Skip to content

Commit 43f92d6

Browse files
mbender-msmbender-ms
committed
updated enforce to review draft
1 parent 9767f9e commit 43f92d6

File tree

2 files changed

+25
-19
lines changed

2 files changed

+25
-19
lines changed

‎articles/virtual-network-manager/automate-ip-address-management.md

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ author: mbender-ms
55
ms.author: mbender
66
ms.service: azure-virtual-network-manager
77
ms.topic: concept-article
8-
ms.date: 03/10/2023
8+
ms.date: 03/10/2025
99
ms.custom: template-concept
1010
---
1111

@@ -129,4 +129,7 @@ for ($i = 0; $i -lt @($vnetList).Count; $i++) {
129129
}
130130
Write-Output "Finished bulk association for existing VNets at: " (Get-Date).ToString("HH:mm:ss")
131131

132+
## Next steps
132133

134+
> [!div class="nextstepaction"]
135+
>

‎articles/virtual-network-manager/enforce-vnet-create-azure-policy.md

Lines changed: 21 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
title: Prevent overlapping VNet address spaces using Azure Policy and IPAM
2+
title: Prevent overlapping virtual network address spaces using Azure Policy and IPAM
33
description:
44
author: mbender-ms
55
ms.author: mbender
@@ -9,16 +9,11 @@ ms.date: 03/10/2023
99
ms.custom: template-concept
1010
---
1111

12-
# Prevent overlapping VNet address spaces using Azure Policy and IPAM
12+
# Prevent overlapping virtual network address spaces using Azure Policy and IPAM
1313

14-
Azure Virtual Network Manager helps you centrally manage virtual networks (VNets) across your organization. While it provides governance for VNets, it doesn't automatically prevent overlapping address spaces during VNet creation or updates. You can enforce non-overlapping address spaces by combining Azure Policy with IP Address Management (IPAM) pools, ensuring network connectivity without IP conflicts in your environment.
14+
Azure Virtual Network Manager helps you centrally manage virtual networks across your organization. While it provides governance for VNets, it doesn't automatically prevent overlapping address spaces during virtual network creation or updates. You can enforce nonoverlapping address spaces by combining [Azure Policy](../governance/policy/overview.md) with [IP Address Management (IPAM) pools](concept-ip-address-management.md#manage-ip-address-pools), ensuring network connectivity without IP conflicts in your environment.
1515

16-
 The following sample Azure policy definition ensures that any virtual network (Microsoft.Network/virtualNetworks) must have at least one IPAM pool prefix allocation from one of the two specified pools. If a virtual network lacks an allocation from either pool, the policy denies the deployment or update of that resource. This enforces VNets with only non-overlapped CIDRs can be created in the scope of this policy definition.
17-
18-
so the tutorial shows the policy definition
19-
20-
once this policy definition is applied to an Azure policy scope like subscription/management group, then it's enforced on the scope
21-
16+
The following sample Azure policy definition ensures that any virtual network (`Microsoft.Network/virtualNetworks`) in the scope of this policy definition must have one IPAM pool prefix allocation from one of the two specified pools. If a virtual network lacks an allocation from either pool, the policy denies the creation or update of a virtual network by enforcing the use of nonoverlapped classless inter-domain routing (CIDRs) addresses.
2217

2318
```json
2419
"mode": "All",
@@ -49,15 +44,15 @@ once this policy definition is applied to an Azure policy scope like subscriptio
4944

5045
                  "field": "Microsoft.Network/virtualnetworks/addressSpace.ipamPoolPrefixAllocations[*].pool.id",
5146

52-
                  "equals": "/subscriptions/c9295b92-3574-4021-95a1-26c8f74f8359/resourceGroups/ipam-test-rg/providers/Microsoft.Network/networkManagers/ipam-test-nm/ipamPools/paigePolicyTestPool2"
47+
                  "equals": "/subscriptions/<subscriptionID>/resourceGroups/<resourceGroupName>/providers/Microsoft.Network/networkManagers/network-manager/ipamPools/IPAM-pool-2"
5348

5449
                },
5550

5651
                {
5752

5853
                  "field": "Microsoft.Network/virtualnetworks/addressSpace.ipamPoolPrefixAllocations[*].pool.id",
5954

60-
                  "equals": "/subscriptions/c9295b92-3574-4021-95a1-26c8f74f8359/resourceGroups/ipam-test-rg/providers/Microsoft.Network/networkManagers/ipam-test-nm/ipamPools/paigePolicyTestPool3"
55+
                  "equals": "/subscriptions/subscriptionID/resourceGroups/<resourceGroupName>/providers/Microsoft.Network/networkManagers/network-manager/ipamPools/IPAM-pool-3"
6156

6257
                }
6358

@@ -80,17 +75,25 @@ once this policy definition is applied to an Azure policy scope like subscriptio
8075
    }
8176
```
8277

83-
This Azure Policy blocks the creation or update of a virtual network unless it includes an IPAM pool allocation from one of two approved pools. It works as follows:
78+
Included in the policy definition are the following actions:
8479

85-
Resource Check: It applies only to virtual networks (Microsoft.Network/virtualNetworks).
80+
- **Resource Check** - It applies only to virtual networks (`Microsoft.Network/virtualNetworks`).
81+
- **Pool Allocation Check** - It verifies if the virtual network has an IPAM pool allocation from either:
82+
- `IPAM-pool-2`, or
83+
- `IPAM-pool-3`.
84+
- **Enforcement** - If neither allocation is present, the policy denies the action. And in order to have pool allocation, IP prefixes must be nonoverlapped within the pool, as such no VNets with overlapped prefixes can be created.
85+
Resource Check: It applies only to virtual networks (`Microsoft.Network/virtualNetworks`).
8686

87-
Pool Allocation Check: It verifies if the virtual network has an IPAM pool allocation from either:
87+
## Implementation steps of the policy
8888

89-
paigePolicyTestPool2, or
89+
With the policy definition, you can enforce nonoverlapping address spaces in your Azure environment. Follow these steps to implement the policy:
9090

91-
paigePolicyTestPool3.
91+
1. **Identify existing network manager and IPAM pools** - Ensure you have an existing Azure Virtual Network Manager instance and at least two IPAM pools created. For more information, see [Create a virtual network manager](./create-virtual-network-manager-powershell.md) and [Create an IPAM pool](./how-to-manage-ip-addresses-network-manager.md).
92+
1. **Create an Azure Policy definition** - Create a policy definition in Azure Policy using the JSON example. You can do this through the Azure portal, Azure CLI, or PowerShell. For more information, see [Create and assign a policy definition](../governance/policy/tutorials/create-and-manage.md).
93+
2. **Assign the policy** - Assign the policy to a specific scope (subscription or management group) where you want to enforce the nonoverlapping address space rule.
94+
1. **Test the policy** - Create or update a virtual network without an IPAM pool allocation from the specified pools. The operation should be denied if the policy is working correctly.
9295

93-
Enforcement: If neither allocation is present, the policy denies the action. And in order to have pool allocation, IP prefixes must be non-overlapped within the pool, as such no VNets with overlapped prefixes can be created.
9496

9597
## Next steps
96-
- [Create a virtual network using Azure CLI](../quickstart-create-vnet-cli.md)
98+
> [!div class="nextstepaction"]
99+
> [Manage IP addresses with Azure Virtual Network Manager](./how-to-manage-ip-addresses-network-manager.md)

0 commit comments

Comments
 (0)