Skip to content

Commit 27903e7

Browse files
ttorblettorble
authored
Merge pull request #102337 from damendo/master
Adding ARM Support
2 parents 98be1c0 + 35f2f92 commit 27903e7

File tree

3 files changed

+193
-8
lines changed

3 files changed

+193
-8
lines changed

‎articles/network-watcher/network-watcher-nsg-flow-logging-azure-resource-manager.md

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
---
2+
title: Network Watcher - Create NSG flow logs using an Azure Resource Manager template
3+
description: Use an Azure Resource Manager template and PowerShell to easily set up NSG Flow Logs.
4+
services: network-watcher
5+
documentationcenter: na
6+
author: damendo
7+
manager: twooley
8+
editor:
9+
tags: azure-resource-manager
10+
11+
ms.service: network-watcher
12+
ms.devlang: na
13+
ms.topic: article
14+
ms.tgt_pltfrm: na
15+
ms.workload: infrastructure-services
16+
ms.date: 01/26/2020
17+
ms.author: damendo
18+
19+
---
20+
21+
# Configure NSG Flow Logs from an Azure Resource Manager template
22+
23+
> [!div class="op_single_selector"]
24+
> - [Azure portal](network-watcher-nsg-flow-logging-portal.md)
25+
> - [PowerShell](network-watcher-nsg-flow-logging-powershell.md)
26+
> - [Azure CLI](network-watcher-nsg-flow-logging-cli.md)
27+
> - [REST API](network-watcher-nsg-flow-logging-rest.md)
28+
> - [Azure Resource Manager](network-watcher-nsg-flow-logging-azure-resource-manager.md)
29+
30+
31+
[Azure Resource Manager](https://azure.microsoft.com/features/resource-manager/) is Azure’s native and powerful way to manage your [infrastructure as code](https://docs.microsoft.com/azure/devops/learn/what-is-infrastructure-as-code).
32+
33+
This article shows how you to enable [NSG Flow Logs](https://docs.microsoft.com/azure/network-watcher/network-watcher-nsg-flow-logging-overview) programmatically using an Azure Resource Manager template and Azure PowerShell. We start by providing an overview of the properties of the NSG Flow Log object, followed by a few sample templates. Then we the deploy template using a local PowerShell instance.
34+
35+
36+
## NSG Flow Logs object
37+
38+
The NSG Flow Logs object with all with parameters is show below.
39+
For a complete overview of the properties, you may read the [NSG Flow Logs template reference](https://docs.microsoft.com/azure/templates/microsoft.network/2019-11-01/networkwatchers/flowlogs#RetentionPolicyParameters).
40+
41+
```json
42+
{
43+
"name": "string",
44+
"type": "Microsoft.Network/networkWatchers/flowLogs",
45+
"location": "string",
46+
"apiVersion": "2019-09-01",
47+
"properties": {
48+
"targetResourceId": "string",
49+
"storageId": "string",
50+
"enabled": "boolean",
51+
"flowAnalyticsConfiguration": {
52+
"networkWatcherFlowAnalyticsConfiguration": {
53+
"enabled": "boolean",
54+
"workspaceResourceId": "string",
55+
"trafficAnalyticsInterval": "integer"
56+
},
57+
"retentionPolicy": {
58+
"days": "integer",
59+
"enabled": "boolean"
60+
},
61+
"format": {
62+
"type": "string",
63+
"version": "integer"
64+
}
65+
}
66+
}
67+
}
68+
```
69+
To create a Microsoft.Network/networkWatchers/flowLogs resource, add the above JSON to the resources section of your template.
70+
71+
72+
## Creating your template
73+
74+
If you are using Azure Resource Manager templates for this time, you can learn more about them the links below.
75+
76+
* [Deploy resources with Resource Manager templates and Azure PowerShell](https://docs.microsoft.com/azure/azure-resource-manager/templates/deploy-powershell#deploy-local-template)
77+
* [Tutorial: Create and deploy your first Azure Resource Manager template](https://docs.microsoft.com/azure/azure-resource-manager/templates/template-tutorial-create-first-template?tabs=azure-powershell)
78+
79+
80+
Below are two examples of complete templates to set up NSG Flow Logs.
81+
82+
Example 1: The simplest version of the above with minimum parameters passed. The below template enables NSG Flow Logs on a target NSG and stores them in a given storage account.
83+
84+
```json
85+
{
86+
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
87+
"contentVersion": "1.0.0.0",
88+
"apiProfile": "2019-09-01",
89+
"resources": [
90+
{
91+
"name": "NetworkWatcher_centraluseuap/Microsoft.NetworkDalanDemoPerimeterNSG",
92+
"type": "Microsoft.Network/networkWatchers/FlowLogs/",
93+
"location": "centraluseuap",
94+
"apiVersion": "2019-09-01",
95+
"properties": {
96+
"targetResourceId": "/subscriptions/56abfbd6-ec72-4ce9-831f-bc2b6f2c5505/resourceGroups/DalanDemo/providers/Microsoft.Network/networkSecurityGroups/PerimeterNSG",
97+
"storageId": "/subscriptions/56abfbd6-ec72-4ce9-831f-bc2b6f2c5505/resourceGroups/MyCanaryFlowLog/providers/Microsoft.Storage/storageAccounts/storagev2ira",
98+
"enabled": true,
99+
"flowAnalyticsConfiguration": {},
100+
"retentionPolicy": {},
101+
"format": {}
102+
}
103+
104+
}
105+
]
106+
}
107+
```
108+
109+
> [!NOTE]
110+
> * The name of resource has the format "Parent Resource>/Child resource". Here, the parent resource is the regional Network Watcher instance (Format: NetworkWatcher_<RegionName>. Example: NetworkWatcher_centraluseuap)
111+
> * targetResourceId is the resource ID of the target NSG
112+
> * storageId is the resource ID of the destination storage account
113+
114+
Example 2: The following templates enabling NSG Flow Logs (version 2) with a retention for 5 days. Enabling Traffic Analytics with a processing interval of 10 minutes.
115+
116+
```json
117+
{
118+
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
119+
"contentVersion": "1.0.0.0",
120+
"apiProfile": "2019-09-01",
121+
"resources": [
122+
{
123+
"name": "NetworkWatcher_centraluseuap/Microsoft.NetworkDalanDemoPerimeterNSG",
124+
"type": "Microsoft.Network/networkWatchers/FlowLogs/",
125+
"location": "centraluseuap",
126+
"apiVersion": "2019-09-01",
127+
"properties": {
128+
"targetResourceId": "/subscriptions/56abfbd6-ec72-4ce9-831f-bc2b6f2c5505/resourceGroups/DalanDemo/providers/Microsoft.Network/networkSecurityGroups/PerimeterNSG",
129+
"storageId": "/subscriptions/56abfbd6-ec72-4ce9-831f-bc2b6f2c5505/resourceGroups/MyCanaryFlowLog/providers/Microsoft.Storage/storageAccounts/storagev2ira",
130+
"enabled": true,
131+
"flowAnalyticsConfiguration": {
132+
"enabled": true,
133+
"workspaceResourceId": "91a3d1e9-698e-4a49-96dc-f6fc585ae888",
134+
"trafficAnalyticsInterval": 10
135+
},
136+
"retentionPolicy": {
137+
"days": 5,
138+
"enabled": true
139+
},
140+
"format": {
141+
"type": "JSON",
142+
"version": 1
143+
}
144+
}
145+
146+
}
147+
]
148+
}
149+
```
150+
151+
## Deploying your Azure Resource Manager template
152+
153+
This tutorial assumes you have an existing Resource group and an NSG you can enable Flow logging on.
154+
You can save any of the above example templates locally as `azuredeploy.json`. Update the property values so that they point to valid resources in your subscription.
155+
156+
To deploy the template, run the following command in PowerShell.
157+
```azurepowershell
158+
New-AzResourceGroupDeployment -Name EnableFlowLog -ResourceGroupName NetworkWatcherRG `
159+
-TemplateFile "C:\MyTemplates\azuredeploy.json"
160+
```
161+
162+
163+
## Verifying your deployment
164+
165+
There are a couple of ways to check if your deployment has Succeeded. Your PowerShell console should show "ProvisioningState" as "Succeeded". Additionally, you can visit the [NSG Flow Logs portal page](https://ms.portal.azure.com/#blade/Microsoft_Azure_Network/NetworkWatcherMenuBlade/flowLogs) to confirm your changes. If there were issues with the deployment, take a look at [Troubleshoot common Azure deployment errors with Azure Resource Manager](https://docs.microsoft.com/azure/azure-resource-manager/templates/common-deployment-errors) article.
166+
167+
168+
## Next steps
169+
170+
Learn how to visualize your NSG Flow data using:
171+
* [Microsoft Power BI](network-watcher-visualize-nsg-flow-logs-power-bi.md)
172+
* [Open source tools](network-watcher-visualize-nsg-flow-logs-open-source-tools.md)
173+
* [Azure Traffic Analytics](https://docs.microsoft.com/azure/network-watcher/traffic-analytics)

‎articles/network-watcher/network-watcher-nsg-flow-logging-portal.md

Lines changed: 18 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
---
2-
title: 'Tutorial - Log network traffic flow to and from a VM using the Azure portal'
3-
titleSuffix: Azure Network Watcher
4-
description: In this tutorial, learn how to log network traffic flow to and from a VM using Network Watcher's NSG flow logs capability.
2+
title: Log network traffic flow to and from a VM - tutorial - Azure portal | Microsoft Docs
3+
description: Learn how to log network traffic flow to and from a VM using Network Watcher's NSG flow logs capability.
54
services: network-watcher
65
documentationcenter: na
76
author: KumudD
@@ -24,6 +23,13 @@ ms.custom: mvc
2423

2524
# Tutorial: Log network traffic to and from a virtual machine using the Azure portal
2625

26+
> [!div class="op_single_selector"]
27+
> - [Azure portal](network-watcher-nsg-flow-logging-portal.md)
28+
> - [PowerShell](network-watcher-nsg-flow-logging-powershell.md)
29+
> - [Azure CLI](network-watcher-nsg-flow-logging-cli.md)
30+
> - [REST API](network-watcher-nsg-flow-logging-rest.md)
31+
> - [Azure Resource Manager](network-watcher-nsg-flow-logging-azure-resource-manager.md)
32+
2733
A network security group (NSG) enables you to filter inbound traffic to, and outbound traffic from, a virtual machine (VM). You can log network traffic that flows through an NSG with Network Watcher's NSG flow log capability. In this tutorial, you learn how to:
2834

2935
> [!div class="checklist"]
@@ -90,7 +96,10 @@ NSG flow logging requires the **Microsoft.Insights** provider. To register the p
9096
| Location | Select **East US** |
9197
| Resource group | Select **Use existing**, and then select **myResourceGroup** |
9298

93-
The storage account must be in the same region as the NSG. The storage account may take around minute to create. Don't continue with remaining steps until the storage account is created.
99+
The storage account may take around minute to create. Don't continue with remaining steps until the storage account is created. If you use an existing storage account instead of creating one, ensure you select a storage account that has **All networks** (default) selected for **Firewalls and virtual networks**, under the **SETTINGS** for the storage account. In all cases, the storage account must be in the same region as the NSG.
100+
101+
> [!NOTE]
102+
> While Microsoft.Insight and Microsoft.Network providers are currently supported as trusted Microsoft Services for Azure Storage, NSG Flow logs is still not fully onboarded. To enable NSG Flow logging, **All Networks** must still be selected until this feature is fully onboarded. 
94103
4. In the top, left corner of portal, select **All services**. In the **Filter** box, type *Network Watcher*. When **Network Watcher** appears in the search results, select it.
95104
5. Under **LOGS**, select **NSG flow logs**, as shown in the following picture:
96105

@@ -104,8 +113,9 @@ NSG flow logging requires the **Microsoft.Insights** provider. To register the p
104113

105114
9. Select the storage account that you created in step 3.
106115
> [!NOTE]
107-
> NSG Flow Logs will not work with a storage account if:
108-
> * The storage account has a [hierarchical namespace](https://docs.microsoft.com/azure/storage/blobs/data-lake-storage-namespace) enabled.
116+
> NSG Flow Logs do not work with storage accounts if:
117+
> * The storage accounts have a firewall enabled.
118+
> * The storage accounts have [hierarchical namespace](https://docs.microsoft.com/azure/storage/blobs/data-lake-storage-namespace) enabled.
109119
1. In the top, left corner of portal, select **All services**. In the **Filter** box, type *Network Watcher*. When **Network Watcher** appears in the search results, select it.
110120
10. Set **Retention (days)** to 5, and then select **Save**.
111121

@@ -117,7 +127,7 @@ NSG flow logging requires the **Microsoft.Insights** provider. To register the p
117127
![Download flow logs](./media/network-watcher-nsg-flow-logging-portal/download-flow-logs.png)
118128

119129
3. Select the storage account that you configured in step 2 of [Enable NSG flow log](#enable-nsg-flow-log).
120-
4. Under **Blob service**, select **Containers**, and then select the **insights-logs-networksecuritygroupflowevent** container.
130+
4. Under **Blob service**, select **Blobs**, and then select the **insights-logs-networksecuritygroupflowevent** container.
121131
5. In the container, navigate the folder hierarchy until you get to a PT1H.json file, as shown in the picture that follows. Log files are written to a folder hierarchy that follows the following naming convention:
122132
https://{storageAccountName}.blob.core.windows.net/insights-logs-networksecuritygroupflowevent/resourceId=/SUBSCRIPTIONS/{subscriptionID}/RESOURCEGROUPS/{resourceGroupName}/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/{nsgName}/y={year}/m={month}/d={day}/h={hour}/m=00/macAddress={macAddress}/PT1H.json
123133

@@ -218,4 +228,4 @@ The value for **mac** in the previous output is the MAC address of the network i
218228

219229
## Next steps
220230

221-
In this tutorial, you learned how to enable NSG flow logging for an NSG. You also learned how to download and view data logged in a file. The raw data in the json file can be difficult to interpret. To visualize the data, you can use Network Watcher [traffic analytics](traffic-analytics.md), Microsoft [PowerBI](network-watcher-visualize-nsg-flow-logs-power-bi.md), and other tools.
231+
In this tutorial, you learned how to enable NSG flow logging for an NSG. You also learned how to download and view data logged in a file. The raw data in the json file can be difficult to interpret. To visualize Flow Logs data, you can use [Azure Traffic Analytics](traffic-analytics.md), [Microsoft Power BI](network-watcher-visualize-nsg-flow-logs-power-bi.md), and other tools. You can try alternate methods of enabling NSG Flow Logs like [PowerShell](network-watcher-nsg-flow-logging-powershell.md), [Azure CLI](network-watcher-nsg-flow-logging-cli.md), [REST API](network-watcher-nsg-flow-logging-rest.md) and [ARM templates](network-watcher-nsg-flow-logging-azure-resource-manager.md).

‎articles/network-watcher/toc.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,8 @@
101101
href: network-watcher-nsg-flow-logging-cli.md
102102
- name: REST
103103
href: network-watcher-nsg-flow-logging-rest.md
104+
- name: Azure Resoure Manager
105+
href: network-watcher-nsg-flow-logging-azure-resource-manager.md
104106
- name: Delete NSG flow log storage blobs
105107
href: network-watcher-delete-nsg-flow-log-blobs.md
106108
- name: Analyze NSG flow logs

0 commit comments

Comments
 (0)