Skip to content

Commit 1093482

Browse files
asudbringasudbring
committed
added cli commands
1 parent dd76bc6 commit 1093482

File tree

1 file changed

+248
-3
lines changed

1 file changed

+248
-3
lines changed

‎articles/virtual-network/tutorial-filter-network-traffic.md

Lines changed: 248 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,12 @@ If you choose to install and use PowerShell locally, this article requires the A
5252

5353
- An Azure account with an active subscription. You can [create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
5454

55+
[!INCLUDE [quickstarts-free-trial-note](~/reusable-content/ce-skilling/azure/includes/quickstarts-free-trial-note.md)]
56+
57+
[!INCLUDE [azure-cli-prepare-your-environment-no-header.md](~/reusable-content/azure-cli/azure-cli-prepare-your-environment-no-header.md)]
58+
59+
- This article requires version 2.0.28 or later of the Azure CLI. If using Azure Cloud Shell, the latest version is already installed.
60+
5561
---
5662

5763
### [Portal](#tab/portal)
@@ -99,6 +105,34 @@ $virtualNetwork | Set-AzVirtualNetwork
99105

100106
### [CLI](#tab/cli)
101107

108+
First create a resource group for all the resources created in this article with [az group create](/cli/azure/group). The following example creates a resource group in the *westus2* location:
109+
110+
```azurecli-interactive
111+
az group create \
112+
--name test-rg \
113+
--location westus2
114+
```
115+
116+
Create a virtual network with [az network vnet create](/cli/azure/network/vnet). The following example creates a virtual named *vnet-1*:
117+
118+
```azurecli-interactive
119+
az network vnet create \
120+
--name vnet-1 \
121+
--resource-group test-rg \
122+
--address-prefixes 10.0.0.0/16
123+
```
124+
125+
Add a subnet to a virtual network with [az network vnet subnet create](/cli/azure/network/vnet/subnet). The following example adds a subnet named *subnet-1* to the virtual network and associates the *nsg-1* network security group to it:
126+
127+
```azurecli-interactive
128+
az network vnet subnet create \
129+
--vnet-name vnet-1 \
130+
--resource-group test-rg \
131+
--name subnet-1 \
132+
--address-prefix 10.0.0.0/24 \
133+
--network-security-group nsg-1
134+
```
135+
102136
---
103137

104138
## Create application security groups
@@ -163,6 +197,20 @@ $mgmtAsg = New-AzApplicationSecurityGroup @mgmt
163197

164198
### [CLI](#tab/cli)
165199

200+
Create an application security group with [az network asg create](/cli/azure/network/asg). An application security group enables you to group servers with similar port filtering requirements. The following example creates two application security groups.
201+
202+
```azurecli-interactive
203+
az network asg create \
204+
--resource-group test-rg \
205+
--name asg-web-servers \
206+
--location westus2
207+
208+
az network asg create \
209+
--resource-group test-rg \
210+
--name asg-mgmt-servers \
211+
--location westus2
212+
```
213+
166214
---
167215

168216
## Create a network security group
@@ -208,6 +256,15 @@ $nsg = New-AzNetworkSecurityGroup @nsgParams
208256

209257
### [CLI](#tab/cli)
210258

259+
Create a network security group with [az network nsg create](/cli/azure/network/nsg). The following example creates a network security group named *nsg-1*:
260+
261+
```azurecli-interactive
262+
# Create a network security group
263+
az network nsg create \
264+
--resource-group test-rg \
265+
--name nsg-1
266+
```
267+
211268
---
212269

213270
## Associate network security group to subnet
@@ -253,6 +310,15 @@ $vnet | Set-AzVirtualNetwork
253310

254311
### [CLI](#tab/cli)
255312

313+
Use [az network vnet subnet update](/cli/azure/network/vnet/subnet) to associate the network security group with the subnet. The following example associates the *nsg-1* network security group with the *subnet-1* subnet:
314+
315+
```azurecli-interactive
316+
az network vnet subnet update \
317+
--resource-group test-rg \
318+
--vnet-name vnet-1 \
319+
--name subnet-1 \
320+
--network-security-group nsg-1
321+
```
256322
---
257323

258324
## Create security rules
@@ -295,6 +361,13 @@ $vnet | Set-AzVirtualNetwork
295361

296362
1. Select **Add**.
297363

364+
> [!CAUTION]
365+
> In this article, RDP (port 3389) is exposed to the internet for the VM that is assigned to the **asg-mgmt** application security group.
366+
>
367+
> For production environments, instead of exposing port 3389 to the internet, it's recommended that you connect to Azure resources that you want to manage using a VPN, private network connection, or Azure Bastion.
368+
>
369+
> For more information on Azure Bastion, see [What is Azure Bastion?](../bastion/bastion-overview.md).
370+
298371
### [PowerShell](#tab/powershell)
299372

300373
Create a security rule with [New-AzNetworkSecurityRuleConfig](/powershell/module/az.network/new-aznetworksecurityruleconfig). The following example creates a rule that allows traffic inbound from the internet to the _asg-web_ application security group over ports 80 and 443:
@@ -357,17 +430,59 @@ $nsg.SecurityRules += $mgmtRule
357430
Set-AzNetworkSecurityGroup -NetworkSecurityGroup $nsg
358431
```
359432

433+
> [!CAUTION]
434+
> In this article, RDP (port 3389) is exposed to the internet for the VM that is assigned to the **asg-mgmt** application security group.
435+
>
436+
> For production environments, instead of exposing port 3389 to the internet, it's recommended that you connect to Azure resources that you want to manage using a VPN, private network connection, or Azure Bastion.
437+
>
438+
> For more information on Azure Bastion, see [What is Azure Bastion?](../bastion/bastion-overview.md).
439+
360440
### [CLI](#tab/cli)
361441

362-
---
442+
Create a security rule with [az network nsg rule create](/cli/azure/network/nsg/rule). The following example creates a rule that allows traffic inbound from the internet to the *asg-web-servers* application security group over ports 80 and 443:
443+
444+
```azurecli-interactive
445+
az network nsg rule create \
446+
--resource-group test-rg \
447+
--nsg-name nsg-1 \
448+
--name Allow-Web-All \
449+
--access Allow \
450+
--protocol Tcp \
451+
--direction Inbound \
452+
--priority 100 \
453+
--source-address-prefix Internet \
454+
--source-port-range "*" \
455+
--destination-asgs "asg-web-servers" \
456+
--destination-port-range 80 443
457+
```
458+
459+
The following example creates a rule that allows traffic inbound from the Internet to the *asg-mgmt-servers* application security group over port 22:
460+
461+
```azurecli-interactive
462+
az network nsg rule create \
463+
--resource-group test-rg \
464+
--nsg-name nsg-1 \
465+
--name Allow-SSH-All \
466+
--access Allow \
467+
--protocol Tcp \
468+
--direction Inbound \
469+
--priority 110 \
470+
--source-address-prefix Internet \
471+
--source-port-range "*" \
472+
--destination-asgs "asg-mgmt-servers" \
473+
--destination-port-range 22
474+
```
363475

364476
> [!CAUTION]
365-
> In this article, RDP (port 3389) is exposed to the internet for the VM that is assigned to the **asg-mgmt** application security group.
477+
> In this article, SSJ (port 22) is exposed to the internet for the VM that is assigned to the **asg-mgmt** application security group.
366478
>
367-
> For production environments, instead of exposing port 3389 to the internet, it's recommended that you connect to Azure resources that you want to manage using a VPN, private network connection, or Azure Bastion.
479+
> For production environments, instead of exposing port 22 to the internet, it's recommended that you connect to Azure resources that you want to manage using a VPN, private network connection, or Azure Bastion.
368480
>
369481
> For more information on Azure Bastion, see [What is Azure Bastion?](../bastion/bastion-overview.md).
370482
483+
484+
---
485+
371486
## Create virtual machines
372487

373488
Create two virtual machines (VMs) in the virtual network.
@@ -550,6 +665,57 @@ The virtual machine takes a few minutes to create. Don't continue with the next
550665

551666
### [CLI](#tab/cli)
552667

668+
Create two VMs in the virtual network so you can validate traffic filtering in a later step.
669+
670+
Create a VM with [az vm create](/cli/azure/vm). The following example creates a VM that serves as a web server. The `--asgs asg-web-servers` option causes Azure to make the network interface it creates for the VM a member of the *asg-web-servers* application security group. The `--nsg ""` option is specified to prevent Azure from creating a default network security group for the network interface Azure creates when it creates the VM. The command prompts you to create a password for the VM. SSH keys aren't used in this example to facilitate the later steps in this article. In a production environment, use SSH keys for security.
671+
672+
```azurecli-interactive
673+
az vm create \
674+
--resource-group test-rg \
675+
--name vm-web \
676+
--image Ubuntu2204 \
677+
--vnet-name vnet-1 \
678+
--subnet subnet-1 \
679+
--nsg "" \
680+
--admin-username azureuser \
681+
--authentication-type password \
682+
--assign-identity
683+
```
684+
685+
The VM takes a few minutes to create. After the VM is created, output similar to the following example is returned:
686+
687+
```output
688+
{
689+
"fqdns": "",
690+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.Compute/virtualMachines/vm-web",
691+
"location": "westus2",
692+
"macAddress": "00-0D-3A-23-9A-49",
693+
"powerState": "VM running",
694+
"privateIpAddress": "10.0.0.4",
695+
"publicIpAddress": "203.0.113.24",
696+
"resourceGroup": "test-rg"
697+
}
698+
```
699+
700+
Create a VM with [az vm create](/cli/azure/vm). The following example creates a VM that serves as a management server. The `--asgs asg-mgmt-servers` option causes Azure to make the network interface it creates for the VM a member of the *asg-mgmt-servers* application security group.
701+
702+
The following example creates a VM and adds a user account. The `--generate-ssh-keys` parameter causes the CLI to look for an available ssh key in `~/.ssh`. If one is found, that key is used. If not, one is generated and stored in `~/.ssh`. Finally, we deploy the latest `Ubuntu 22.04` image.
703+
704+
```azurecli-interactive
705+
az vm create \
706+
--resource-group test-rg \
707+
--name vm-mgmt \
708+
--image Ubuntu2204 \
709+
--vnet-name vnet-1 \
710+
--subnet subnet-1 \
711+
--nsg "" \
712+
--admin-username azureuser \
713+
--generate-ssh-keys \
714+
--assign-identity
715+
```
716+
717+
The VM takes a few minutes to create. Don't continue with the next step until Azure finishes creating the VM.
718+
553719
---
554720

555721
## Associate network interfaces to an ASG
@@ -620,6 +786,32 @@ Set-AzNetworkInterface @params3
620786

621787
### [CLI](#tab/cli)
622788

789+
Use [az network nic update](/cli/azure/network/nic) to associate the network interface with the application security group. The following example associates the *asg-web-servers* application security group with the *vm-web-nic* network interface:
790+
791+
```azurecli-interactive
792+
# Retrieve the network interface name associated with the virtual machine
793+
nic_name=$(az vm show --resource-group test-rg --name vm-web --query 'networkProfile.networkInterfaces[0].id' -o tsv | xargs basename)
794+
795+
# Associate the application security group with the network interface
796+
az network nic update \
797+
--resource-group test-rg \
798+
--name $nic_name \
799+
--application-security-groups asg-web-servers
800+
```
801+
802+
Repeat the command to associate the *asg-mgmt-servers* application security group with the *vm-mgmt-nic* network interface.
803+
804+
```azurecli-interactive
805+
# Retrieve the network interface name associated with the virtual machine
806+
nic_name=$(az vm show --resource-group test-rg --name vm-mgmt --query 'networkProfile.networkInterfaces[0].id' -o tsv | xargs basename)
807+
808+
# Associate the application security group with the network interface
809+
az network nic update \
810+
--resource-group test-rg \
811+
--name $nic_name \
812+
--application-security-groups asg-mgmt-servers
813+
```
814+
623815
---
624816

625817
## Test traffic filters
@@ -730,6 +922,50 @@ To confirm that you can access the _vm-web_ web server from outside of Azure, op
730922

731923
### [CLI](#tab/cli)
732924

925+
Using an SSH client of your choice, connect to the VMs created previously. For example, the following command can be used from a command line interface such as [Windows Subsystem for Linux](/windows/wsl/install) to create an SSH session with the *vm-mgmt* VM. In the previous steps, we enabled Microsoft Entra ID sign-in for the VMs. You can sign-in to the virtual machines using your Microsoft Entra ID credentials or you can use the SSH key that you used to create the VMs. In the following example, we use the SSH key to sign in to management VM and then sign in to the web VM from the management VM with a password.
926+
927+
For more information about how to SSH to a Linux VM and sign in with Microsoft Entra ID, see [Sign in to a Linux virtual machine in Azure by using Microsoft Entra ID and OpenSSH](/entra/identity/devices/howto-vm-sign-in-azure-ad-linux).
928+
929+
### Store IP address of VM in order to SSH
930+
931+
Run the following command to store the IP address of the VM as an environment variable:
932+
933+
```bash
934+
export IP_ADDRESS=$(az vm show --show-details --resource-group test-rg --name vm-mgmt --query publicIps --output tsv)
935+
```
936+
937+
```bash
938+
ssh -o StrictHostKeyChecking=no azureuser@$IP_ADDRESS
939+
```
940+
941+
The connection succeeds because the network interface attached to the *vm-mgmt* VM is in the *asg-mgmt-servers* application security group, which allows port 22 inbound from the Internet.
942+
943+
Use the following command to SSH to the *vm-web* VM from the *vm-mgmt* VM:
944+
945+
```bash
946+
ssh -o StrictHostKeyChecking=no azureuser@vm-web
947+
```
948+
949+
The connection succeeds because a default security rule within each network security group allows traffic over all ports between all IP addresses within a virtual network. You can't SSH to the *vm-web* VM from the Internet because the security rule for the *asg-web-servers* doesn't allow port 22 inbound from the Internet.
950+
951+
Use the following commands to install the nginx web server on the *vm-web* VM:
952+
953+
```bash
954+
# Update package source
955+
sudo apt-get -y update
956+
957+
# Install NGINX
958+
sudo apt-get -y install nginx
959+
```
960+
961+
The *vm-web* VM is allowed outbound to the Internet to retrieve nginx because a default security rule allows all outbound traffic to the Internet. Exit the *vm-web* SSH session, which leaves you at the `username@vm-mgmt:~$` prompt of the *vm-mgmt* VM. To retrieve the nginx welcome screen from the *vm-web* VM, enter the following command:
962+
963+
```bash
964+
curl vm-web
965+
```
966+
967+
Sign out of the *vm-mgmt* VM. To confirm that you can access the *vm-web* web server from outside of Azure, enter `curl <publicIpAddress>` from your own computer. The connection succeeds because the *asg-web-servers* application security group, which the network interface attached to the *vm-web* VM is in, allows port 80 inbound from the Internet.
968+
733969
---
734970

735971
### [Portal](#tab/portal)
@@ -750,6 +986,15 @@ Remove-AzResourceGroup @params
750986

751987
### [CLI](#tab/cli)
752988

989+
When no longer needed, use [az group delete](/cli/azure/group) to remove the resource group and all of the resources it contains.
990+
991+
```azurecli-interactive
992+
az group delete \
993+
--name test-rg \
994+
--yes \
995+
--no-wait
996+
```
997+
753998
---
754999

7551000
## Next steps

0 commit comments

Comments
 (0)