Skip to content

Commit 56dc7eb

Browse files
huypubhuypub
authored
Merge pull request #243955 from MicrosoftDocs/release-vnet-encryption
Release vnet encryption --scheduled release at 4AM of 7/06
2 parents d353d7a + bfd3166 commit 56dc7eb

9 files changed

+424
-0
lines changed

‎articles/virtual-network/how-to-create-encryption-cli.md

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
---
2+
title: Create a virtual network with encryption - Azure CLI
3+
titleSuffix: Azure Virtual Network
4+
description: Learn how to create an encrypted virtual network using the Azure CLI. A virtual network lets Azure resources communicate with each other and with the internet.
5+
author: asudbring
6+
ms.service: virtual-network
7+
ms.topic: how-to
8+
ms.date: 05/24/2023
9+
ms.author: allensu
10+
11+
---
12+
13+
# Create a virtual network with encryption using the Azure CLI
14+
15+
Azure Virtual Network encryption is a feature of Azure Virtual Network. Virtual network encryption allows you to seamlessly encrypt and decrypt internal network traffic over the wire, with minimal effect to performance and scale. Azure Virtual Network encryption protects data traversing your virtual network virtual machine to virtual machine and virtual machine to on-premises.
16+
17+
## Prerequisites
18+
19+
- An Azure account with an active subscription. [Create one for free](https://azure.microsoft.com/free/?ref=microsoft.com&utm_source=microsoft.com&utm_medium=docs&utm_campaign=visualstudio).
20+
21+
[!INCLUDE [azure-cli-prepare-your-environment-no-header.md](~/articles/reusable-content/azure-cli/azure-cli-prepare-your-environment-no-header.md)]
22+
23+
- The how-to article requires version 2.31.0 or later of the Azure CLI. If using Azure Cloud Shell, the latest version is already installed.
24+
25+
## Create a resource group
26+
27+
An Azure resource group is a logical container into which Azure resources are deployed and managed.
28+
29+
Create a resource group with [az group create](/cli/azure/group#az-group-create) named **test-rg** in the **eastus2** location.
30+
31+
```azurecli-interactive
32+
az group create \
33+
--name test-rg \
34+
--location eastus2
35+
```
36+
37+
## Create a virtual network
38+
39+
In this section, you create a virtual network and enable virtual network encryption.
40+
41+
Use [az network vnet create](/cli/azure/network/vnet#az-network-vnet-create) to create a virtual network.
42+
43+
```azurecli-interactive
44+
az network vnet create \
45+
--resource-group test-rg \
46+
--location eastus2 \
47+
--name vnet-1 \
48+
--enable-encryption true \
49+
--encryption-enforcement-policy allowUnencrypted \
50+
--address-prefixes 10.0.0.0/16 \
51+
--subnet-name subnet-1 \
52+
--subnet-prefixes 10.0.0.0/24
53+
```
54+
55+
> [!IMPORTANT]
56+
> Azure Virtual Network encryption requires supported virtual machine SKUs in the virtual network for traffic to be encrypted. For more information, see [Azure Virtual Network encryption requirements](virtual-network-encryption-overview.md#requirements).
57+
58+
## Verify encryption enabled
59+
60+
You can check the encryption parameter in the virtual network to verify that encryption is enabled on the virtual network.
61+
62+
Use [az network vnet show](/cli/azure/network/vnet#az-network-vnet-show) to view the encryption parameter for the virtual network you created previously.
63+
64+
```azurecli-interactive
65+
az network vnet show \
66+
--resource-group test-rg \
67+
--name vnet-1 \
68+
--query encryption \
69+
--output tsv
70+
```
71+
72+
```output
73+
user@Azure:~$ az network vnet show \
74+
--resource-group test-rg \
75+
--name vnet-1 \
76+
--query encryption \
77+
--output tsv
78+
True AllowUnencrypted
79+
```
80+
81+
## Clean up resources
82+
83+
When you're done with the virtual network, use [az group delete](/cli/azure/group#az-group-delete) to remove the resource group and all its resources.
84+
85+
```azurecli-interactive
86+
az group delete \
87+
--name test-rg \
88+
--yes
89+
```
90+
91+
## Next steps
92+
93+
- For more information about Azure Virtual Networks, see [What is Azure Virtual Network?](/azure/virtual-network/virtual-networks-overview).
94+
95+
- For more information about Azure Virtual Network encryption, see [What is Azure Virtual Network encryption?](virtual-network-encryption-overview.md).

‎articles/virtual-network/how-to-create-encryption-portal.md

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
---
2+
title: Create a virtual network with encryption - Azure portal
3+
titleSuffix: Azure Virtual Network
4+
description: Learn how to create an encrypted virtual network using the Azure portal. A virtual network lets Azure resources communicate with each other and with the internet.
5+
author: asudbring
6+
ms.service: virtual-network
7+
ms.topic: how-to
8+
ms.date: 07/07/2023
9+
ms.author: allensu
10+
11+
---
12+
13+
# Create a virtual network with encryption using the Azure portal
14+
15+
Azure Virtual Network encryption is a feature of Azure Virtual Network. Virtual network encryption allows you to seamlessly encrypt and decrypt internal network traffic over the wire, with minimal effect to performance and scale. Azure Virtual Network encryption protects data traversing your virtual network virtual machine to virtual machine and virtual machine to on-premises.
16+
17+
## Prerequisites
18+
19+
- An Azure account with an active subscription. [Create one for free](https://azure.microsoft.com/free/?ref=microsoft.com&utm_source=microsoft.com&utm_medium=docs&utm_campaign=visualstudio).
20+
21+
## Create a virtual network
22+
23+
In this section, you create a virtual network and enable virtual network encryption.
24+
25+
1. Sign in to the [Azure portal](https://portal.azure.com/).
26+
27+
1. In the search box at the top of the portal, begin typing **Virtual networks**. When **Virtual networks** appears in the search results, select it.
28+
29+
1. In **Virtual networks**, select **+ Create**.
30+
31+
1. Enter or select the following information in the **Basics** tab of **Create virtual network**:
32+
33+
| Setting | Value |
34+
| ------- | ----- |
35+
| **Project details** | |
36+
| **Subscription** | Select your subscription. |
37+
| **Resource group** | Select **Create new**, then enter **test-rg** in **Name**. Select **OK**. |
38+
| **Instance details** | |
39+
| Virtual network name | Enter **vnet-1**. |
40+
| Region | Select **(US) East US 2**. |
41+
42+
1. Select **Review + create**.
43+
44+
1. Select **Create**.
45+
46+
> [!IMPORTANT]
47+
> Azure Virtual Network encryption requires supported virtual machine SKUs in the virtual network for traffic to be encrypted. The setting **dropUnencrypted** will drop traffic between unsupported virtual machine SKUs if they are deployed in the virtual network. For more information, see [Azure Virtual Network encryption requirements](virtual-network-encryption-overview.md#requirements).
48+
49+
## Enable encryption
50+
51+
1. In the search box at the top of the portal, begin typing **Virtual networks**. When **Virtual networks** appears in the search results, select it.
52+
53+
1. Select **vnet-1**.
54+
55+
1. In the **Overview** of **vnet-1**, select the **Properties** tab.
56+
57+
1. Select **Disabled** next to **Encryption**:
58+
59+
:::image type="content" source="./media/how-to-create-encryption-portal/virtual-network-properties.png" alt-text="Screenshot of properties of the virtual network.":::
60+
61+
1. Select the box next to **Virtual network encryption**.
62+
63+
1. Select **Save**.
64+
65+
## Verify encryption enabled
66+
67+
1. In the search box at the top of the portal, begin typing **Virtual networks**. When **Virtual networks** appears in the search results, select it.
68+
69+
1. Select **vnet-1**.
70+
71+
1. In the **Overview** of **vnet-1**, select the **Properties** tab.
72+
73+
1. Verify that **Encryption** is set to **Enabled**.
74+
75+
:::image type="content" source="./media/how-to-create-encryption-portal/virtual-network-properties-encryption-enabled.png" alt-text="Screenshot of properties of the virtual network with encryption enabled.":::
76+
77+
[!INCLUDE [portal-clean-up.md](../../includes/portal-clean-up.md)]
78+
79+
## Next steps
80+
81+
- For more information about Azure Virtual Networks, see [What is Azure Virtual Network?](/azure/virtual-network/virtual-networks-overview)
82+
83+
- For more information about Azure Virtual Network encryption, see [What is Azure Virtual Network encryption?](virtual-network-encryption-overview.md)

‎articles/virtual-network/how-to-create-encryption-powershell.md

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
---
2+
title: Create a virtual network with encryption - Azure PowerShell
3+
titleSuffix: Azure Virtual Network
4+
description: Learn how to create an encrypted virtual network using Azure PowerShell. A virtual network lets Azure resources communicate with each other and with the internet.
5+
author: asudbring
6+
ms.service: virtual-network
7+
ms.topic: how-to
8+
ms.date: 07/07/2023
9+
ms.author: allensu
10+
11+
---
12+
13+
# Create a virtual network with encryption using Azure PowerShell
14+
15+
Azure Virtual Network encryption is a feature of Azure Virtual Network. Virtual network encryption allows you to seamlessly encrypt and decrypt internal network traffic over the wire, with minimal effect to performance and scale. Azure Virtual Network encryption protects data traversing your virtual network virtual machine to virtual machine and virtual machine to on-premises.
16+
17+
## Prerequisites
18+
19+
- An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
20+
21+
- Azure PowerShell installed locally or Azure Cloud Shell.
22+
23+
- Sign in to Azure PowerShell and ensure you've selected the subscription with which you want to use this feature. For more information, see [Sign in with Azure PowerShell](/powershell/azure/authenticate-azureps).
24+
25+
- Ensure your `Az.Network` module is 4.3.0 or later. To verify the installed module, use the command Get-InstalledModule -Name `Az.Network`. If the module requires an update, use the command Update-Module -Name `Az.Network` if necessary.
26+
27+
If you choose to install and use PowerShell locally, this article requires the Azure PowerShell module version 5.4.1 or later. Run `Get-Module -ListAvailable Az` to find the installed version. If you need to upgrade, see [Install Azure PowerShell module](/powershell/azure/install-Az-ps). If you're running PowerShell locally, you also need to run `Connect-AzAccount` to create a connection with Azure.
28+
29+
## Create a resource group
30+
31+
An Azure resource group is a logical container into which Azure resources are deployed and managed.
32+
33+
Create a resource group with [New-AzResourceGroup](/powershell/module/az.resources/new-azresourcegroup) named **test-rg** in the **eastus2** location.
34+
35+
```azurepowershell-interactive
36+
$rg =@{
37+
Name = 'test-rg'
38+
Location = 'eastus2'
39+
}
40+
New-AzResourceGroup @rg
41+
```
42+
43+
## Create a virtual network
44+
45+
In this section, you create a virtual network and enable virtual network encryption.
46+
47+
Use [New-AzVirtualNetwork](/powershell/module/az.network/new-azvirtualnetwork) and [New-AzVirtualNetworkSubnetConfig](/powershell/module/az.network/new-azvirtualnetworksubnetconfig) to create a virtual network.
48+
49+
```azurepowershell-interactive
50+
## Create backend subnet config ##
51+
$subnet = @{
52+
Name = 'subnet-1'
53+
AddressPrefix = '10.0.0.0/24'
54+
}
55+
$subnetConfig = New-AzVirtualNetworkSubnetConfig @subnet
56+
57+
## Create the virtual network ##
58+
$net = @{
59+
Name = 'vnet-1'
60+
ResourceGroupName = 'test-rg'
61+
Location = 'eastus2'
62+
AddressPrefix = '10.0.0.0/16'
63+
Subnet = $subnetConfig
64+
EnableEncryption = 'true'
65+
EncryptionEnforcementPolicy = 'AllowUnencrypted'
66+
}
67+
New-AzVirtualNetwork @net
68+
69+
```
70+
71+
> [!IMPORTANT]
72+
> Azure Virtual Network encryption requires supported virtual machine SKUs in the virtual network for traffic to be encrypted. For more information, see [Azure Virtual Network encryption requirements](virtual-network-encryption-overview.md#requirements).
73+
74+
## Verify encryption enabled
75+
76+
You can check the encryption parameter in the virtual network to verify that encryption is enabled on the virtual network.
77+
78+
Use [Get-AzVirtualNetwork](/powershell/module/az.network/get-azvirtualnetwork) to view the encryption parameter for the virtual network you created previously.
79+
80+
```azurepowershell-interactive
81+
## Place the virtual network configuration into a variable. ##
82+
$net = @{
83+
Name = 'vnet-1'
84+
ResourceGroupName = 'test-rg'
85+
}
86+
$vnet = Get-AzVirtualNetwork @net
87+
```
88+
89+
To view the parameter for encryption, enter the following information.
90+
91+
```azurepowershell-interactive
92+
$vnet.Encryption
93+
```
94+
95+
```output
96+
Enabled Enforcement
97+
------- -----------
98+
True allowUnencrypted
99+
```
100+
101+
## Clean up resources
102+
103+
When you're done with the virtual network, use [Remove-AzResourceGroup](/powershell/module/az.resources/remove-azresourcegroup) to remove the resource group and all its resources.
104+
105+
```azurepowershell-interactive
106+
Remove-AzResourceGroup -Name 'test-rg' -Force
107+
```
108+
109+
## Next steps
110+
111+
- For more information about Azure Virtual Networks, see [What is Azure Virtual Network?](/azure/virtual-network/virtual-networks-overview).
112+
113+
- For more information about Azure Virtual Network encryption, see [What is Azure Virtual Network encryption?](virtual-network-encryption-overview.md).

‎articles/virtual-network/media/how-to-create-encryption-portal/virtual-network-properties-encryption-enabled.png

518 KB
Loading

‎articles/virtual-network/media/how-to-create-encryption-portal/virtual-network-properties.png

523 KB
Loading

‎articles/virtual-network/media/virtual-network-encryption-overview/virtual-network-encryption.png

47.6 KB
Loading

‎articles/virtual-network/toc.yml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,12 @@
7373
href: /security/benchmark/azure/baselines/virtual-network-nat-security-baseline?toc=/azure/virtual-network/toc.json?toc=/azure/virtual-network/toc.json?toc=/azure/virtual-network/toc.json
7474
- name: Network isolation of Azure services
7575
href: vnet-integration-for-azure-services.md
76+
- name: Virtual network encryption
77+
items:
78+
- name: Overview
79+
href: virtual-network-encryption-overview.md
80+
- name: FAQ
81+
href: virtual-network-encryption-faq.yml
7682
- name: Network security groups
7783
items:
7884
- name: Overview
@@ -184,6 +190,14 @@
184190
href: deploy-container-networking.md
185191
- name: Security
186192
items:
193+
- name: Create virtual network with encryption
194+
items:
195+
- name: Azure portal
196+
href: how-to-create-encryption-portal.md
197+
- name: Azure PowerShell
198+
href: how-to-create-encryption-powershell.md
199+
- name: Azure CLI
200+
href: how-to-create-encryption-cli.md
187201
- name: Filter network traffic
188202
items:
189203
- name: Azure portal

‎articles/virtual-network/virtual-network-encryption-faq.yml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
### YamlMime:FAQ
2+
metadata:
3+
title: Virtual Network encryption frequently asked questions
4+
description: Answers to common questions about using Azure Virtual Network encryption.
5+
ms.topic: faq
6+
7+
title: Frequently asked questions for Azure Virtual Network encryption
8+
summary: |
9+
Here are some answers to common questions about using Azure Virtual Network encryption.
10+
11+
sections:
12+
- name: Single section - ignored
13+
questions:
14+
- question: Can I enable virtual network encryption on an existing virtual network, virtual machine, network interface, or NSG?
15+
answer: |
16+
Yes.
17+
18+
- question: How do I verify my data is encrypted?
19+
answer: |
20+
Encryption verification is limited to the status of the network interface resource, vnetEncryptionSupported, and Accelerated networking during public preview. After public preview, virtual network flow logs can be used to see the encrypted and unencrypted flows between virtual machines.
21+
22+
- question: Is there data not encrypted?
23+
answer: |
24+
Fragmented packets aren't offloaded to hardware and don't get encrypted. Use an MTU of 1500 in the network configuration of your virtual machines.
25+
26+
- question: What certificate is used for the DTLS establishment on the Azure Host?
27+
answer: |
28+
Microsoft manages and has created certificates for each region. Customer provided certificates are a feature on the road map.
29+
30+
- question: What is the performance effect?
31+
answer: |
32+
There's a minimal performance effect to throughput/bandwidth. The crypto operations are offloaded to a crypto-specialized FPGA. There's a minimal effect to an initial connection between two virtual machines, because a tunnel needs to be established.
33+
34+
- question: Is VPN gateway, Application gateway, Azure Firewall, or PaaS supported?
35+
answer: |
36+
It depends on the underlying VM size that the PaaS uses, and requires Accelerated Networking enabled.
37+
38+
- question: Where is the encryption terminated?
39+
answer: |
40+
The encryption is terminated at the SmartNIC/FPGA on the Azure Host.

0 commit comments

Comments
 (0)