Skip to content

Commit 1779fe5

Browse files
ShawnJacksonShawnJackson
committed
edit pass: howto-configure-acls-for-ssh-management-on-access-vpn
1 parent 27b4502 commit 1779fe5

File tree

1 file changed

+57
-78
lines changed

1 file changed

+57
-78
lines changed

‎articles/operator-nexus/howto-configure-acls-for-ssh-management-on-access-vpn.md

Lines changed: 57 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
2-
title: "Azure Operator Nexus: Configure Network Access Control Lists (ACLs) for SSH Access on Management VPN."
3-
description: Instructions on setting up network access control lists (ACLs) to control SSH access on a management VPN.
2+
title: Create ACLs on an NNI in Azure Operator Nexus
3+
description: Get instructions on setting up network access control lists (ACLs) to control SSH access on a management VPN.
44
ms.service: azure-operator-nexus
55
ms.custom: template-how-to
66
ms.topic: how-to
@@ -9,53 +9,51 @@ author: sushantjrao
99
ms.author: sushrao
1010
---
1111

12-
# Create ACLs on an NNI
12+
# Create ACLs on an NNI in Azure Operator Nexus
1313

14-
In Azure Operator Nexus, access control lists (ACLs) for `Permit` and `Deny` actions at a network-to-network interconnect (NNI) level help protect Secure Shell (SSH) access on the management virtual private netowrk (VPN). At this time, you can apply network ACLs only before you provision the network fabric.
15-
16-
Ingress and egress ACLs are created prior to the creation of NNI resources and are referenced into the NNI payload. When NNI resources are created, they also create referenced ingress and egress ACLs. This activity needs to be performed before provisioning the network fabric.
14+
In Azure Operator Nexus, access control lists (ACLs) for `Permit` and `Deny` actions at a network-to-network interconnect (NNI) level help protect Secure Shell (SSH) access on the management virtual private network (VPN). You create ingress and egress ACLs before the creation of NNI resources and then reference those ACLs in the NNI payload. You need to create referenced ingress and egress ACLs before you provision the network fabric.
1715

1816
These are the high-level steps for creating an ACL on an NNI:
1917

20-
1. Create NNI Ingress and egress ACLs
21-
2. Update Azure Resource Manager resource reference in a management NNI
22-
3. Create an NNI and provision the network fabric
18+
1. Create NNI ingress and egress ACLs.
19+
2. Update the Azure Resource Manager resource reference in a management NNI.
20+
3. Create an NNI and provision the network fabric.
2321

2422
## Parameter usage guidance
2523

26-
| Parameter | Description | Example or Range |
24+
| Parameter | Description | Example or range |
2725
|----------------------|--------------------------------------------------------------|--------------------------------|
28-
| defaultAction | Defines default action to be taken. If not defined, traffic is permitted. | "defaultAction": "Permit" |
29-
| resource-group | Resource group of the network fabric. | nfresourcegroup |
30-
| resource-name | Name of the ACL. | example-ingressACL |
31-
| vlanGroups | List of VLAN groups. | |
32-
| vlans | List of VLANs that need to be matched. | |
33-
| match-configurations | Name of match configuration. | example_acl (spaces and special character "&" aren't supported) |
34-
| matchConditions | Conditions required to be matched. | |
35-
| ttlValues | TTL (Time To Live). | 0-255 |
36-
| dscpMarking | DSCP Markings that need to be matched. | 0-63 |
37-
| portCondition | Port condition that needs to be matched. | |
38-
| portType | Port type that needs to be matched. | Example: SourcePort. Allowed values: DestinationPort, SourcePort |
39-
| protocolTypes | Protocols that need to be matched. | [tcp, udp, range[1-2, 1, 2]] (if protocol number, it should be in the range of 1-255) |
40-
| vlanMatchCondition | VLAN match condition that needs to be matched. | |
41-
| layer4Protocol | Layer 4 Protocol. | Should be either TCP or UDP |
42-
| ipCondition | IP condition that needs to be matched. | |
43-
| actions | Action to be taken based on match condition. | Example: permit |
44-
| configuration-type | Configuration type can be inline or by using a file. However, AON supports only inline today. | Example: inline |
45-
46-
There are some further restrictions that you should be aware of:
47-
48-
- **Inline ports and inline VLANs** are a static way of defining the ports or VLANs using `azcli`.
49-
- **PortGroupNames and VLANGroupNames** are dynamic ways of defining ports and VLANs.
50-
- **Inline ports and the PortGroupNames** together aren't allowed.
51-
- **Inline VLANs and the VLANGroupNames** together aren't allowed.
52-
- **IpGroupNames and IpPrefixValues** together aren't allowed.
53-
- **Egress ACLs** won't support IP options, IP length, fragment, ether-type, DSCP marking, or TTL values.
54-
- **Ingress ACLs** won't support following options: etherType.
26+
| `defaultAction` | Default action to be taken. If it's not defined, traffic is permitted. | `"defaultAction": "Permit"` |
27+
| `resource-group` | Resource group of the network fabric. | `nfresourcegroup` |
28+
| `resource-name` | Name of the ACL. | `example-ingressACL` |
29+
| `vlanGroups` | List of virtual local area network (VLAN) groups. | |
30+
| `vlans` | List of VLANs that need to be matched. | |
31+
| `match-configurations` | Name of the match configuration. | `example_acl`. Spaces and the ampersand character (&) aren't supported. |
32+
| `matchConditions` | Conditions required to be matched. | |
33+
| `ttlValues` | Time to live (TTL). | `0`-`255` |
34+
| `dscpMarking` | Differentiated Services Code Point (DSCP) markings that need to be matched. | `0`-`63` |
35+
| `portCondition` | Port condition that needs to be matched. | |
36+
| `portType` | Port type that needs to be matched. | Example: `SourcePort`. Allowed values: `DestinationPort`, `SourcePort`. |
37+
| `protocolTypes` | Protocols that need to be matched. | `[tcp, udp, range[1-2, 1, 2]]`. If it's a protocol number, it should be in the range of `1`-`255`. |
38+
| `vlanMatchCondition` | VLAN match condition that needs to be matched. | |
39+
| `layer4Protocol` | Layer 4 protocol. | Should be either `TCP` or `UDP`. |
40+
| `ipCondition` | IP condition that needs to be matched. | |
41+
| `actions` | Action to be taken based on a match condition. | Example: `permit`. |
42+
| `configuration-type` | Configuration type, which can be inline or file. At this time, Azure Operator Nexus supports only inline. | Example: `inline`. |
43+
44+
You should also be aware of these restrictions:
45+
46+
- Inline ports and inline VLANs are a static way of defining the ports or VLANs by using `azcli`.
47+
- `portGroupNames` and `vlanGroupNames` are dynamic ways of defining ports and VLANs.
48+
- Inline ports and `portGroupNames` together aren't allowed.
49+
- Inline VLANs and `vlanGroupNames` together aren't allowed.
50+
- `ipGroupNames` and `ipPrefixValues` together aren't allowed.
51+
- Egress ACLs don't support IP options, IP length, fragment, EtherType, DSCP marking, or TTL values.
52+
- Ingress ACLs don't support EtherType options.
5553

5654
## Create an ingress ACL
5755

58-
To create an ingress ACL, you can use the following Azure CLI command:
56+
To create an ingress ACL, you can use the following Azure CLI command. This command creates an ingress ACL with the specified configurations and provides the expected result as output. Adjust the parameters as needed for your use case.
5957

6058
```bash
6159
az networkfabric acl create
@@ -69,7 +67,7 @@ az networkfabric acl create
6967

7068
```
7169

72-
### Expected output
70+
#### Expected output
7371

7472
```json
7573
{
@@ -135,11 +133,9 @@ az networkfabric acl create
135133
}
136134
```
137135

138-
This command creates an ingress ACL with the specified configurations and outputs the expected result. Adjust the parameters as needed for your use case.
139-
140136
## Create an egress ACL
141137

142-
To create an egress ACL, you can use the following Azure CLI command:
138+
To create an egress ACL, you can use the following Azure CLI command. This command creates an egress ACL with the specified configurations and provides the expected result as output. Adjust the parameters as needed for your use case.
143139

144140
```bash
145141
az networkfabric acl create
@@ -153,7 +149,7 @@ az networkfabric acl create
153149

154150
```
155151

156-
### Expected output
152+
#### Expected output
157153

158154
```json
159155
{
@@ -199,16 +195,16 @@ az networkfabric acl create
199195
}
200196
```
201197

202-
This command creates an egress ACL with the specified configurations and outputs the expected result. Adjust the parameters as needed for your use case.
203-
204198
## Update the Resource Manager reference
205199

206-
This step enables the creation of ACLs (ingress and egress if reference is provided) during the creation of the NNI resource. Post creation of NNI and before fabric provisioning, re-put can be done on NNI.
200+
This step enables the creation of ACLs (ingress and egress if a reference is provided) during the creation of the NNI resource. After you create the NNI and before you provision the network fabric, you can perform re-put on the NNI.
207201

208-
- `ingressAclId`: Reference ID for ingress ACL
209-
- `egressAclId`: Reference ID for egress ACL
202+
- `ingressAclId`: Reference ID for the ingress ACL.
203+
- `egressAclId`: Reference ID for the egress ACL.
210204

211-
To get Resource Manager resource ID, navigate to the resource group of the subscription used.
205+
To get the Resource Manager resource ID, go to the resource group of the subscription that you're using.
206+
207+
The following command updates the Resource Manager reference for the NNI resource by associating it with the provided ingress and egress ACLs. Adjust the parameters as needed for your use case.
212208

213209
```bash
214210
az networkfabric nni create
@@ -224,38 +220,29 @@ az networkfabric nni create
224220
--egress-acl-id "/subscriptions/xxxxx-xxxx-xxxx-xxxx-xxxxx/resourceGroups/example-rg/providers/Microsoft.ManagedNetworkFabric/accesscontrollists/example-Ipv4egressACL"
225221
```
226222

227-
This command updates the Resource Manager reference for the NNI resource, associating it with the provided ingress and egress ACLs. Adjust the parameters as needed for your use case.
228-
229223
## Show ACL details
230224

231-
To display the details of an ACL, use the following command:
225+
To display the details of a specified ACL, use the following command:
232226

233227
```bash
234228
az networkfabric acl show --resource-group "example-rg" --resource-name "example-acl"
235229
```
236230

237-
This command will retrieve and display information about the specified ACL.
238-
239231
## List ACLs
240232

241-
To list all ACLs within a resource group, use the following command:
233+
To list all ACLs within a specified resource group, use the following command:
242234

243235
```bash
244236
az networkfabric acl list --resource-group "ResourceGroupName"
245237
```
246238

247-
This command will list all ACLs present in the specified resource group.
239+
## Create ACLs on the ISD external network
248240

249-
## Create an ACL on isolation domain external network
241+
Use the following information to create ingress and egress ACLs for the isolation domain (ISD) external network. Then, update the Resource Manager resource reference for the external network.
250242

251-
Steps to be performed to create an ACL on an NNI:
243+
### Create an egress ACL for the ISD external network
252244

253-
1. Create an isolation domain external network ingress and egress ACLs.
254-
2. Update Arm Resource Reference for External Network.
255-
256-
## Create an ISD external network egress ACL
257-
258-
To create an egress ACL for an Isolation Domain External Network, use the following command:
245+
To create an egress ACL for the specified ISD external network with the provided configuration, use the following command. Adjust the parameters as required for your use case.
259246

260247
```bash
261248
az networkfabric acl create
@@ -268,11 +255,9 @@ az networkfabric acl create
268255
--match-configurations "[{matchConfigurationName:'L3ISD_EXT_OPTA_EGRESS_ACL_IPV4_CE_PE',sequenceNumber:1110,ipAddressType:IPv4,matchConditions:[{ipCondition:{type:SourceIP,prefixType:Prefix,ipPrefixValues:['10.18.0.124/30','10.18.0.128/30','10.18.30.16/30','10.18.30.20/30']}},{ipCondition:{type:DestinationIP,prefixType:Prefix,ipPrefixValues:['10.18.0.124/30','10.18.0.128/30','10.18.30.16/30','10.18.30.20/30']}}],actions:[{type:Count}]}]"
269256
```
270257

271-
This command creates an egress ACL for the specified Isolation Domain External Network with the provided configuration.
272-
273-
### Expected output
258+
#### Expected output
274259

275-
Upon successful execution, the command will return information about the created ACL in the following format:
260+
Upon successful execution, the command returns information about the created ACL in the following format. This output includes details about the configuration and state.
276261

277262
```json
278263
{
@@ -336,11 +321,9 @@ Upon successful execution, the command will return information about the created
336321
}
337322
```
338323

339-
This output provides details of the created ACL, including its configuration, state, and other relevant information. Adjust the parameters as required for your use case.
324+
### Create an ingress ACL for the ISD external network
340325

341-
## Create ISD External Network ingress ACL
342-
343-
To create an ingress ACL for an Isolation Domain External Network, use the following command:
326+
To create an ingress ACL for the specified ISD external network with the provided configuration, use the following command. Adjust the parameters as required for your use case.
344327

345328
```bash
346329
az networkfabric acl create
@@ -353,11 +336,9 @@ az networkfabric acl create
353336
--match-configurations "[{matchConfigurationName:'L3ISD_EXT_OPTA_INGRESS_ACL_IPV4_CE_PE',sequenceNumber:1110,ipAddressType:IPv4,matchConditions:[{ipCondition:{type:SourceIP,prefixType:Prefix,ipPrefixValues:['10.18.0.124/30','10.18.0.128/30','10.18.30.16/30','10.18.30.20/30']}},{ipCondition:{type:DestinationIP,prefixType:Prefix,ipPrefixValues:['10.18.0.124/30','10.18.0.128/30','10.18.30.16/30','10.18.30.20/30']}}],actions:[{type:Count}]}]"
354337
```
355338

356-
This command creates an ingress ACL for the specified Isolation Domain External Network with the provided configuration.
357-
358-
### Expected Output
339+
#### Expected output
359340

360-
Upon successful execution, the command will return information about the created ACL in the following format:
341+
Upon successful execution, the command returns information about the created ACL in the following format. This output includes details about the configuration and state.
361342

362343
```json
363344
{
@@ -420,5 +401,3 @@ Upon successful execution, the command will return information about the created
420401
"type": "microsoft.managednetworkfabric/accesscontrollists"
421402
}
422403
```
423-
424-
This output provides details of the created ACL, including its configuration, state, and other relevant information. Adjust the parameters as required for your use case.

0 commit comments

Comments
 (0)