|
1 | 1 | --- |
2 | | -title: What is Azure IoT Layered Network Management (preview)? |
3 | | -description: Learn about Azure IoT Layered Network Management (preview). |
| 2 | +title: Azure IoT Operations networking |
| 3 | +description: Learn about Azure IoT Operations networking |
4 | 4 | author: PatAltimore |
5 | 5 | ms.subservice: layered-network-management |
6 | 6 | ms.author: patricka |
7 | 7 | ms.topic: concept-article |
8 | 8 | ms.custom: |
9 | 9 | - ignite-2023 |
10 | | -ms.date: 10/22/2024 |
| 10 | +ms.date: 06/30/2025 |
11 | 11 |
|
12 | | -#CustomerIntent: As an operator, I want understand how to use Azure IoT Layered Network Management to secure my devices. |
| 12 | +#CustomerIntent: As an operator, I want understand how to use Azure IoT Operations networking to secure my devices. |
13 | 13 | ms.service: azure-iot-operations |
14 | 14 | --- |
15 | 15 |
|
16 | | -# What is Azure IoT Layered Network Management (preview)? |
| 16 | +# Azure IoT Operations networking |
17 | 17 |
|
18 | | -Azure IoT Layered Network Management (preview) service is a component that facilitates the connection between Azure and clusters in isolated network environment. In industrial scenarios, the isolated network follows the *[ISA-95](https://www.isa.org/standards-and-publications/isa-standards/isa-standards-committees/isa95)/[Purdue Network architecture](https://en.wikipedia.org/wiki/Purdue_Enterprise_Reference_Architecture)*. The Layered Network Management (preview) service can route the network traffic from a non-internet facing layer through an internet facing layer and then to Azure. You have to deploy the Layered Network Management and configure it properly for your network environment before deploying the Azure IoT Operations on Arc-enabled Kubernetes clusters. Review the network architecture of your solution and use the Layered Network Management service if it's applicable and necessary for your scenarios. If you integrated other mechanisms of controlling internet access for the isolated network, you should compare the functionality with Layered Network Management service and choose the one that fits your needs the best. Layered Network Management is an optional component and it's not a dependency for any feature of Azure IoT Operations service. |
| 18 | +Networking is a foundational aspect of deploying and managing distributed systems, especially when working with hybrid and multi-cloud environments. In Azure Arc-enabled scenarios, networking enables secure connectivity between on-premises resources, edge devices, and Azure services. Proper network configuration ensures reliable communication, security, and scalability for your IoT Operations and Kubernetes clusters. There are several networking options you can use. |
19 | 19 |
|
20 | | -> [!IMPORTANT] |
21 | | -> The network environments outlined in Layered Network Management documentation are examples for testing the Layered Network Management. It's not a recommendation of how you build your network and cluster topology for productional usage. |
22 | | -> |
23 | | -> Although network isolation is a security topic, the Layered Network Management service isn't designed for increasing the security of your solution. It's designed for maintaining the security level of your original design as much as possible while enabling the connection to Azure Arc. |
| 20 | +## Arc gateway |
| 21 | + |
| 22 | +The Azure Arc gateway acts as a network proxy, allowing you to onboard and manage servers that do not have direct internet access. By routing traffic through the gateway, you can simplify firewall rules and reduce the need for complex network changes. This is especially useful for securely connecting isolated or segmented environments to Azure Arc. |
24 | 23 |
|
25 | | -Layered Network Management (preview) provides several benefits including: |
| 24 | +For more information about the Azure Arc gateway, see [simplify network configuration requirements with Azure Arc gateway (preview)](/azure/azure-arc/servers/arc-gateway). |
26 | 25 |
|
27 | | -* Kubernetes-based configuration and compatibility with IP and NIC mapping for crossing levels |
28 | | -* Ability to connect devices in isolated networks at scale to [Azure Arc](/azure/azure-arc/) for application lifecycle management and configuration of previously isolated resources remotely from a single Azure control plane |
29 | | -* Security and governance across network levels for devices and services with URL allowlists and connection auditing for deterministic network configurations |
30 | | -* Kubernetes observability tooling for previously isolated devices and applications across levels |
31 | | -* Default compatibility with all Azure IoT Operations service connections |
| 26 | +## Connected clusters |
32 | 27 |
|
33 | | -:::image type="content" source="./media/concept-layered-network/layered-network-management-overview.png" alt-text="Diagram of Layered Network Management." lightbox="./media/concept-layered-network/layered-network-management-overview.png"::: |
| 28 | +The Azure Arc gateway for connected Kubernetes clusters enables you to register and manage clusters behind firewalls or in private networks. It reduces the need for outbound connectivity from each cluster, centralizing network egress through the gateway. This approach streamlines onboarding and ongoing management of clusters in secure or restricted environments. |
34 | 29 |
|
35 | | -## Isolated network environment for deploying Layered Network Management (preview) |
| 30 | +For more information about connected clusters, see [simplify network configuration requirements with Azure Arc gateway (preview)](/azure/azure-arc/servers/arc-gateway). |
36 | 31 |
|
37 | | -There are several ways to configure Layered Network Management (preview) to bridge the connection between clusters in the isolated network and services on Azure. The following lists example network environments and cluster scenarios for Layered Network Management. |
| 32 | +## Explicit proxy usage |
38 | 33 |
|
39 | | -- **A simplified virtual machine and network** - This scenario uses an [Azure AKS](/azure/aks/) cluster and an Azure Linux VM. You need an Azure subscription the following resources: |
40 | | - - An [AKS cluster](/azure/aks/concepts-clusters-workloads) for layer 4 and 5. |
41 | | - - An [Azure Linux VM](/azure/virtual-machines/) for layer 3. |
42 | | -- **A simplified physically isolated network** - Requires at least two physical devices (IoT/PC/server) and a wireless access point. This setup simulates a simple two-layer network (level 3 and level 4). Level 3 is the isolated cluster and is the target for deploying the Azure IoT Operations. |
43 | | - - The wireless access point is used for setting up a local network and **doesn't** provide internet access. |
44 | | - - Level 4 cluster - A single node cluster hosted on a dual NIC physical machine, connects to internet and the local network. Layered Network Management should be deployed to this cluster. |
45 | | - - Level 3 cluster - Another single node cluster hosted on a physical machine. This device cluster only connects to the local network. |
46 | | - - Custom DNS - A DNS server setup in the local network or CoreDNS configuration on the level 3 cluster. It provides custom domain name resolution and points the network request to the IP of level 4 cluster. |
47 | | -- **ISA-95 network** - You should try deploying Layered Network Management to an ISA-95 network or a preproduction environment. |
| 34 | +Azure Firewall Explicit Proxy allows you to direct Azure Arc traffic through a managed firewall, providing enhanced security and monitoring. This is useful for organizations that require all outbound traffic to be inspected or logged, and helps meet compliance requirements by controlling and auditing network flows to Azure. |
48 | 35 |
|
49 | | -## Key features |
| 36 | +For more information about Azure Firewall Explicit Proxy, see [access Azure services over Azure Firewall Explicit Proxy (Public Preview)](/azure/azure-arc/azure-firewall-explicit-proxy). |
50 | 37 |
|
51 | | -Layered Network Management supports the Azure IoT Operations components in an isolated network environment. The following table summarizes supported features and integration: |
| 38 | +## Networking sample |
52 | 39 |
|
53 | | -| Layered Network Management features | Status | |
54 | | -|------------------------------------------------------------------------------------------|:---:| |
55 | | -|Forward TLS traffic|Public preview| |
56 | | -|Traffic Auditing - Basic: Source/destination IP addresses and header values|Public preview| |
57 | | -|Allowlist management through [Kubernetes Custom Resource](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/)|Public preview| |
58 | | -|Installation: Integrated install experience of Layered Network Management and other Azure IoT Operations components|Public preview| |
59 | | -|Reverse Proxy for OSI Layer 4 (TCP)|Public preview| |
60 | | -|Support East-West traffic forwarding for Azure IoT Operations components - manual setup |Public Preview| |
61 | | -|Installation: Layered Network Management deployed as an Arc extension|Public Preview| |
| 40 | +In industries like manufacturing, you often see segmented networking architectures that create layers. These layers minimize or block lower-level segments from connecting to the internet (for example, [Purdue Network Architecture](https://en.wikipedia.org/wiki/Purdue_Enterprise_Reference_Architecture)). This article shows one way to work with these networks by using open, industry-recognized software. |
62 | 41 |
|
63 | | -## Next steps |
| 42 | +A networking guidance sample is available in the [Azure IoT Operations samples repository](https://github.com/Azure-Samples/explore-iot-operations/tree/patricka-layered-network/samples/layered-networking). The sample demonstrates how to use Azure IoT Operations networking to manage devices in segmented networks, such as those found in manufacturing environments. It provides a practical implementation of the layered network architecture, allowing you to connect and manage devices securely. The sample includes: |
64 | 43 |
|
65 | | -- Learn [How does Azure IoT Operations work in layered network?](concept-iot-operations-in-layered-network.md) |
66 | | -- [Set up Layered Network Management in a simplified virtual machine and network environment](howto-deploy-aks-layered-network.md) to try an example with Azure virtual resources. It's the quickest way to see how Layered Network Management works without having to set up physical machines and Purdue Network. |
| 44 | +- Kubernetes-based configuration and compatibility with networking primitives |
| 45 | +- Connecting devices in isolated networks at scale to [Azure Arc](/azure/azure-arc/) for application lifecycle management and configuration of previously isolated resources remotely from a single Azure control plane |
| 46 | +- Security and governance across network levels for devices and services with URL and IP allow lists and connection auditing |
| 47 | +- Compatibility with all Azure IoT Operations services connection |
| 48 | +- Bifurcation capabilities for targeted endpoints |
| 49 | + |
| 50 | +> [!IMPORTANT] |
| 51 | +> Azure IoT Layered Network Management (preview) will be retired. Use the [networking sample](https://github.com/Azure-Samples/explore-iot-operations/tree/patricka-layered-network/samples/layered-networking) instead to implement layered network management in Azure IoT Operations. |
0 commit comments