Skip to content

Commit 3774d27

Browse files
Maggiemouse1Maggiemouse1
authored
Merge pull request #198135 from asudbring/pe-static-ip-posh
Create a private endpoint with a static IP article - PowerShell
2 parents 0f5404d + 897fedd commit 3774d27

File tree

3 files changed

+307
-0
lines changed

3 files changed

+307
-0
lines changed

‎articles/private-link/media/private-endpoint-static-ip-powershell/web-app-default-page.png

126 KB
Loading

‎articles/private-link/private-endpoint-static-ip-powershell.md

Lines changed: 303 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,303 @@
1+
---
2+
title: Create a private endpoint with a static IP address - PowerShell
3+
titleSuffix: Azure Private Link
4+
description: Learn how to create a private endpoint for an Azure service with a static private IP address.
5+
author: asudbring
6+
ms.author: allensu
7+
ms.service: private-link
8+
ms.topic: how-to
9+
ms.date: 05/13/2022
10+
ms.custom:
11+
---
12+
13+
# Create a private endpoint with a static IP address using PowerShell
14+
15+
A private endpoint IP address is allocated by DHCP in your virtual network by default. In this article, you'll create a private endpoint with a static IP address.
16+
17+
## Prerequisites
18+
19+
- An Azure account with an active subscription. If you don't already have an Azure account, [create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
20+
21+
- An Azure web app with a **PremiumV2-tier** or higher app service plan, deployed in your Azure subscription.
22+
23+
- For more information and an example, see [Quickstart: Create an ASP.NET Core web app in Azure](../app-service/quickstart-dotnetcore.md).
24+
25+
- The example webapp in this article is named **myWebApp1979**. Replace the example with your webapp name.
26+
27+
If you choose to install and use PowerShell locally, this article requires the Azure PowerShell module version 5.4.1 or later. To find the installed version, run `Get-Module -ListAvailable Az`. If you need to upgrade, see [Install the Azure PowerShell module](/powershell/azure/install-Az-ps). If you're running PowerShell locally, you also need to run `Connect-AzAccount` to create a connection with Azure.
28+
29+
## Create a resource group
30+
31+
An Azure resource group is a logical container where Azure resources are deployed and managed.
32+
33+
Create a resource group with [New-AzResourceGroup](/powershell/module/az.resources/new-azresourcegroup):
34+
35+
```azurepowershell-interactive
36+
New-AzResourceGroup -Name 'myResourceGroup' -Location 'eastus'
37+
```
38+
39+
## Create a virtual network and bastion host
40+
41+
A virtual network and subnet is required for to host the private IP address for the private endpoint. You'll create a bastion host to connect securely to the virtual machine to test the private endpoint. You'll create the virtual machine in a later section.
42+
43+
In this section, you'll:
44+
45+
- Create a virtual network with [New-AzVirtualNetwork](/powershell/module/az.network/new-azvirtualnetwork)
46+
47+
- Create subnet configurations for the backend subnet and the bastion subnet with [New-AzVirtualNetworkSubnetConfig](/powershell/module/az.network/new-azvirtualnetworksubnetconfig)
48+
49+
- Create a public IP address for the bastion host with [New-AzPublicIpAddress](/powershell/module/az.network/new-azpublicipaddress)
50+
51+
- Create the bastion host with [New-AzBastion](/powershell/module/az.network/new-azbastion)
52+
53+
```azurepowershell-interactive
54+
## Configure the back-end subnet. ##
55+
$subnetConfig = New-AzVirtualNetworkSubnetConfig -Name myBackendSubnet -AddressPrefix 10.0.0.0/24
56+
57+
## Create the Azure Bastion subnet. ##
58+
$bastsubnetConfig = New-AzVirtualNetworkSubnetConfig -Name AzureBastionSubnet -AddressPrefix 10.0.1.0/24
59+
60+
## Create the virtual network. ##
61+
$net = @{
62+
Name = 'MyVNet'
63+
ResourceGroupName = 'myResourceGroup'
64+
Location = 'eastus'
65+
AddressPrefix = '10.0.0.0/16'
66+
Subnet = $subnetConfig, $bastsubnetConfig
67+
}
68+
$vnet = New-AzVirtualNetwork @net
69+
70+
## Create the public IP address for the bastion host. ##
71+
$ip = @{
72+
Name = 'myBastionIP'
73+
ResourceGroupName = 'myResourceGroup'
74+
Location = 'eastus'
75+
Sku = 'Standard'
76+
AllocationMethod = 'Static'
77+
Zone = 1,2,3
78+
}
79+
$publicip = New-AzPublicIpAddress @ip
80+
81+
## Create the bastion host. ##
82+
$bastion = @{
83+
ResourceGroupName = 'myResourceGroup'
84+
Name = 'myBastion'
85+
PublicIpAddress = $publicip
86+
VirtualNetwork = $vnet
87+
}
88+
New-AzBastion @bastion -AsJob
89+
```
90+
91+
## Create a private endpoint
92+
93+
An Azure service that supports private endpoints is required to setup the private endpoint and connection to the virtual network. For the examples in this article, we are using an Azure WebApp from the prerequisites. For more information on the Azure services that support a private endpoint, see [Azure Private Link availability](availability.md).
94+
95+
> [!IMPORTANT]
96+
> You must have a previously deployed Azure WebApp to proceed with the steps in this article. See [Prerequisites](#prerequisites) for more information.
97+
98+
In this section, you'll:
99+
100+
- Create a private link service connection with [New-AzPrivateLinkServiceConnection](/powershell/module/az.network/new-azprivatelinkserviceconnection).
101+
102+
- Create the private endpoint static IP configuration with [New-AzPrivateEndpointIpConfiguration](/powershell/module/az.network/new-azprivateendpointipconfiguration).
103+
104+
- Create the private endpoint with [New-AzPrivateEndpoint](/powershell/module/az.network/new-azprivateendpoint).
105+
106+
```azurepowershell-interactive
107+
## Place the previously created webapp into a variable. ##
108+
$webapp = Get-AzWebApp -ResourceGroupName myResourceGroup -Name myWebApp1979
109+
110+
## Create the private endpoint connection. ##
111+
$pec = @{
112+
Name = 'myConnection'
113+
PrivateLinkServiceId = $webapp.ID
114+
GroupID = 'sites'
115+
}
116+
$privateEndpointConnection = New-AzPrivateLinkServiceConnection @pec
117+
118+
## Place the virtual network you created previously into a variable. ##
119+
$vnet = Get-AzVirtualNetwork -ResourceGroupName 'myResourceGroup' -Name 'myVNet'
120+
121+
## Disable the private endpoint network policy. ##
122+
$vnet.Subnets[0].PrivateEndpointNetworkPolicies = "Disabled"
123+
$vnet | Set-AzVirtualNetwork
124+
125+
## Create the static IP configuration. ##
126+
$ip = @{
127+
Name = 'myIPconfig'
128+
GroupId = 'sites'
129+
MemberName = 'sites'
130+
PrivateIPAddress = '10.0.0.10'
131+
}
132+
$ipconfig = New-AzPrivateEndpointIpConfiguration @ip
133+
134+
## Create the private endpoint. ##
135+
$pe = @{
136+
ResourceGroupName = 'myResourceGroup'
137+
Name = 'myPrivateEndpoint'
138+
Location = 'eastus'
139+
Subnet = $vnet.Subnets[0]
140+
PrivateLinkServiceConnection = $privateEndpointConnection
141+
IpConfiguration = $ipconfig
142+
}
143+
New-AzPrivateEndpoint @pe
144+
145+
```
146+
147+
## Configure the private DNS zone
148+
149+
A private DNS zone is used to resolve the DNS name of the private endpoint in the virtual network. For this example, we are using the DNS information for an Azure WebApp, for more information on the DNS configuration of private endpoints, see [Azure Private Endpoint DNS configuration](private-endpoint-dns.md)].
150+
151+
In this section, you'll:
152+
153+
- Create a new private Azure DNS zone with [New-AzPrivateDnsZone](/powershell/module/az.privatedns/new-azprivatednszone)
154+
155+
- Link the DNS zone to the virtual network you created previously with [New-AzPrivateDnsVirtualNetworkLink](/powershell/module/az.privatedns/new-azprivatednsvirtualnetworklink)
156+
157+
- Create a DNS zone configuration with [New-AzPrivateDnsZoneConfig](/powershell/module/az.network/new-azprivatednszoneconfig)
158+
159+
- Create a DNS zone group with [New-AzPrivateDnsZoneGroup](/powershell/module/az.network/new-azprivatednszonegroup)
160+
161+
```azurepowershell-interactive
162+
## Place the virtual network into a variable. ##
163+
$vnet = Get-AzVirtualNetwork -ResourceGroupName 'myResourceGroup' -Name 'myVNet'
164+
165+
## Create the private DNS zone. ##
166+
$zn = @{
167+
ResourceGroupName = 'myResourceGroup'
168+
Name = 'privatelink.azurewebsites.net'
169+
}
170+
$zone = New-AzPrivateDnsZone @zn
171+
172+
## Create a DNS network link. ##
173+
$lk = @{
174+
ResourceGroupName = 'myResourceGroup'
175+
ZoneName = 'privatelink.azurewebsites.net'
176+
Name = 'myLink'
177+
VirtualNetworkId = $vnet.Id
178+
}
179+
$link = New-AzPrivateDnsVirtualNetworkLink @lk
180+
181+
## Configure the DNS zone. ##
182+
$cg = @{
183+
Name = 'privatelink.azurewebsites.net'
184+
PrivateDnsZoneId = $zone.ResourceId
185+
}
186+
$config = New-AzPrivateDnsZoneConfig @cg
187+
188+
## Create the DNS zone group. ##
189+
$zg = @{
190+
ResourceGroupName = 'myResourceGroup'
191+
PrivateEndpointName = 'myPrivateEndpoint'
192+
Name = 'myZoneGroup'
193+
PrivateDnsZoneConfig = $config
194+
}
195+
New-AzPrivateDnsZoneGroup @zg
196+
197+
```
198+
199+
## Create a test virtual machine
200+
201+
To verify the static IP address and the functionality of the private endpoint, a test virtual machine connected to your virtual network is required.
202+
203+
In this section, you'll:
204+
205+
- Create a login credential for the virtual machine with [Get-Credential](/powershell/module/microsoft.powershell.security/get-credential)
206+
207+
- Create a network interface for the virtual machine with [New-AzNetworkInterface](/powershell/module/az.network/new-aznetworkinterface)
208+
209+
- Create a virtual machine configuration with [New-AzVMConfig](/powershell/module/az.compute/new-azvmconfig), [Set-AzVMOperatingSystem](/powershell/module/az.compute/set-azvmoperatingsystem), [Set-AzVMSourceImage](/powershell/module/az.compute/set-azvmsourceimage), and [Add-AzVMNetworkInterface](/powershell/module/az.compute/add-azvmnetworkinterface)
210+
211+
- Create the virtual machine with [New-AzVM](/powershell/module/az.compute/new-azvm)
212+
213+
```azurepowershell-interactive
214+
## Create the credential for the virtual machine. Enter a username and password at the prompt. ##
215+
$cred = Get-Credential
216+
217+
## Place the virtual network into a variable. ##
218+
$vnet = Get-AzVirtualNetwork -Name myVNet -ResourceGroupName myResourceGroup
219+
220+
## Create a network interface for the virtual machine. ##
221+
$nic = @{
222+
Name = 'myNicVM'
223+
ResourceGroupName = 'myResourceGroup'
224+
Location = 'eastus'
225+
Subnet = $vnet.Subnets[0]
226+
}
227+
$nicVM = New-AzNetworkInterface @nic
228+
229+
## Create the configuration for the virtual machine. ##
230+
$vm1 = @{
231+
VMName = 'myVM'
232+
VMSize = 'Standard_DS1_v2'
233+
}
234+
$vm2 = @{
235+
ComputerName = 'myVM'
236+
Credential = $cred
237+
}
238+
$vm3 = @{
239+
PublisherName = 'MicrosoftWindowsServer'
240+
Offer = 'WindowsServer'
241+
Skus = '2019-Datacenter'
242+
Version = 'latest'
243+
}
244+
$vmConfig =
245+
New-AzVMConfig @vm1 | Set-AzVMOperatingSystem -Windows @vm2 | Set-AzVMSourceImage @vm3 | Add-AzVMNetworkInterface -Id $nicVM.Id
246+
247+
## Create the virtual machine. ##
248+
New-AzVM -ResourceGroupName 'myResourceGroup' -Location 'eastus' -VM $vmConfig
249+
250+
```
251+
252+
[!INCLUDE [ephemeral-ip-note.md](../../includes/ephemeral-ip-note.md)]
253+
254+
## Test connectivity with the private endpoint
255+
256+
Use the VM you created in the previous step to connect to the webapp across the private endpoint.
257+
258+
1. Sign in to the [Azure portal](https://portal.azure.com).
259+
260+
2. In the search box at the top of the portal, enter **Virtual machine**. Select **Virtual machines**.
261+
262+
3. Select **myVM**.
263+
264+
4. On the overview page for **myVM**, select **Connect**, and then select **Bastion**.
265+
266+
5. Enter the username and password that you used when you created the VM. Select **Connect**.
267+
268+
6. After you've connected, open PowerShell on the server.
269+
270+
7. Enter `nslookup mywebapp1979.azurewebsites.net`. Replace **mywebapp1979** with the name of the web app that you created earlier. You'll receive a message that's similar to the following:
271+
272+
```powershell
273+
Server: UnKnown
274+
Address: 168.63.129.16
275+
276+
Non-authoritative answer:
277+
Name: mywebapp1979.privatelink.azurewebsites.net
278+
Address: 10.0.0.10
279+
Aliases: mywebapp1979.azurewebsites.net
280+
```
281+
282+
A static private IP address of *10.0.0.10* is returned for the web app name.
283+
284+
8. In the bastion connection to **myVM**, open the web browser.
285+
286+
9. Enter the URL of your web app, **https://mywebapp1979.azurewebsites.net**.
287+
288+
If your web app hasn't been deployed, you'll get the following default web app page:
289+
290+
:::image type="content" source="./media/private-endpoint-static-ip-powershell/web-app-default-page.png" alt-text="Screenshot of the default web app page on a browser." border="true":::
291+
292+
10. Close the connection to **myVM**.
293+
294+
## Next steps
295+
296+
To learn more about Private Link and Private endpoints, see
297+
298+
- [What is Azure Private Link](private-link-overview.md)
299+
300+
- [Private endpoint overview](private-endpoint-overview.md)
301+
302+
303+

‎articles/private-link/toc.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,10 @@
6565
href: /security/benchmark/azure/baselines/private-link-security-baseline?toc=/azure/private-link/toc.json
6666
- name: How-to
6767
items:
68+
- name: Private endpoint with static IP address
69+
items:
70+
- name: PowerShell
71+
href: private-endpoint-static-ip-powershell.md
6872
- name: Export private endpoint DNS records
6973
href: private-endpoint-export-dns.md
7074
- name: Manage network policies for private endpoints

0 commit comments

Comments
 (0)