Skip to content

Commit 4995e90

Browse files
megvanhuygenmegvanhuygen
authored
Merge pull request #104746 from wesmc7777/mar13
New DPS content for March 13
2 parents 5f99651 + 413a581 commit 4995e90

9 files changed

+310
-0
lines changed

‎articles/iot-dps/iot-dps-ip-filtering.md

Lines changed: 257 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,257 @@
1+
---
2+
title: Azure IoT DPS IP connection filters | Microsoft Docs
3+
description: How to use IP filtering to block connections from specific IP addresses to your Azure IoT DPS instance. You can block connections from individual or ranges of IP addresses.
4+
author: wesmc7777
5+
ms.author: wesmc
6+
ms.service: iot-dps
7+
services: iot-dps
8+
ms.topic: conceptual
9+
ms.date: 03/12/2020
10+
---
11+
12+
# Use IP filters
13+
14+
Security is an important aspect of any IoT solution. Sometimes you need to explicitly specify the IP addresses from which devices can connect as part of your security configuration. The *IP filter* feature for an Azure IoT Hub Device Provisioning Service (DPS) enables you to configure rules for rejecting or accepting traffic from specific IPv4 addresses.
15+
16+
## When to use
17+
18+
There are two specific use-cases where it is useful to block connections to a DPS endpoint from certain IP addresses:
19+
20+
* Your DPS should receive traffic only from a specified range of IP addresses and reject everything else. For example, you are using your DPS with [Azure Express Route](https://azure.microsoft.com/documentation/articles/expressroute-faqs/#supported-services) to create private connections between a DPS and your devices.
21+
22+
* You need to reject traffic from IP addresses that have been identified as suspicious by the DPS administrator.
23+
24+
## How filter rules are applied
25+
26+
The IP filter rules are applied at the DPS instance level. Therefore the IP filter rules apply to all connections from devices and back-end apps using any supported protocol.
27+
28+
Any connection attempt from an IP address that matches a rejecting IP rule in your DPS instance receives an unauthorized 401 status code and description. The response message does not mention the IP rule.
29+
30+
## Default setting
31+
32+
By default, the **IP Filter** grid in the portal for DPS is empty. This default setting means that your DPS accepts connections from any IP address. This default setting is equivalent to a rule that accepts the 0.0.0.0/0 IP address range.
33+
34+
![IoT DPS default IP filter settings](./media/iot-dps-ip-filtering/ip-filter-default.png)
35+
36+
## Add or edit an IP filter rule
37+
38+
To add an IP filter rule, select **+ Add IP Filter Rule**.
39+
40+
![Add an IP filter rule to an IoT DPS](./media/iot-dps-ip-filtering/ip-filter-add-rule.png)
41+
42+
After selecting **Add IP Filter Rule**, fill in the fields.
43+
44+
![After selecting Add an IP Filter rule](./media/iot-dps-ip-filtering/ip-filter-after-selecting-add.png)
45+
46+
* Provide a **name** for the IP Filter rule. This must be a unique, case-insensitive, alphanumeric string up to 128 characters long. Only the ASCII 7-bit alphanumeric characters plus `{'-', ':', '/', '\', '.', '+', '%', '_', '#', '*', '?', '!', '(', ')', ',', '=', '@', ';', '''}` are accepted.
47+
48+
* Provide a single IPv4 address or a block of IP addresses in CIDR notation. For example, in CIDR notation 192.168.100.0/22 represents the 1024 IPv4 addresses from 192.168.100.0 to 192.168.103.255.
49+
50+
* Select **Allow** or **Block** as the **action** for the IP filter rule.
51+
52+
After filling in the fields, select **Save** to save the rule. You see an alert notifying you that the update is in progress.
53+
54+
![Notification about saving an IP filter rule](./media/iot-dps-ip-filtering/ip-filter-save-new-rule.png)
55+
56+
The **Add** option is disabled when you reach the maximum of 10 IP filter rules.
57+
58+
To edit an existing rule, select the data you want to change, make the change, then select **Save** to save your edit.
59+
60+
> [!NOTE]
61+
> Rejecting IP addresses can prevent other Azure Services from interacting with the DPS instance.
62+
63+
## Delete an IP filter rule
64+
65+
To delete an IP filter rule, select the trash can icon on that row and then select **Save**. The rule is removed and the change is saved.
66+
67+
![Delete an IoT DPS IP filter rule](./media/iot-dps-ip-filtering/ip-filter-delete-rule.png)
68+
69+
70+
## Update IP filter rules in code
71+
72+
You may retrieve and modify your DPS IP filter using Azure resource Provider's REST endpoint. See `properties.ipFilterRules` in [createorupdate method](https://docs.microsoft.com/rest/api/iot-dps/iotdpsresource/createorupdate).
73+
74+
Updating DPS IP filter rules is not currently supported with Azure CLI or Azure PowerShell but, can be accomplished with Azure Resource Manager templates. See, [Azure Resource Manager templates](../azure-resource-manager/templates/overview.md) for guidance on using Resource Manager templates. The template examples that follow show how to create, edit, and delete DPS IP filter rules.
75+
76+
### Add an IP filter rule
77+
78+
The following template example creates a new IP filter rule named "AllowAll" that accepts all traffic.
79+
80+
```json
81+
{
82+
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
83+
"contentVersion": "1.0.0.0",
84+
"parameters": {
85+
"iotDpsName": {
86+
"type": "string",
87+
"defaultValue": "[resourceGroup().name]",
88+
"minLength": 3,
89+
"metadata": {
90+
"description": "Specifies the name of the IoT DPS service."
91+
}
92+
},
93+
"location": {
94+
"type": "string",
95+
"defaultValue": "[resourceGroup().location]",
96+
"metadata": {
97+
"description": "Location for Iot DPS resource."
98+
}
99+
}
100+
},
101+
"variables": {
102+
"iotDpsApiVersion": "2020-01-01"
103+
},
104+
"resources": [
105+
{
106+
"type": "Microsoft.Devices/provisioningServices",
107+
"apiVersion": "[variables('iotDpsApiVersion')]",
108+
"name": "[parameters('iotDpsName')]",
109+
"location": "[parameters('location')]",
110+
"sku": {
111+
"name": "S1",
112+
"tier": "Standard",
113+
"capacity": 1
114+
},
115+
"properties": {
116+
"IpFilterRules": [
117+
{
118+
"FilterName": "AllowAll",
119+
"Action": "Accept",
120+
"ipMask": "0.0.0.0/0"
121+
}
122+
]
123+
}
124+
}
125+
]
126+
}
127+
```
128+
129+
Update the IP filter rule attributes of the template based on your requirements.
130+
131+
| Attribute | Description |
132+
| ------------------------ | ----------- |
133+
| **FilterName** | Provide a name for the IP Filter rule. This must be a unique, case-insensitive, alphanumeric string up to 128 characters long. Only the ASCII 7-bit alphanumeric characters plus {'-', ':', '/', '\', '.', '+', '%', '_', '#', '*', '?', '!', '(', ')', ',', '=', '@', ';', '''} are accepted. |
134+
| **Action** | Accepted values are **Accept** or **Reject** as the action for the IP filter rule. |
135+
| **ipMask** | Provide a single IPv4 address or a block of IP addresses in CIDR notation. For example, in CIDR notation 192.168.100.0/22 represents the 1024 IPv4 addresses from 192.168.100.0 to 192.168.103.255. |
136+
137+
138+
### Update an IP filter rule
139+
140+
The following template example updates the IP filter rule named "AllowAll", shown previously, to reject all traffic.
141+
142+
```json
143+
{
144+
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", 
145+
    "contentVersion": "1.0.0.0", 
146+
    "parameters": {
147+
        "iotDpsName": {
148+
            "type": "string",
149+
            "defaultValue": "[resourceGroup().name]",
150+
            "minLength": 3,
151+
            "metadata": {
152+
                "description": "Specifies the name of the IoT DPS service."
153+
            }
154+
        }, 
155+
        "location": {
156+
            "type": "string",
157+
            "defaultValue": "[resourceGroup().location]",
158+
            "metadata": {
159+
                "description": "Location for Iot DPS resource."
160+
            }
161+
        }       
162+
    }, 
163+
    "variables": {
164+
        "iotDpsApiVersion": "2020-01-01"
165+
    }, 
166+
    "resources": [
167+
        {
168+
            "type": "Microsoft.Devices/provisioningServices",
169+
            "apiVersion": "[variables('iotDpsApiVersion')]",
170+
            "name": "[parameters('iotDpsName')]",
171+
            "location": "[parameters('location')]",
172+
            "sku": {
173+
                "name": "S1",
174+
                "tier": "Standard",
175+
                "capacity": 1
176+
            },
177+
            "properties": {
178+
                "IpFilterRules": [
179+
                    {
180+
                        "FilterName": "AllowAll",
181+
                        "Action": "Reject",
182+
                        "ipMask": "0.0.0.0/0"
183+
                    }
184+
                ]
185+
            }            
186+
        }
187+
    ]
188+
}
189+
```
190+
191+
### Delete an IP filter rule
192+
193+
The following template example deletes all IP filter rules for the DPS instance.
194+
195+
```json
196+
{
197+
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", 
198+
    "contentVersion": "1.0.0.0", 
199+
    "parameters": {
200+
        "iotDpsName": {
201+
            "type": "string",
202+
            "defaultValue": "[resourceGroup().name]",
203+
            "minLength": 3,
204+
            "metadata": {
205+
                "description": "Specifies the name of the IoT DPS service."
206+
            }
207+
        }, 
208+
        "location": {
209+
            "type": "string",
210+
            "defaultValue": "[resourceGroup().location]",
211+
            "metadata": {
212+
                "description": "Location for Iot DPS resource."
213+
            }
214+
        }       
215+
    }, 
216+
    "variables": {
217+
        "iotDpsApiVersion": "2020-01-01"
218+
    }, 
219+
    "resources": [
220+
        {
221+
            "type": "Microsoft.Devices/provisioningServices",
222+
            "apiVersion": "[variables('iotDpsApiVersion')]",
223+
            "name": "[parameters('iotDpsName')]",
224+
            "location": "[parameters('location')]",
225+
            "sku": {
226+
                "name": "S1",
227+
                "tier": "Standard",
228+
                "capacity": 1
229+
            },
230+
            "properties": {
231+
            }            
232+
        }
233+
    ]
234+
}
235+
```
236+
237+
238+
239+
## IP filter rule evaluation
240+
241+
IP filter rules are applied in order and the first rule that matches the IP address determines the accept or reject action.
242+
243+
For example, if you want to accept addresses in the range 192.168.100.0/22 and reject everything else, the first rule in the grid should accept the address range 192.168.100.0/22. The next rule should reject all addresses by using the range 0.0.0.0/0.
244+
245+
You can change the order of your IP filter rules in the grid by clicking the three vertical dots at the start of a row and using drag and drop.
246+
247+
To save your new IP filter rule order, click **Save**.
248+
249+
![Change the order of your DPS IP filter rules](./media/iot-dps-ip-filtering/ip-filter-rule-order.png)
250+
251+
## Next steps
252+
253+
To further explore the managing DPS, see:
254+
255+
* [Understanding IoT DPS IP addresses](iot-dps-understand-ip-address.md)
256+
* [Configure DPS using the Azure CLI](how-to-manage-dps-with-cli.md)
257+
* [Control access to DPS](how-to-control-access.md)

‎articles/iot-dps/iot-dps-understand-ip-address.md

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
---
2+
title: Understanding the IP address of your IoT Device Provisioning Service (DPS) instance | Microsoft Docs
3+
description: Understand how to query your IoT Device Provisioning Service (DPS) address and its properties. The IP address of your DPS instance can change during certain scenarios such as disaster recovery or regional failover.
4+
author: wesmc7777
5+
ms.author: wesmc
6+
ms.service: iot-dps
7+
services: iot-dps
8+
ms.topic: conceptual
9+
ms.date: 03/12/2020
10+
---
11+
12+
# IoT Hub DPS IP addresses
13+
14+
The IP address prefixes for the public endpoints of an IoT Hub Device Provisioning Service (DPS) are published periodically under the _AzureIoTHub_ [service tag](../virtual-network/service-tags-overview.md). You may use these IP address prefixes to control connectivity between an IoT DPS instance and devices or network assets in order to implement a variety of network isolation goals:
15+
16+
| Goal | Approach |
17+
|------|----------|
18+
| Ensure your devices and services communicate with IoT Hub DPS endpoints only | Use the _AzureIoTHub_ service tag to discover IoT Hub DPS instances. Configure ALLOW rules on your devices' and services' firewall setting for those IP address prefixes accordingly. Configure rules to drop traffic to other destination IP addresses that you do not want devices or services to communicate with. |
19+
| Ensure your IoT Hub DPS endpoint receives connections only from your devices and network assets | Use IoT DPS [IP filter feature](iot-dps-ip-filtering.md) to create filter rules for the device and DPS service APIs. These filter rules can be used to allow connections only from your devices and network asset IP addresses (see [limitations](#limitations-and-workarounds) section). |
20+
21+
22+
23+
24+
## Best practices
25+
26+
* When adding ALLOW rules in your devices' firewall configuration, it is best to provide specific [ports used by applicable protocols](../iot-hub/iot-hub-devguide-protocols.md#port-numbers).
27+
28+
* The IP address prefixes of IoT DPS instances are subject to change. These changes are published periodically via service tags before taking effect. It is therefore important that you develop processes to regularly retrieve and use the latest service tags. This process can be automated via the [service tags discovery API](../virtual-network/service-tags-overview.md#service-tags-on-premises). The Service tags discovery API is still in preview and in some cases may not produce the full list of tags and IP addresses. Until discovery API is generally available, consider using the [service tags in downloadable JSON format](../virtual-network/service-tags-overview.md#discover-service-tags-by-using-downloadable-json-files).
29+
30+
* Use the *AzureIoTHub.[region name]* tag to identify IP prefixes used by DPS endpoints in a specific region. To account for datacenter disaster recovery, or [regional failover](../iot-hub/iot-hub-ha-dr.md), ensure connectivity to IP prefixes of your DPS instance's geo-pair region is also enabled.
31+
32+
* Setting up firewall rules for a DPS instance may block off connectivity needed to run Azure CLI and PowerShell commands against it. To avoid these connectivity issues, you can add ALLOW rules for your clients' IP address prefixes to re-enable CLI or PowerShell clients to communicate with your DPS instance.
33+
34+
35+
## Limitations and workarounds
36+
37+
* The DPS IP filter feature has a limit of 100 rules. This limit and can be raised via requests through Azure Customer Support.
38+
39+
* Your configured [IP filtering rules](iot-dps-ip-filtering.md) are only applied on your DPS endpoints and not on the linked IoT Hub endpoints. IP filtering for linked IoT Hubs must be configured separately. For more information, see, [IoT Hub IP filtering rules](../iot-hub/iot-hub-ip-filtering.md).
40+
41+
## Support for IPv6
42+
43+
IPv6 is currently not supported on IoT Hub or DPS.
44+
45+
## Next steps
46+
47+
To learn more about IP address configurations with DPS, see:
48+
49+
* [Configure IP filtering](iot-dps-ip-filtering.md)

‎articles/iot-dps/media/iot-dps-ip-filtering/ip-filter-add-rule.png

7.61 KB
Loading

‎articles/iot-dps/media/iot-dps-ip-filtering/ip-filter-after-selecting-add.png

14.1 KB
Loading

‎articles/iot-dps/media/iot-dps-ip-filtering/ip-filter-default.png

19.5 KB
Loading

‎articles/iot-dps/media/iot-dps-ip-filtering/ip-filter-delete-rule.png

13.7 KB
Loading

‎articles/iot-dps/media/iot-dps-ip-filtering/ip-filter-rule-order.png

17.1 KB
Loading

‎articles/iot-dps/media/iot-dps-ip-filtering/ip-filter-save-new-rule.png

15.2 KB
Loading

‎articles/iot-dps/toc.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,8 @@
9797
href: concepts-security.md
9898
- name: Service
9999
href: concepts-service.md
100+
- name: Understanding DPS IP addresses
101+
href: iot-dps-understand-ip-address.md
100102
- name: TPM attestation
101103
href: concepts-tpm-attestation.md
102104
- name: Symmetric key attestation
@@ -127,6 +129,8 @@
127129
href: how-to-manage-dps-with-cli.md
128130
- name: Control access to Provisioning Service APIs
129131
href: how-to-control-access.md
132+
- name: Configure IP filtering
133+
href: iot-dps-ip-filtering.md
130134
- name: Provision IoT Edge devices
131135
items:
132136
- name: Linux

0 commit comments

Comments
 (0)