip to step 2. Open a command session and sign into Azure with `Connect-AzAccount`.
36+
2. Create a resource group with the [New-AzResourceGroup](/powershell/module/az.resources/new-azresourcegroup) command. The following example creates a resource group in the East US Azure region:
37+
38+
```azurepowershell
39+
$rg = New-AzResourceGroup -Name MyResourceGroup -Location EastUS
40+
```
41+
42+
## Create a public IP address
43+
44+
To access your virtual machines from the Internet, you need a public IP addresses. Create public IP addresses with [New-AzPublicIpAddress](/powershell/module/az.network/new-azpublicipaddress). The following example creates a IPv4 public IP address named *MyPublicIP* routing preference type *Internet* in the *MyResourceGroup* resource group in *East US* region:
45+
46+
```azurepowershell-interactive
47+
$iptagtype="RoutingPreference"
48+
$tagName = "Internet"
49+
$ipTag = New-AzPublicIpTag -IpTagType $iptagtype -Tag $tagName
50+
# attach the tag
51+
$publicIp = New-AzPublicIpAddress `
52+
-Name "MyPublicIP" `
53+
-ResourceGroupName $rg.ResourceGroupName `
54+
-Location $rg.Location `
55+
-IpTag $ipTag `
56+
-AllocationMethod Static `
57+
-Sku Standard `
58+
-IpAddressVersion IPv4
59+
```
60+
61+
## Create network resources
62+
63+
Before you deploy a VM, you must create supporting network resources - network security group, virtual network, and virtual NIC.
64+
65+
### Create a network security group
66+
67+
Create a network security group with [New-AzNetworkSecurityGroup](/powershell/module/az.network/new-aznetworksecuritygroup). The following example creates a NSG named *myNSG*
68+
69+
```azurepowershell
70+
$nsg = New-AzNetworkSecurityGroup `
71+
-ResourceGroupName $rg.ResourceGroupName `
72+
-Location $rg.Location `
73+
-Name "myNSG"
74+
```
75+
76+
### Create a virtual network
77+
78+
Create a virtual network with [New-AzVirtualNetwork](/powershell/module/az.network/new-azvirtualnetwork). The following example creates a virtual network named *myVNET* with *mySubNet*:
79+
80+
### Create a subnet
81+
82+
```azurepowershell
83+
$subnet = New-AzVirtualNetworkSubnetConfig `
84+
-Name "mySubnet" `
85+
-AddressPrefix "10.0.0.0/24"
86+
```
87+
88+
```azurepowershell
89+
# Create a virtual network
90+
$vnet = New-AzVirtualNetwork `
91+
-ResourceGroupName $rg.ResourceGroupName `
92+
-Location $rg.Location `
93+
-Name "myVNET" `
94+
-AddressPrefix "10.0.0.0/16" `
95+
-Subnet $subnet
96+
```
97+
98+
### Create a NIC
99+
100+
Create virtual NICs with [New-AzNetworkInterface](/powershell/module/az.network/new-aznetworkinterface. The following example creates a virtual NIC.
101+
102+
```azurepowershell
103+
# Create an IP Config
104+
$ipconfig=New-AzNetworkInterfaceIpConfig `
105+
-Name myIpConfig `
106+
-Subnet $vnet.subnets[0] `
107+
-PrivateIpAddressVersion IPv4 `
108+
-PublicIpAddress $publicIp
109+
110+
# Create a NIC
111+
$nic = New-AzNetworkInterface `
112+
-Name "mynic" `
113+
-ResourceGroupName $rg.ResourceGroupName `
114+
-Location $rg.Location `
115+
-NetworkSecurityGroupId $nsg.Id `
116+
-IpConfiguration $ipconfig
117+
```
118+
119+
## Create a virtual machine
120+
121+
Set an administrator username and password for the VMs with [Get-Credential](https://msdn.microsoft.com/powershell/reference/5.1/microsoft.powershell.security/Get-Credential):
122+
123+
```azurepowershell
124+
$cred = get-credential -Message "Routing Preference SAMPLE: Please enter the Administrator credential to log into the VM."
125+
```
126+
127+
Now you can create the VM with [New-AzVM](/powershell/module/az.compute/new-azvm). The following example creates two VMs and the required virtual network components if they do not already exist.
128+
129+
```azurepowershell
130+
$vmsize = "Standard_A2"
131+
$ImagePublisher = "MicrosoftWindowsServer"
132+
$imageOffer = "WindowsServer"
133+
$imageSKU = "2019-Datacenter"
134+
135+
$vmName= "myVM"
136+
$vmconfig = New-AzVMConfig -VMName $vmName -VMSize $vmsize | Set-AzVMOperatingSystem -Windows -ComputerName $vmName -Credential $cred -ProvisionVMAgent -EnableAutoUpdate | Set-AzVMSourceImage -PublisherName $ImagePublisher -Offer $imageOffer -Skus $imageSKU -Version "latest" | Set-AzVMOSDisk -Name "$vmName.vhd" -CreateOption "FromImage" | Add-AzVMNetworkInterface -Id $nic.Id
137+
$VM1 = New-AzVM -ResourceGroupName $rg.ResourceGroupName -Location $rg.Location -VM $vmconfig
138+
```
139+
140+
## Allow network traffic to the VM
141+
142+
Before you can connect to the public IP address from the internet, ensure that you have the necessary ports open in any network security group that you might have associated to the network interface, the subnet the network interface is in, or both. You can view the effective security rules for a network interface and its subnet using the [Portal](diagnose-network-traffic-filter-problem.md#diagnose-using-azure-portal), [CLI](diagnose-network-traffic-filter-problem.md#diagnose-using-azure-cli), or [PowerShell](diagnose-network-traffic-filter-problem.md#diagnose-using-powershell).
143+
144+
## Clean up resources
145+
146+
When no longer needed, you can use the [Remove-AzResourceGroup](/powershell/module/az.resources/remove-azresourcegroup) command to remove the resource group, VM, and all related resources.
147+
148+
```azurepowershell
149+
Remove-AzResourceGroup -Name MyResourceGroup
150+
```
151+
152+
## Next steps
153+
154+
* Learn more about [routing preference in public IP addresses](routing-preference-overview.md).
155+
* Learn more about [public IP addresses](virtual-network-ip-addresses-overview-arm.md#public-ip-addresses) in Azure.
156+
* Learn more about [public IP address settings](virtual-network-public-ip-address.md#create-a-public-ip-address).
12.5 KB
Loading
12.2 KB
Loading
82.8 KB
Loading

0 commit comments

Comments
 (0)