Skip to content

Commit 2bd0f6b

Browse files
ShannonLeavittShannonLeavitt
authored
Merge pull request #178877 from Blackmist/1891137-port-updates-part-2
updates for ports/clarity
2 parents dbcd851 + 472bdc6 commit 2bd0f6b

File tree

3 files changed

+143
-40
lines changed

3 files changed

+143
-40
lines changed

‎articles/machine-learning/how-to-access-azureml-behind-firewall.md

Lines changed: 136 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,13 @@ ms.topic: how-to
99
ms.author: jhirono
1010
author: jhirono
1111
ms.reviewer: larryfr
12-
ms.date: 10/21/2021
12+
ms.date: 11/05/2021
1313
ms.custom: devx-track-python, ignite-fall-2021
1414
---
1515

1616
# Configure inbound and outbound network traffic
1717

18-
In this article, learn about the network communication requirements when securing Azure Machine Learning workspace in a virtual network (VNet). This includes how to configure Azure Firewall to control access to your Azure Machine Learning workspace and the public internet. To learn more about securing Azure Machine Learning, see [Enterprise security for Azure Machine Learning](concept-enterprise-security.md).
18+
In this article, learn about the network communication requirements when securing Azure Machine Learning workspace in a virtual network (VNet). Including how to configure Azure Firewall to control access to your Azure Machine Learning workspace and the public internet. To learn more about securing Azure Machine Learning, see [Enterprise security for Azure Machine Learning](concept-enterprise-security.md).
1919

2020
> [!NOTE]
2121
> The information in this article applies to Azure Machine Learning workspace configured with a private endpoint.
@@ -30,6 +30,18 @@ In this article, learn about the network communication requirements when securin
3030
> * [Enable studio functionality](how-to-enable-studio-virtual-network.md)
3131
> * [Use custom DNS](how-to-custom-dns.md)
3232
33+
## Well-known ports
34+
35+
The following are well-known ports used by services listed in this article. If a port range is used in this article and is not listed in this section, it is specific to the service and may not have published information on what it is used for:
36+
37+
38+
| Port | Description |
39+
| ----- | ----- |
40+
| 80 | Unsecured web traffic (HTTP) |
41+
| 443 | Secured web traffic (HTTPS) |
42+
| 445 | SMB traffic used to access file shares in Azure File storage |
43+
| 8787 | Used when connecting to RStudio on a compute instance |
44+
3345
## Required public internet access
3446

3547
[!INCLUDE [machine-learning-required-public-internet-access](../../includes/machine-learning-public-internet-access.md)]
@@ -57,7 +69,7 @@ These rule collections are described in more detail in [What are some Azure Fire
5769

5870
| Service tag | Protocol | Port |
5971
| ----- |:-----:|:-----:|
60-
| AzureActiveDirectory | TCP | * |
72+
| AzureActiveDirectory | TCP | 80, 443 |
6173
| AzureMachineLearning | TCP | 443 |
6274
| AzureResourceManager | TCP | 443 |
6375
| Storage.region | TCP | 443 |
@@ -67,7 +79,7 @@ These rule collections are described in more detail in [What are some Azure Fire
6779
| Keyvault.region | TCP | 443 |
6880

6981
> [!TIP]
70-
> * ContainerRegistry.region is only needed for custom Docker images. This includes small modifications (such as additional packages) to base images provided by Microsoft.
82+
> * ContainerRegistry.region is only needed for custom Docker images. Including small modifications (such as additional packages) to base images provided by Microsoft.
7183
> * MicrosoftContainerRegistry.region is only needed if you plan on using the _default Docker images provided by Microsoft_, and _enabling user-managed dependencies_.
7284
> * Keyvault.region is only needed if your workspace was created with the [hbi_workspace](/python/api/azureml-core/azureml.core.workspace%28class%29#create-name--auth-none--subscription-id-none--resource-group-none--location-none--create-resource-group-true--sku--basic---friendly-name-none--storage-account-none--key-vault-none--app-insights-none--container-registry-none--cmk-keyvault-none--resource-cmk-uri-none--hbi-workspace-false--default-cpu-compute-target-none--default-gpu-compute-target-none--exist-ok-false--show-output-true-) flag enabled.
7385
> * For entries that contain `region`, replace with the Azure region that you're using. For example, `ContainerRegistry.westus`.
@@ -117,52 +129,143 @@ If not configured correctly, the firewall can cause problems using your workspac
117129

118130
The hosts in the following tables are owned by Microsoft, and provide services required for the proper functioning of your workspace. The tables list hosts for the Azure public, Azure Government, and Azure China 21Vianet regions.
119131

132+
> [!IMPORTANT]
133+
> Azure Machine Learning uses Azure Storage Accounts in your subscription and in Microsoft-managed subscriptions. Where applicable, the following terms are used to differentiate between them in this section:
134+
>
135+
> * __Your storage__: The Azure Storage Account(s) in your subscription, which is used to store your data and artifacts such as models, training data, training logs, and Python scripts.>
136+
> * __Microsoft storage__: The Azure Machine Learning compute instance and compute clusters rely on Azure Batch, and must access storage located in a Microsoft subscription. This storage is used only for the management of the compute instances. None of your data is stored here.
137+
120138
**General Azure hosts**
121139

122-
| **Required for** | **Azure public** | **Azure Government** | **Azure China 21Vianet** |
140+
# [Azure public](#tab/public)
141+
142+
| **Required for** | **Hosts** | **Protocol** | **Ports** |
143+
| ----- | ----- | ----- | ---- |
144+
| Azure Active Directory | login.microsoftonline.com | TCP | 80, 443 |
145+
| Azure portal | management.azure.com | TCP | 443 |
146+
| Azure Resource Manager | management.azure.com | TCP | 443 |
147+
148+
# [Azure Government](#tab/gov)
149+
150+
| **Required for** | **Hosts** | **Protocol** | **Ports** |
151+
| ----- | ----- | ----- | ---- |
152+
| Azure Active Directory | login.microsoftonline.us | TCP | 80, 443 |
153+
| Azure portal | management.azure.us | TCP | 443 |
154+
| Azure Resource Manager | management.usgovcloudapi.net | TCP | 443 |
155+
156+
# [Azure China 21Vianet](#tab/china)
157+
158+
| **Required for** | **Hosts** | **Protocol** | **Ports** |
123159
| ----- | ----- | ----- | ----- |
124-
| Azure Active Directory | login.microsoftonline.com | login.microsoftonline.us | login.chinacloudapi.cn |
125-
| Azure portal | management.azure.com | management.azure.us | management.azure.cn |
126-
| Azure Resource Manager | management.azure.com | management.usgovcloudapi.net | management.chinacloudapi.cn |
160+
| Azure Active Directory | login.chinacloudapi.cn | TCP | 80, 443 |
161+
| Azure portal | management.azure.cn | TCP | 443 |
162+
| Azure Resource Manager | management.chinacloudapi.cn | TCP | 443 |
163+
164+
---
127165

128166
**Azure Machine Learning hosts**
129167

130168
> [!IMPORTANT]
131169
> In the following table, replace `<storage>` with the name of the default storage account for your Azure Machine Learning workspace.
132170
133-
| **Required for** | **Azure public** | **Azure Government** | **Azure China 21Vianet** |
171+
# [Azure public](#tab/public)
172+
173+
| **Required for** | **Hosts** | **Protocol** | **Ports** |
174+
| ----- | ----- | ----- | ----- |
175+
| Azure Machine Learning studio | ml.azure.com | TCP | 443 |
176+
| API |\*.azureml.ms | TCP | 443 |
177+
| Integrated notebook | \*.notebooks.azure.net | TCP | 443 |
178+
| Integrated notebook | \<storage\>.file.core.windows.net | TCP | 443, 445 |
179+
| Integrated notebook | \<storage\>.dfs.core.windows.net | TCP | 443 |
180+
| Integrated notebook | \<storage\>.blob.core.windows.net | TCP | 443 |
181+
| Integrated notebook | graph.microsoft.com | TCP | 443 |
182+
| Integrated notebook | \*.aznbcontent.net | TCP | 443 |
183+
184+
# [Azure Government](#tab/gov)
185+
186+
| **Required for** | **Hosts** | **Protocol** | **Ports** |
134187
| ----- | ----- | ----- | ----- |
135-
| Azure Machine Learning studio | ml.azure.com | ml.azure.us | studio.ml.azure.cn |
136-
| API |\*.azureml.ms | \*.ml.azure.us | \*.ml.azure.cn |
137-
| Integrated notebook | \*.notebooks.azure.net | \*.notebooks.usgovcloudapi.net |\*.notebooks.chinacloudapi.cn |
138-
| Integrated notebook | \<storage\>.file.core.windows.net | \<storage\>.file.core.usgovcloudapi.net | \<storage\>.file.core.chinacloudapi.cn |
139-
| Integrated notebook | \<storage\>.dfs.core.windows.net | \<storage\>.dfs.core.usgovcloudapi.net | \<storage\>.dfs.core.chinacloudapi.cn |
140-
| Integrated notebook | \<storage\>.blob.core.windows.net | \<storage\>.blob.core.usgovcloudapi.net | \<storage\>.blob.core.chinacloudapi.cn |
141-
| Integrated notebook | graph.microsoft.com | graph.microsoft.us | graph.chinacloudapi.cn |
142-
| Integrated notebook | \*.aznbcontent.net | | |
188+
| Azure Machine Learning studio | ml.azure.us | TCP | 443 |
189+
| API | \*.ml.azure.us | TCP | 443 |
190+
| Integrated notebook | \*.notebooks.usgovcloudapi.net | TCP | 443 |
191+
| Integrated notebook | \<storage\>.file.core.usgovcloudapi.net | TCP | 443, 445 |
192+
| Integrated notebook | \<storage\>.dfs.core.usgovcloudapi.net | TCP | 443 |
193+
| Integrated notebook | \<storage\>.blob.core.usgovcloudapi.net | TCP | 443 |
194+
| Integrated notebook | graph.microsoft.us | TCP | 443 |
195+
| Integrated notebook | \*.aznbcontent.net | TCP | 443 |
196+
197+
# [Azure China 21Vianet](#tab/china)
198+
199+
| **Required for** | **Hosts** | **Protocol** | **Ports** |
200+
| ----- | ----- | ----- | ----- |
201+
| Azure Machine Learning studio | studio.ml.azure.cn | TCP | 443 |
202+
| API | \*.ml.azure.cn | TCP | 443 |
203+
| Integrated notebook | \*.notebooks.chinacloudapi.cn | TCP | 443 |
204+
| Integrated notebook | \<storage\>.file.core.chinacloudapi.cn | TCP | 443, 445 |
205+
| Integrated notebook | \<storage\>.dfs.core.chinacloudapi.cn | TCP | 443 |
206+
| Integrated notebook | \<storage\>.blob.core.chinacloudapi.cn | TCP | 443 |
207+
| Integrated notebook | graph.chinacloudapi.cn | TCP | 443 |
208+
| Integrated notebook | \*.aznbcontent.net | TCP | 443 |
209+
210+
---
143211

144212
**Azure Machine Learning compute instance and compute cluster hosts**
145213

146-
| **Required for** | **Azure public** | **Azure Government** | **Azure China 21Vianet** |
147-
| ----- | ----- | ----- | ----- |
148-
| Compute cluster/instance | graph.windows.net | graph.windows.net | graph.chinacloudapi.cn |
149-
| Compute instance | \*.instances.azureml.net | \*.instances.azureml.us | \*.instances.azureml.cn |
150-
| Compute instance | \*.instances.azureml.ms | | |
151-
| Azure Storage Account | \*.blob.core.windows.net</br>\*.table.core.windows.net</br>\*.queue.core.windows.net | \*.blob.core.usgovcloudapi.net</br>\*.table.core.usgovcloudapi.net</br>\*.queue.core.usgovcloudapi.net | \*blob.core.chinacloudapi.cn</br>\*.table.core.chinacloudapi.cn</br>\*.queue.core.chinacloudapi.cn |
152-
| Azure Key Vault | \*.vault.azure.net | \*.vault.usgovcloudapi.net | \*.vault.azure.cn |
214+
> [!TIP]
215+
> * The host for __Azure Key Vault__ is only needed if your workspace was created with the [hbi_workspace](/python/api/azureml-core/azureml.core.workspace%28class%29#create-name--auth-none--subscription-id-none--resource-group-none--location-none--create-resource-group-true--sku--basic---friendly-name-none--storage-account-none--key-vault-none--app-insights-none--container-registry-none--cmk-keyvault-none--resource-cmk-uri-none--hbi-workspace-false--default-cpu-compute-target-none--default-gpu-compute-target-none--exist-ok-false--show-output-true-) flag enabled.
216+
> * Ports 8787 and 18881 for __compute instance__ are only needed when your Azure Machine workspace has a private endpoint.
217+
> * In the following table, replace `<storage>` with the name of the default storage account for your Azure Machine Learning workspace.
153218
154-
> [!IMPORTANT]
155-
> Your firewall must allow communication with \*.instances.azureml.ms over __TCP__ ports __18881, 443, and 8787__.
219+
# [Azure public](#tab/public)
156220

157-
> [!TIP]
158-
> The FQDN for Azure Key Vault is only needed if your workspace was created with the [hbi_workspace](/python/api/azureml-core/azureml.core.workspace%28class%29#create-name--auth-none--subscription-id-none--resource-group-none--location-none--create-resource-group-true--sku--basic---friendly-name-none--storage-account-none--key-vault-none--app-insights-none--container-registry-none--cmk-keyvault-none--resource-cmk-uri-none--hbi-workspace-false--default-cpu-compute-target-none--default-gpu-compute-target-none--exist-ok-false--show-output-true-) flag enabled.
221+
| **Required for** | **Hosts** | **Protocol** | **Ports** |
222+
| ----- | ----- | ----- | ----- |
223+
| Compute cluster/instance | graph.windows.net | TCP | 443 |
224+
| Compute instance | \*.instances.azureml.net | TCP | 443 |
225+
| Compute instance | \*.instances.azureml.ms | TCP | 443, 8787, 18881 |
226+
| Microsoft storage access | \*.blob.core.windows.net | TCP | 443 |
227+
| Microsoft storage access | \*.table.core.windows.net | TCP | 443 |
228+
| Microsoft storage access | \*.queue.core.windows.net | TCP | 443 |
229+
| Your storage account | \<storage\>.file.core.windows.net | TCP | 443, 445 |
230+
| Your storage account | \<storage\>.blob.core.windows.net | TCP | 443 |
231+
| Azure Key Vault | \*.vault.azure.net | TCP | 443 |
232+
233+
# [Azure Government](#tab/gov)
234+
235+
| **Required for** | **Hosts** | **Protocol** | **Ports** |
236+
| ----- | ----- | ----- | ----- |
237+
| Compute cluster/instance | graph.windows.net | TCP | 443 |
238+
| Compute instance | \*.instances.azureml.us | TCP | 443 |
239+
| Compute instance | \*.instances.azureml.ms | TCP | 443, 8787, 18881 |
240+
| Microsoft storage access | \*.blob.core.usgovcloudapi.net | TCP | 443 |
241+
| Microsoft storage access | \*.table.core.usgovcloudapi.net | TCP | 443 |
242+
| Microsoft storage access | \*.queue.core.usgovcloudapi.net | TCP | 443 |
243+
| Your storage account | \<storage\>.file.core.usgovcloudapi.net | TCP | 443, 445 |
244+
| Your storage account | \<storage\>.blob.core.usgovcloudapi.net | TCP | 443 |
245+
| Azure Key Vault | \*.vault.usgovcloudapi.net | TCP | 443 |
246+
247+
# [Azure China 21Vianet](#tab/china)
248+
249+
| **Required for** | **Hosts** | **Protocol** | **Ports** |
250+
| ----- | ----- | ----- | ----- |
251+
| Compute cluster/instance | graph.chinacloudapi.cn | TCP | 443 |
252+
| Compute instance | \*.instances.azureml.cn | TCP | 443 |
253+
| Compute instance | \*.instances.azureml.ms | TCP | 443, 8787, 18881 |
254+
| Microsoft storage access | \*blob.core.chinacloudapi.cn | TCP | 443 |
255+
| Microsoft storage access | \*.table.core.chinacloudapi.cn | TCP | 443 |
256+
| Microsoft storage access | \*.queue.core.chinacloudapi.cn | TCP | 443 |
257+
| Your storage account | \<storage\>.file.core.chinacloudapi.cn | TCP | 443, 445 |
258+
| Your storage account | \<storage\>.blob.core.chinacloudapi.cn | TCP | 443 |
259+
| Azure Key Vault | \*.vault.azure.cn | TCP | 443 |
260+
261+
---
159262

160263
**Docker images maintained by by Azure Machine Learning**
161264

162-
| **Required for** | **Azure public** | **Azure Government** | **Azure China 21Vianet** |
265+
| **Required for** | **Hosts** | **Protocol** | **Ports** |
163266
| ----- | ----- | ----- | ----- |
164-
| Microsoft Container Registry | mcr.microsoft.com | mcr.microsoft.com | mcr.microsoft.com |
165-
| Azure Machine Learning pre-built images | viennaglobal.azurecr.io | viennaglobal.azurecr.io | viennaglobal.azurecr.io |
267+
| Microsoft Container Registry | mcr.microsoft.com | TCP | 443 |
268+
| Azure Machine Learning pre-built images | viennaglobal.azurecr.io | TCP | 443 |
166269

167270
> [!TIP]
168271
> * __Azure Container Registry__ is required for any custom Docker image. This includes small modifications (such as additional packages) to base images provided by Microsoft.
@@ -233,7 +336,7 @@ Enable outbound access to the following endpoints when deploying the Azure Machi
233336
| quay.io, *.quay.io | https:443 | Quay.io registry, required to pull container images for AML extension components |
234337
| gcr.io| https:443 | Google cloud repository, required to pull container images for AML extension components |
235338
| storage.googleapis.com | https:443 | Google cloud storage, gcr images are hosted on |
236-
| registry-1.docker.io, production.cloudflare.docker.com | https:443 | Docker hub registry,required to pull container images for AML extension components |
339+
| registry-1.docker.io, production.cloudflare.docker.com | https:443 | Docker hub registry, required to pull container images for AML extension components |
237340
| auth.docker.io| https:443 | Docker repository authentication, required to access docker hub registry |
238341
| *.kusto.windows.net, *.table.core.windows.net, *.queue.core.windows.net | https:443 | Required to upload and analyze system logs in Kusto |
239342

@@ -254,7 +357,7 @@ In addition to the endpoints for training workloads, enable outbound access for
254357
|--|--|--|
255358
| *.azurecr.io | https:443 | Azure container registry, required to pull container images to host training or inference jobs|
256359
| *.blob.core.windows.net | https:443 | Azure blob storage, required to fetch machine learning project scripts, container images and job logs/metrics |
257-
| *.workspace.\<region\>.api.azureml.ms , \<region\>.experiments.azureml.net, \<region\>.api.azureml.ms | https:443 | Azure mahince learning service api, required to communicate with AML |
360+
| *.workspace.\<region\>.api.azureml.ms , \<region\>.experiments.azureml.net, \<region\>.api.azureml.ms | https:443 | Azure machine learning service api, required to communicate with AML |
258361

259362
### Visual Studio Code hosts
260363

‎articles/machine-learning/how-to-secure-training-vnet.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ ms.topic: how-to
99
ms.reviewer: larryfr
1010
ms.author: jhirono
1111
author: jhirono
12-
ms.date: 10/21/2021
12+
ms.date: 11/05/2021
1313
ms.custom: contperf-fy20q4, tracking-python, contperf-fy21q1, references_regions
1414

1515
---

‎includes/machine-learning-public-internet-access.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
---
2-
title: include file
3-
description: include file
2+
title: Include file
3+
description: Include file
44
author: lobrien
55
ms.service: machine-learning
66
services: machine-learning
77
ms.topic: include
8-
ms.date: 08/27/2021
8+
ms.date: 11/05/2021
99
ms.author: larryfr
1010
ms.custom: include file
1111
---
@@ -16,7 +16,7 @@ Azure Machine Learning requires both inbound and outbound access to the public i
1616
| ----- |:-----:| ----- | ----- |
1717
| Inbound | 29876-29877 | BatchNodeManagement | Create, update, and delete of Azure Machine Learning compute instance and compute cluster. |
1818
| Inbound | 44224 | AzureMachineLearning | Create, update, and delete of Azure Machine Learning compute instance. |
19-
| Outbound | * | AzureActiveDirectory | Authentication using Azure AD. |
19+
| Outbound | 80, 443 | AzureActiveDirectory | Authentication using Azure AD. |
2020
| Outbound | 443 | AzureMachineLearning | Using Azure Machine Learning services. |
2121
| Outbound | 443 | AzureResourceManager | Creation of Azure resources with Azure Machine Learning. |
2222
| Outbound | 443 | Storage.region | Access data stored in the Azure Storage Account for the Azure Batch service. |
@@ -43,8 +43,8 @@ You may also need to allow __outbound__ traffic to Visual Studio Code and non-Mi
4343
| **cloud.r-project.org** | Used when installing CRAN packages for R development. |
4444
| **\*pytorch.org** | Used by some examples based on PyTorch. |
4545
| **\*.tensorflow.org** | Used by some examples based on Tensorflow. |
46-
| **update.code.visualstudio.com**</br></br>**\*.vo.msecnd.net** | Used to retrieve VS Code server bits which are installed on the compute instance through a setup script.|
47-
| **raw.githubusercontent.com/microsoft/vscode-tools-for-ai/master/azureml_remote_websocket_server/\*** | Used to retrieve websocket server bits which are installed on the compute instance. The websocket server is used to transmit requests from Visual Studio Code client (desktop application) to Visual Studio Code server running on the compute instance.|
46+
| **update.code.visualstudio.com**</br></br>**\*.vo.msecnd.net** | Used to retrieve VS Code server bits, which are installed on the compute instance through a setup script.|
47+
| **raw.githubusercontent.com/microsoft/vscode-tools-for-ai/master/azureml_remote_websocket_server/\*** | Used to retrieve websocket server bits, which are installed on the compute instance. The websocket server is used to transmit requests from Visual Studio Code client (desktop application) to Visual Studio Code server running on the compute instance.|
4848

4949
When using Azure Kubernetes Service (AKS) with Azure Machine Learning, allow the following traffic to the AKS VNet:
5050

0 commit comments

Comments
 (0)