Skip to content

Commit 143db66

Browse files
Merge pull request #105929 from msmbaldwin/ade-firewall
Added firewall article
2 parents ea04491 + 877c52f commit 143db66

File tree

5 files changed

+54
-226
lines changed

5 files changed

+54
-226
lines changed

articles/virtual-machines/linux/disk-encryption-faq.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ You can't apply Azure Disk Encryption on your custom Linux image. Only the galle
9595

9696
## Can I apply updates to a Linux Red Hat VM that uses the yum update?
9797

98-
Yes, you can perform a yum update on a Red Hat Linux VM. For more information, see [Linux package management behind a firewall](disk-encryption-troubleshooting.md#linux-package-management-behind-a-firewall).
98+
Yes, you can perform a yum update on a Red Hat Linux VM. For more information, see [Azure Disk Encryption on an isolated network](disk-encryption-isolated-network.md).
9999

100100
## What is the recommended Azure disk encryption workflow for Linux?
101101

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
---
2+
title: Azure Disk Encryption on an isolated network
3+
description: This article provides troubleshooting tips for Microsoft Azure Disk Encryption for Linux VMs.
4+
author: msmbaldwin
5+
ms.service: security
6+
ms.topic: article
7+
ms.author: mbaldwin
8+
ms.date: 02/27/2020
9+
10+
ms.custom: seodec18
11+
12+
---
13+
# Azure Disk Encryption on an isolated network
14+
15+
When connectivity is restricted by a firewall, proxy requirement, or network security group (NSG) settings, the ability of the extension to perform needed tasks might be disrupted. This disruption can result in status messages such as "Extension status not available on the VM."
16+
17+
## Package management
18+
19+
Azure Disk Encryption depends on a number of components, which are typically installed as part of ADE enablement if not already present. When behind a firewall or otherwise isolated from the Internet, these packages must be pre-installed or available locally.
20+
21+
Here are the packages necessary for each distribution. For a full list of supported distros and volume types, see [supported VMs and operating systems](disk-encryption-overview.md#supported-vms-and-operating-systems).
22+
23+
- **Ubuntu 14.04, 16.04, 18.04**: lsscsi, psmisc, at, cryptsetup-bin, python-parted, python-six, procps
24+
- **CentOS 7.2 - 7.7**: lsscsi, psmisc, lvm2, uuid, at, patch, cryptsetup, cryptsetup-reencrypt, pyparted, procps-ng, util-linux
25+
- **CentOS 6.8**: lsscsi, psmisc, lvm2, uuid, at, cryptsetup-reencrypt, pyparted, python-six
26+
- **RedHat 7.2 - 7.7**: lsscsi, psmisc, lvm2, uuid, at, patch, cryptsetup, cryptsetup-reencrypt, procps-ng, util-linux
27+
- **RedHat 6.8**: lsscsi, psmisc, lvm2, uuid, at, patch, cryptsetup-reencrypt
28+
- **openSUSE 42.3, SLES 12-SP4, 12-SP3**: lsscsi, cryptsetup
29+
30+
On Red Hat, when a proxy is required, you must make sure that the subscription-manager and yum are set up properly. For more information, see [How to troubleshoot subscription-manager and yum problems](https://access.redhat.com/solutions/189533).
31+
32+
When packages are installed manually, they must also be manually upgraded as new versions are released.
33+
34+
## Network security groups
35+
Any network security group settings that are applied must still allow the endpoint to meet the documented network configuration prerequisites for disk encryption. See [Azure Disk Encryption: Networking requirements](disk-encryption-overview.md#networking-requirements)
36+
37+
## Azure Disk Encryption with Azure AD (previous version)
38+
39+
If using [Azure Disk Encryption with Azure AD (previous version)](disk-encryption-overview-aad.md), the [Azure Active Directory Library](../../active-directory/azuread-dev/active-directory-authentication-libraries.md) will need to be installed manually for all distros (in addition to the packages appropriate for the distro, as [listed above](#package-management)).
40+
41+
When encryption is being enabled with [Azure AD credentials](disk-encryption-linux-aad.md), the target VM must allow connectivity to both Azure Active Directory endpoints and Key Vault endpoints. Current Azure Active Directory authentication endpoints are maintained in sections 56 and 59 of the [Office 365 URLs and IP address ranges](https://docs.microsoft.com/office365/enterprise/urls-and-ip-address-ranges) documentation. Key Vault instructions are provided in the documentation on how to [Access Azure Key Vault behind a firewall](../../key-vault/key-vault-access-behind-firewall.md).
42+
43+
### Azure Instance Metadata Service
44+
45+
The virtual machine must be able to access the [Azure Instance Metadata service](instance-metadata-service.md) endpoint, which uses a well-known non-routable IP address (`169.254.169.254`) that can be accessed only from within the VM. Proxy configurations that alter local HTTP traffic to this address (for example, adding an X-Forwarded-For header) are not supported.
46+
47+
## Next steps
48+
49+
- See more steps for [Azure disk encryption troubleshooting](disk-encryption-troubleshooting.md)
50+
- [Azure data encryption at rest](../../security/fundamentals/encryption-atrest.md)

articles/virtual-machines/linux/disk-encryption-troubleshooting.md

Lines changed: 1 addition & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -92,21 +92,7 @@ Before the next attempt, reevaluate the characteristics of the VM and make sure
9292

9393
## Troubleshooting Azure Disk Encryption behind a firewall
9494

95-
When connectivity is restricted by a firewall, proxy requirement, or network security group (NSG) settings, the ability of the extension to perform needed tasks might be disrupted. This disruption can result in status messages such as "Extension status not available on the VM." In expected scenarios, the encryption fails to finish. The sections that follow have some common firewall problems that you might investigate.
96-
97-
### Network security groups
98-
Any network security group settings that are applied must still allow the endpoint to meet the documented network configuration [prerequisites](disk-encryption-overview.md#networking-requirements) for disk encryption.
99-
100-
### Azure Key Vault behind a firewall
101-
102-
When encryption is being enabled with [Azure AD credentials](disk-encryption-linux-aad.md#), the target VM must allow connectivity to both Azure Active Directory endpoints and Key Vault endpoints. Current Azure Active Directory authentication endpoints are maintained in sections 56 and 59 of the [Office 365 URLs and IP address ranges](https://docs.microsoft.com/office365/enterprise/urls-and-ip-address-ranges) documentation. Key Vault instructions are provided in the documentation on how to [Access Azure Key Vault behind a firewall](../../key-vault/key-vault-access-behind-firewall.md).
103-
104-
### Azure Instance Metadata Service
105-
The VM must be able to access the [Azure Instance Metadata service](../windows/instance-metadata-service.md) endpoint which uses a well-known non-routable IP address (`169.254.169.254`) that can be accessed only from within the VM. Proxy configurations that alter local HTTP traffic to this address (for example, adding an X-Forwarded-For header) are not supported.
106-
107-
### Linux package management behind a firewall
108-
109-
At runtime, Azure Disk Encryption for Linux relies on the target distribution’s package management system to install needed prerequisite components before enabling encryption. If the firewall settings prevent the VM from being able to download and install these components, then subsequent failures are expected. The steps to configure this package management system can vary by distribution. On Red Hat, when a proxy is required, you must make sure that the subscription-manager and yum are set up properly. For more information, see [How to troubleshoot subscription-manager and yum problems](https://access.redhat.com/solutions/189533).
95+
See [Disk Encryption on an isolated network](disk-encryption-isolated-network.md)
11096

11197
## Troubleshooting encryption status
11298

articles/virtual-machines/linux/instance-metadata-service.md

Lines changed: 0 additions & 210 deletions
Original file line numberDiff line numberDiff line change
@@ -312,139 +312,6 @@ curl -H Metadata:true "http://169.254.169.254/metadata/instance?api-version=2019
312312
}
313313
```
314314

315-
#### Retrieving metadata in Windows Virtual Machine
316-
317-
**Request**
318-
319-
Instance metadata can be retrieved in Windows via the PowerShell utility `curl`:
320-
321-
```bash
322-
curl -H @{'Metadata'='true'} http://169.254.169.254/metadata/instance?api-version=2019-06-01 | select -ExpandProperty Content
323-
```
324-
325-
Or through the `Invoke-RestMethod` cmdlet:
326-
327-
```powershell
328-
329-
Invoke-RestMethod -Headers @{"Metadata"="true"} -URI http://169.254.169.254/metadata/instance?api-version=2019-06-01 -Method get
330-
```
331-
332-
**Response**
333-
334-
> [!NOTE]
335-
> The response is a JSON string. The following example response is pretty-printed for readability.
336-
337-
```json
338-
{
339-
"compute": {
340-
"azEnvironment": "AzurePublicCloud",
341-
"customData": "",
342-
"location": "centralus",
343-
"name": "negasonic",
344-
"offer": "lampstack",
345-
"osType": "Linux",
346-
"placementGroupId": "",
347-
"plan": {
348-
"name": "5-6",
349-
"product": "lampstack",
350-
"publisher": "bitnami"
351-
},
352-
"platformFaultDomain": "0",
353-
"platformUpdateDomain": "0",
354-
"provider": "Microsoft.Compute",
355-
"publicKeys": [],
356-
"publisher": "bitnami",
357-
"resourceGroupName": "myrg",
358-
"resourceId": "/subscriptions/xxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx/resourceGroups/myrg/providers/Microsoft.Compute/virtualMachines/negasonic",
359-
"sku": "5-6",
360-
"storageProfile": {
361-
"dataDisks": [
362-
{
363-
"caching": "None",
364-
"createOption": "Empty",
365-
"diskSizeGB": "1024",
366-
"image": {
367-
"uri": ""
368-
},
369-
"lun": "0",
370-
"managedDisk": {
371-
"id": "/subscriptions/xxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx/resourceGroups/macikgo-test-may-23/providers/Microsoft.Compute/disks/exampledatadiskname",
372-
"storageAccountType": "Standard_LRS"
373-
},
374-
"name": "exampledatadiskname",
375-
"vhd": {
376-
"uri": ""
377-
},
378-
"writeAcceleratorEnabled": "false"
379-
}
380-
],
381-
"imageReference": {
382-
"id": "",
383-
"offer": "UbuntuServer",
384-
"publisher": "Canonical",
385-
"sku": "16.04.0-LTS",
386-
"version": "latest"
387-
},
388-
"osDisk": {
389-
"caching": "ReadWrite",
390-
"createOption": "FromImage",
391-
"diskSizeGB": "30",
392-
"diffDiskSettings": {
393-
"option": "Local"
394-
},
395-
"encryptionSettings": {
396-
"enabled": "false"
397-
},
398-
"image": {
399-
"uri": ""
400-
},
401-
"managedDisk": {
402-
"id": "/subscriptions/xxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx/resourceGroups/macikgo-test-may-23/providers/Microsoft.Compute/disks/exampleosdiskname",
403-
"storageAccountType": "Standard_LRS"
404-
},
405-
"name": "exampleosdiskname",
406-
"osType": "Linux",
407-
"vhd": {
408-
"uri": ""
409-
},
410-
"writeAcceleratorEnabled": "false"
411-
}
412-
},
413-
"subscriptionId": "xxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx",
414-
"tags": "Department:IT;Environment:Test;Role:WebRole",
415-
"version": "7.1.1902271506",
416-
"vmId": "13f56399-bd52-4150-9748-7190aae1ff21",
417-
"vmScaleSetName": "",
418-
"vmSize": "Standard_A1_v2",
419-
"zone": "1"
420-
},
421-
"network": {
422-
"interface": [
423-
{
424-
"ipv4": {
425-
"ipAddress": [
426-
{
427-
"privateIpAddress": "10.0.1.4",
428-
"publicIpAddress": "X.X.X.X"
429-
}
430-
],
431-
"subnet": [
432-
{
433-
"address": "10.0.1.0",
434-
"prefix": "24"
435-
}
436-
]
437-
},
438-
"ipv6": {
439-
"ipAddress": []
440-
},
441-
"macAddress": "002248020E1E"
442-
}
443-
]
444-
}
445-
}
446-
```
447-
448315
## Metadata APIs
449316

450317
The following APIs are available through the metadata endpoint:
@@ -537,38 +404,6 @@ Nonce is an optional 10-digit string. If not provided, IMDS returns the current
537404

538405
The signature blob is a [pkcs7](https://aka.ms/pkcs7) signed version of document. It contains the certificate used for signing along with the VM details like vmId, sku, nonce, subscriptionId, timeStamp for creation and expiry of the document and the plan information about the image. The plan information is only populated for Azure Market place images. The certificate can be extracted from the response and used to validate that the response is valid and is coming from Azure.
539406

540-
#### Retrieving attested metadata in Windows Virtual Machine
541-
542-
**Request**
543-
544-
Instance metadata can be retrieved in Windows via the PowerShell utility `curl`:
545-
546-
```powershell
547-
curl -H @{'Metadata'='true'} "http://169.254.169.254/metadata/attested/document?api-version=2018-10-01&nonce=1234567890" | select -ExpandProperty Content
548-
```
549-
550-
Or through the `Invoke-RestMethod` cmdlet:
551-
552-
```powershell
553-
Invoke-RestMethod -Headers @{"Metadata"="true"} -URI "http://169.254.169.254/metadata/attested/document?api-version=2018-10-01&nonce=1234567890" -Method get
554-
```
555-
556-
Api-version is a mandatory field. Refer to the service availability section for supported API versions.
557-
Nonce is an optional 10-digit string. If not provided, IMDS returns the current UTC timestamp in its place. Due to IMDS's caching mechanism, a previously cached nonce value may be returned.
558-
559-
**Response**
560-
561-
> [!NOTE]
562-
> The response is a JSON string. The following example response is pretty-printed for readability.
563-
564-
```json
565-
{
566-
"encoding":"pkcs7","signature":"MIIEEgYJKoZIhvcNAQcCoIIEAzCCA/8CAQExDzANBgkqhkiG9w0BAQsFADCBugYJKoZIhvcNAQcBoIGsBIGpeyJub25jZSI6IjEyMzQ1NjY3NjYiLCJwbGFuIjp7Im5hbWUiOiIiLCJwcm9kdWN0IjoiIiwicHVibGlzaGVyIjoiIn0sInRpbWVTdGFtcCI6eyJjcmVhdGVkT24iOiIxMS8yMC8xOCAyMjowNzozOSAtMDAwMCIsImV4cGlyZXNPbiI6IjExLzIwLzE4IDIyOjA4OjI0IC0wMDAwIn0sInZtSWQiOiIifaCCAj8wggI7MIIBpKADAgECAhBnxW5Kh8dslEBA0E2mIBJ0MA0GCSqGSIb3DQEBBAUAMCsxKTAnBgNVBAMTIHRlc3RzdWJkb21haW4ubWV0YWRhdGEuYXp1cmUuY29tMB4XDTE4MTEyMDIxNTc1N1oXDTE4MTIyMDIxNTc1NlowKzEpMCcGA1UEAxMgdGVzdHN1YmRvbWFpbi5tZXRhZGF0YS5henVyZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAML/tBo86ENWPzmXZ0kPkX5dY5QZ150mA8lommszE71x2sCLonzv4/UWk4H+jMMWRRwIea2CuQ5RhdWAHvKq6if4okKNt66fxm+YTVz9z0CTfCLmLT+nsdfOAsG1xZppEapC0Cd9vD6NCKyE8aYI1pliaeOnFjG0WvMY04uWz2MdAgMBAAGjYDBeMFwGA1UdAQRVMFOAENnYkHLa04Ut4Mpt7TkJFfyhLTArMSkwJwYDVQQDEyB0ZXN0c3ViZG9tYWluLm1ldGFkYXRhLmF6dXJlLmNvbYIQZ8VuSofHbJRAQNBNpiASdDANBgkqhkiG9w0BAQQFAAOBgQCLSM6aX5Bs1KHCJp4VQtxZPzXF71rVKCocHy3N9PTJQ9Fpnd+bYw2vSpQHg/AiG82WuDFpPReJvr7Pa938mZqW9HUOGjQKK2FYDTg6fXD8pkPdyghlX5boGWAMMrf7bFkup+lsT+n2tRw2wbNknO1tQ0wICtqy2VqzWwLi45RBwTGB6DCB5QIBATA/MCsxKTAnBgNVBAMTIHRlc3RzdWJkb21haW4ubWV0YWRhdGEuYXp1cmUuY29tAhBnxW5Kh8dslEBA0E2mIBJ0MA0GCSqGSIb3DQEBCwUAMA0GCSqGSIb3DQEBAQUABIGAld1BM/yYIqqv8SDE4kjQo3Ul/IKAVR8ETKcve5BAdGSNkTUooUGVniTXeuvDj5NkmazOaKZp9fEtByqqPOyw/nlXaZgOO44HDGiPUJ90xVYmfeK6p9RpJBu6kiKhnnYTelUk5u75phe5ZbMZfBhuPhXmYAdjc7Nmw97nx8NnprQ="
567-
}
568-
```
569-
570-
The signature blob is a [pkcs7](https://aka.ms/pkcs7) signed version of document. It contains the certificate used for signing along with the VM details like vmId, sku, nonce, subscriptionId, timeStamp for creation and expiry of the document and the plan information about the image. The plan information is only populated for Azure Market place images. The certificate can be extracted from the response and used to validate that the response is valid and is coming from Azure.
571-
572407
## Example scenarios for usage
573408

574409
### Tracking VM running on Azure
@@ -862,51 +697,6 @@ openssl verify -verbose -CAfile /etc/ssl/certs/Baltimore_CyberTrust_Root.pem -un
862697

863698
In cases where the intermediate certificate cannot be downloaded due to network constraints during validation, the intermediate certificate can be pinned. However, Azure will roll over the certificates as per standard PKI practice. The pinned certificates would need to be updated when roll over happens. Whenever a change to update the intermediate certificate is planned, the Azure blog will be updated and Azure customers will be notified. The intermediate certificates can be found [here](https://www.microsoft.com/pki/mscorp/cps/default.htm). The intermediate certificates for each of the regions can be different.
864699

865-
### Failover Clustering in Windows Server
866-
867-
For certain scenarios, when querying Instance Metadata Service with Failover Clustering, it is necessary to add a route to the routing table.
868-
869-
1. Open command prompt with administrator privileges.
870-
871-
2. Run the following command and note the address of the Interface for Network Destination (`0.0.0.0`) in the IPv4 Route Table.
872-
873-
```bat
874-
route print
875-
```
876-
877-
> [!NOTE]
878-
> The following example output from a Windows Server VM with Failover Cluster enabled contains only the IPv4 Route Table for simplicity.
879-
880-
```bat
881-
IPv4 Route Table
882-
===========================================================================
883-
Active Routes:
884-
Network Destination Netmask Gateway Interface Metric
885-
0.0.0.0 0.0.0.0 10.0.1.1 10.0.1.10 266
886-
10.0.1.0 255.255.255.192 On-link 10.0.1.10 266
887-
10.0.1.10 255.255.255.255 On-link 10.0.1.10 266
888-
10.0.1.15 255.255.255.255 On-link 10.0.1.10 266
889-
10.0.1.63 255.255.255.255 On-link 10.0.1.10 266
890-
127.0.0.0 255.0.0.0 On-link 127.0.0.1 331
891-
127.0.0.1 255.255.255.255 On-link 127.0.0.1 331
892-
127.255.255.255 255.255.255.255 On-link 127.0.0.1 331
893-
169.254.0.0 255.255.0.0 On-link 169.254.1.156 271
894-
169.254.1.156 255.255.255.255 On-link 169.254.1.156 271
895-
169.254.255.255 255.255.255.255 On-link 169.254.1.156 271
896-
224.0.0.0 240.0.0.0 On-link 127.0.0.1 331
897-
224.0.0.0 240.0.0.0 On-link 169.254.1.156 271
898-
224.0.0.0 240.0.0.0 On-link 10.0.1.10 266
899-
255.255.255.255 255.255.255.255 On-link 127.0.0.1 331
900-
255.255.255.255 255.255.255.255 On-link 169.254.1.156 271
901-
255.255.255.255 255.255.255.255 On-link 10.0.1.10 266
902-
```
903-
904-
1. Run the following command and use the address of the Interface for Network Destination (`0.0.0.0`) which is (`10.0.1.10`) in this example.
905-
906-
```bat
907-
route add 169.254.169.254/32 10.0.1.10 metric 1 -p
908-
```
909-
910700
### Storage profile
911701

912702
Instance Metadata Service can provide details about the storage disks associated with the VM. This data can be found at the instance/compute/storageProfile endpoint.

articles/virtual-machines/linux/toc.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -312,6 +312,8 @@
312312
href: disk-encryption-key-vault.md
313313
- name: Disk encryption sample scripts
314314
href: disk-encryption-sample-scripts.md
315+
- name: Disk encryption on an isolated network
316+
href: disk-encryption-isolated-network.md
315317
- name: Disk encryption troubleshooting
316318
href: disk-encryption-troubleshooting.md
317319
- name: Disk encryption FAQ

0 commit comments

Comments
 (0)