Skip to content

Commit 344f11b

Browse files
greg-lindsaygreg-lindsay
committed
edit ps steps
1 parent 0d731de commit 344f11b

File tree

2 files changed

+143
-59
lines changed

2 files changed

+143
-59
lines changed

‎articles/dns/dns-security-policy.md

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ author: greg-lindsay
55
manager: KumuD
66
ms.service: azure-dns
77
ms.topic: article
8-
ms.date: 11/14/2024
8+
ms.date: 11/19/2024
99
ms.author: greglin
1010
---
1111

@@ -29,10 +29,8 @@ A DNS security policy has the following associated elements and properties:
2929
- Virtual network links: You can link one security policy per VNet. A security policy can be associated to multiple VNets.
3030
- DNS domain lists: Location-based lists of DNS domains.
3131

32-
You can
33-
34-
On the first option, the security policy is created with diagnostics set to be sent towards a storage account (your DNS query logs are visible there).
35-
On the second option, you configure the security policy via Portal and have instructions on how to create and manage the security policy, plus setting the diagnostic options to send the DNS query details to a log analytics workspace.
32+
You can create a security policy with diagnostics sent to a storage account (your DNS query logs are visible there).
33+
You can create a security policy via Portal and have instructions on how to create and manage the security policy, plus setting the diagnostic options to send the DNS query details to a log analytics workspace.
3634

3735
You should now be able to log your DNS traffic to one or multiple locations (storage account, log analytics workspace). DNS security policy should log all DNS queries initiated from your VNET. You can try following two scenarios for your testing.
3836
1. Create an Azure DNS private zone and link it to the virtual network where you have deployed the resolver. Next create some DNS records in the DNS zone and try to resolve these records from on-prem machines and Azure VMs. You can use nslookup command or Resolve-DnsName PowerShell command to lookup specific DNS records. You can also try variation of this scenario by creating different types of DNS records like AAAA, TXT, CNAME etc.

‎articles/dns/dns-traffic-log-how-to.md

Lines changed: 140 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ description: Learn how to filter and view Azure DNS traffic
44
author: greg-lindsay
55
ms.service: azure-dns
66
ms.topic: how-to
7-
ms.date: 11/14/2024
7+
ms.date: 11/19/2024
88
ms.author: greglin
99
---
1010

@@ -190,74 +190,160 @@ The failed query is recorded in log analytics:
190190
191191
## [PowerShell](#tab/sign-powershell)
192192

193-
Set up a local PowerShell repository and install the Az.DnsResolver PowerShell module
193+
Set up a local PowerShell repository and install the Az.DnsResolver PowerShell module. This is only needed if you aren't using Cloud Shell.
194194

195195
1. Create a new folder on your disk to act as a local PowerShell repository. In this example, `C:\bin\PSRepo` is used.
196196
2. Download [Az.DnsResolver.0.2.6.nupkg](https://github.com/sfiguemsft/privateresolver/blob/main/Az.DnsResolver.0.2.6.nupkg) into this directory.
197197
3. Set up your local repository by running the following command:
198198

199-
```PowerShell
200-
# Register the repository
201-
Register-PSRepository -Name LocalPSRepo -SourceLocation 'C:\bin\PSRepo' -ScriptSourceLocation 'C:\bin\PSRepo' -InstallationPolicy Trusted
199+
```PowerShell
200+
# Register the repository
201+
Register-PSRepository -Name LocalPSRepo -SourceLocation 'C:\bin\PSRepo' -ScriptSourceLocation 'C:\bin\PSRepo' -InstallationPolicy Trusted
202202
203-
# Install the Az.DnsResolver module
204-
Install-Module -Name Az.DnsResolver -RequiredVersion 0.2.6
203+
# Install the Az.DnsResolver module
204+
Install-Module -Name Az.DnsResolver -RequiredVersion 0.2.6 -SkipPublisherCheck
205205
206-
# If you already installed Az.DnsResolver, update your version to 0.2.6
207-
Update-Module -Name Az.DnsResolver
206+
# If you already installed Az.DnsResolver, update your version to 0.2.6
207+
Update-Module -Name Az.DnsResolver
208208
209-
# Confirm that the Az.DnsResolver module was installed properly
210-
Get-InstalledModule -Name Az.DnsResolver
211-
```
209+
# Confirm that the Az.DnsResolver module was installed properly
210+
Get-InstalledModule -Name Az.DnsResolver
211+
```
212212
213213
4. Set the subscription context
214214
215-
```PowerShell
216-
# Connect PowerShell to Azure cloud
217-
Connect-AzAccount -Environment AzureCloud
215+
```PowerShell
216+
# Connect PowerShell to Azure cloud
217+
Connect-AzAccount -Environment AzureCloud
218+
219+
# Set your default subscription
220+
Select-AzSubscription -SubscriptionObject (Get-AzSubscription -SubscriptionId <your-sub-id>)
221+
```
218222
219-
# Set your default subscription
220-
Select-AzSubscription -SubscriptionObject (Get-AzSubscription -SubscriptionId <your-sub-id>)
223+
5. Create a DNS security policy with PowerShell.
221224
222-
# Register your subscription for Microsoft.Network
223-
# Even if your subscription is already registered, re-register the subscription to ensure access to Azure DNS security policy resource types.
224-
$result = Register-AzProviderFeature -ProviderNamespace Microsoft.Network $result.ResourceTypes | Where-Object { $_.ResourceTypeName.Contains("dnsResolverPolicies") -or $_.ResourceTypeName.Contains("dnsResolverDomainLists") }
225-
```
225+
```PowerShell
226+
$ErrorActionPreference = "Stop"
226227
227-
4. Create a DNS security policy with PowerShell
228-
229-
```PowerShell
230-
$ErrorActionPreference = "Stop"
231-
$resourceNumber = 1 # Customize this if needed $region = "centraluseuap" $name = "$($env:username)" $nameSuffix = "prod-$($region)-$($name)-securitypolicytest$($resourceNumber)-bugbash"
232-
$resourceGroupName = "rg-$($nameSuffix)" $virtualNetworkName = "vnet-$($nameSuffix)" $securityPolicyName = "dnssecuritypolicy-$($nameSuffix)" $storageAccountName = "storageaccount$name" $diagnosticSettingName = "diagnosticsetting-$($nameSuffix)" $vnetId = "/subscriptions/$subscriptionId/resourceGroups/$resourceGroupName/providers/Microsoft.Network/virtualNetworks/$virtualNetworkName"
233-
Write-Host "Creating resource group"
234-
$rg = New-AzResourceGroup -Name $resourceGroupName -Location $region Write-Host ($rg | ConvertTo-Json -Depth 64)
235-
Write-Host "Creating virtual network" $defaultSubnet = New-AzVirtualNetworkSubnetConfig -Name "default" -AddressPrefix "10.$resourceNumber.0.0/24" $vnet = New-AzVirtualNetwork -Name $virtualNetworkName -ResourceGroupName $resourceGroupName -Location $region -AddressPrefix "10.$resourceNumber.0.0/16" -Subnet $defaultSubnet Write-Host ($vnet | ConvertTo-Json -Depth 64)
236-
Write-Host "Creating storage account" $storageAccount = New-AzStorageAccount -ResourceGroupName $resourceGroupName -Name $storageAccountName -Location $region -SkuName Standard_GRS Write-Host $securityPolicy.ToJsonString()
237-
################################
238-
# DO PUTS
239-
################################
240-
Write-Host "Creating security policy" $securityPolicy = New-AzDnsResolverPolicy -Location $region -ResourceGroupName $resourceGroupName -Name $securityPolicyName Write-Host $securityPolicy.ToJsonString()
241-
Write-Host "Creating security policy virtual network link" $link = New-AzDnsResolverPolicyVirtualNetworkLink -Location $region -ResourceGroupName $resourceGroupName -DnsResolverPolicyName $securityPolicyName -Name test-policy-link -VirtualNetworkId $vnetId Write-Host $link.ToJsonString()
242-
$log = New-AzDiagnosticSettingLogSettingsObject -Enabled $true -Category DnsResponse
243-
Write-Host "Creating diagnostic setting" $diagnosticSetting = New-AzDiagnosticSetting -Name $diagnosticSettingName -ResourceId $securityPolicy.id -Log $log -StorageAccountId $storageAccount.id Write-Host $diagnosticSetting.ToJsonString()
244-
################################
245-
# DO UPDATES
246-
################################
247-
Write-Host "Updating security policy" $securityPolicy = Update-AzDnsResolverPolicy -ResourceGroupName $resourceGroupName -Name $securityPolicyName -Tag @{"key0" = "value0"} Write-Host $securityPolicy.ToJsonString()
248-
Write-Host "Updating security policy virtual network link" $link = Update-AzDnsResolverPolicyVirtualNetworkLink -ResourceGroupName $resourceGroupName -DnsResolverPolicyName $securityPolicyName -Name test-policy-link -Tag @{"key1" = "value1"} Write-Host $link.ToJsonString()
249-
$log = New-AzDiagnosticSettingLogSettingsObject -Enabled $false -Category DnsResponse
250-
Write-Host "Updating diagnostic setting by disabling log category" $diagnosticSetting = New-AzDiagnosticSetting -Name $diagnosticSettingName -ResourceId $securityPolicy.id -Log $log -StorageAccountId $storageAccount.id Write-Host $diagnosticSetting.ToJsonString()
251-
################################
252-
# DO GETS
253-
################################
254-
Write-Host "Getting security policy" $securityPolicy = Get-AzDnsResolverPolicy -ResourceGroupName $resourceGroupName -Name $securityPolicyName Write-Host $securityPolicy.ToJsonString()
255-
Write-Host "Getting security policy virtual network link"
256-
$link = Get-AzDnsResolverPolicyVirtualNetworkLink -ResourceGroupName $resourceGroupName -DnsResolverPolicyName $securityPolicyName -Name test-policy-link Write-Host $link.ToJsonString()
257-
Write-Host "Getting diagnostic setting" $diagnosticSetting = Get-AzDiagnosticSetting -ResourceId $securityPolicy.id Write-Host $diagnosticSetting.ToJsonString()
258-
```
228+
################################################################
229+
# Configure resource names and locations
230+
################################################################
231+
232+
$resourceNumber = 1 # Customize this if needed
233+
$region = "centralus" # Change this region to your preference
234+
if ($env:username) {$name = "$($env:username)"} else {$name = "$($env:USER)"} # The environment variable is different in Cloud Shell vs local PowerShell
235+
$nameSuffix = "test-$($region)-$($name)-resolverpolicytest$($resourceNumber)-test"
236+
$resourceGroupName = "rg-$($nameSuffix)"
237+
$virtualNetworkName = "vnet-$($nameSuffix)"
238+
$resolverPolicyName = "dnsresolverpolicy-$($nameSuffix)"
239+
$domainListName = "domainlist-$($nameSuffix)"
240+
$securityRuleName = "securityrule-$($nameSuffix)"
241+
$resolverPolicyLinkName = "dnsresolverpolicylink"
242+
$storageAccountName = "stor-$($name)" # Customize this, taking care that the name is not too long
243+
$diagnosticSettingName = "diagnosticsetting-$($nameSuffix)"
244+
$vnetId = "/subscriptions/$subscriptionId/resourceGroups/$resourceGroupName/providers/Microsoft.Network/virtualNetworks/$virtualNetworkName"
245+
246+
################################################################
247+
# Create resource group, virtual network, and storage account
248+
################################################################
249+
250+
Write-Host "Creating resource group"
251+
$rg = New-AzResourceGroup -Name $resourceGroupName -Location $region
252+
Write-Host ($rg | ConvertTo-Json -Depth 64)
253+
254+
Write-Host "Creating virtual network"
255+
$defaultSubnet = New-AzVirtualNetworkSubnetConfig -Name "default" -AddressPrefix "10.$resourceNumber.0.0/24"
256+
$vnet = New-AzVirtualNetwork -Name $virtualNetworkName -ResourceGroupName $resourceGroupName -Location $region -AddressPrefix "10.$resourceNumber.0.0/16" -Subnet $defaultSubnet
257+
Write-Host ($vnet | ConvertTo-Json -Depth 64)
258+
259+
Write-Host "Creating storage account"
260+
$storageAccount = New-AzStorageAccount -ResourceGroupName $resourceGroupName -Name $storageAccountName -Location $region -SkuName Standard_GRS
261+
Write-Host $storageAccount.ToString()
262+
263+
################################
264+
# Create DNS security policy
265+
################################
266+
267+
Write-Host "Creating DNS resolver policy"
268+
$resolverPolicy = New-AzDnsResolverPolicy -Location $region -ResourceGroupName $resourceGroupName -Name $resolverPolicyName
269+
Write-Host $resolverPolicy.ToJsonString()
270+
271+
Write-Host "Creating DNS resolver policy virtual network link"
272+
$link = New-AzDnsResolverPolicyVirtualNetworkLink -Location $region -ResourceGroupName $resourceGroupName -DnsResolverPolicyName $resolverPolicyName -Name $resolverPolicyLinkName -VirtualNetworkId $vnetId
273+
Write-Host $link.ToJsonString()
274+
275+
$log = New-AzDiagnosticSettingLogSettingsObject -Enabled $true -Category DnsResponse
276+
277+
Write-Host "Creating diagnostic setting"
278+
$diagnosticSetting = New-AzDiagnosticSetting -Name $diagnosticSettingName -ResourceId $resolverPolicy.id -Log $log -StorageAccountId $storageAccount.id
279+
Write-Host $diagnosticSetting.ToJsonString()
280+
281+
Write-Host "Creating domain list"
282+
$domainList = New-AzDnsResolverDomainList -Location $region -ResourceGroupName $resourceGroupName -Name $domainListName -Domain @("contoso.com.", "example.com.")
283+
Write-Host $domainList.ToJsonString()
284+
285+
Write-Host "Creating DNS security policy rule"
286+
$rule = New-AzDnsResolverPolicyDnsSecurityRule -ResourceGroupName $resourceGroupName -Name $securityRuleName -DnsResolverDomainList @{id = $domainList.Id;} -DnsSecurityRuleState "Enabled" -ActionType "Block" -ActionBlockResponseCode "SERVFAIL" -Priority 100 -DnsResolverPolicyName $resolverPolicyName -Location $region
287+
Write-Host $rule.ToJsonString()
288+
```
289+
290+
6. Optional: Update DNS resolver policies with new values.
291+
292+
```PowerShell
293+
################################
294+
# Update DNS security policy
295+
################################
296+
297+
Write-Host "Updating DNS resolver policy"
298+
$resolverPolicy = Update-AzDnsResolverPolicy -ResourceGroupName $resourceGroupName -Name $resolverPolicyName -Tag @{"key0" = "value0"}
299+
Write-Host $resolverPolicy.ToJsonString()
300+
301+
Write-Host "Updating DNS resolver policy virtual network link"
302+
$link = Update-AzDnsResolverPolicyVirtualNetworkLink -ResourceGroupName $resourceGroupName -DnsResolverPolicyName $resolverPolicyName -Name $resolverPolicyLinkName -Tag @{"key1" = "value1"}
303+
Write-Host $link.ToJsonString()
304+
305+
$log = New-AzDiagnosticSettingLogSettingsObject -Enabled $false -Category DnsResponse
306+
307+
Write-Host "Updating diagnostic setting by disabling log category"
308+
$diagnosticSetting = New-AzDiagnosticSetting -Name $diagnosticSettingName -ResourceId $resolverPolicy.id -Log $log -StorageAccountId $storageAccount.id
309+
Write-Host $diagnosticSetting.ToJsonString()
310+
311+
Write-Host "Updating domain list"
312+
$domainList = Update-AzDnsResolverDomainList -ResourceGroupName $resourceGroupName -Name $domainListName -Tag @{"key2" = "value2"}
313+
Write-Host $domainList.ToJsonString()
314+
315+
Write-Host "Updating DNS security policy rule"
316+
$rule = Update-AzDnsResolverPolicyDnsSecurityRule -ResourceGroupName $resourceGroupName -Name $securityRuleName -DnsResolverDomainList @{id = $domainList.Id;} -DnsResolverPolicyName $resolverPolicyName
317+
Write-Host $rule.ToJsonString()
318+
```
319+
320+
7. Review the DNS security policy configuration.
321+
322+
```PowerShell
323+
################################
324+
# Get DNS security policy
325+
################################
326+
327+
Write-Host "Getting DNS resolver policy"
328+
$resolverPolicy = Get-AzDnsResolverPolicy -ResourceGroupName $resourceGroupName -Name $resolverPolicyName
329+
Write-Host $resolverPolicy.ToJsonString()
330+
331+
Write-Host "Getting DNS resolver policy virtual network link"
332+
$link = Get-AzDnsResolverPolicyVirtualNetworkLink -ResourceGroupName $resourceGroupName -DnsResolverPolicyName $resolverPolicyName -Name $resolverPolicyLinkName
333+
Write-Host $link.ToJsonString()
334+
335+
Write-Host "Getting diagnostic setting"
336+
$diagnosticSetting = Get-AzDiagnosticSetting -ResourceId $resolverPolicy.id
337+
Write-Host $diagnosticSetting.ToJsonString()
338+
339+
Write-Host "Getting domain list"
340+
$domainList = Get-AzDnsResolverDomainList -ResourceGroupName $resourceGroupName -Name $domainListName
341+
Write-Host $rule.ToJsonString()
259342
260-
Configuration for domain list and traffic rules is coming.
343+
Write-Host "Getting DNS security policy rule"
344+
$rule = Get-AzDnsResolverPolicyDnsSecurityRule -ResourceGroupName $resourceGroupName -Name $securityRuleName -DnsResolverPolicyName $resolverPolicyName
345+
Write-Host $rule.ToJsonString()
346+
```
261347
262348
---
263349

0 commit comments

Comments
 (0)