Skip to content

Commit 58f7c69

Browse files
v-dirichardsv-dirichards
authored
Merge pull request #209371 from mumian/0826-bicep-watcher
[network watcher] - new Bicep quickstart
2 parents 58e8b7b + 2eadd67 commit 58f7c69

File tree

3 files changed

+112
-86
lines changed

3 files changed

+112
-86
lines changed

‎articles/network-watcher/quickstart-configure-network-security-group-flow-logs-from-arm-template.md

Lines changed: 7 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
---
2-
title: 'Quickstart: Configure network security group flow logs by using an Azure Resource Manager template (ARM template)'
2+
title: 'Quickstart: Configure Network Watcher network security group flow logs by using an Azure Resource Manager template (ARM template)'
33
description: Learn how to enable network security group (NSG) flow logs programmatically by using an Azure Resource Manager template (ARM template) and Azure PowerShell.
44
services: network-watcher
55
author: damendo
66
ms.author: damendo
7-
ms.date: 01/07/2021
7+
ms.date: 09/01/2022
88
ms.topic: quickstart
99
ms.service: network-watcher
1010
ms.custom: devx-track-azurepowershell, subject-armqs, mode-arm
@@ -31,91 +31,15 @@ If you don't have an Azure subscription, create a [free account](https://azure.m
3131

3232
The template that we use in this quickstart is from [Azure Quickstart Templates](https://azure.microsoft.com/resources/templates/networkwatcher-flowlogs-create/).
3333

34-
:::code language="json" source="~/quickstart-templates/quickstarts/microsoft.network/networkwatcher-flowLogs-create/azuredeploy.json":::
34+
:::code language="json" source="~/quickstart-templates/quickstarts/microsoft.network/networkwatcher-flowLogs-create/azuredeploy.json" range="1-117" highlight="94-115":::
3535

3636
These resources are defined in the template:
3737

38-
- [Microsoft.Storage/storageAccounts](/azure/templates/microsoft.storage/storageaccounts)
39-
- [Microsoft.Resources/deployments](/azure/templates/microsoft.resources/deployments)
40-
41-
## NSG flow logs object
42-
43-
The following code shows an NSG flow logs object and its parameters. To create a `Microsoft.Network/networkWatchers/flowLogs` resource, add this code to the resources section of your template:
44-
45-
```json
46-
{
47-
"name": "string",
48-
"type": "Microsoft.Network/networkWatchers/flowLogs",
49-
"location": "string",
50-
"apiVersion": "2019-09-01",
51-
"properties": {
52-
"targetResourceId": "string",
53-
"storageId": "string",
54-
"enabled": "boolean",
55-
"flowAnalyticsConfiguration": {
56-
"networkWatcherFlowAnalyticsConfiguration": {
57-
"enabled": "boolean",
58-
"workspaceResourceId": "string",
59-
"trafficAnalyticsInterval": "integer"
60-
},
61-
"retentionPolicy": {
62-
"days": "integer",
63-
"enabled": "boolean"
64-
},
65-
"format": {
66-
"type": "string",
67-
"version": "integer"
68-
}
69-
}
70-
}
71-
}
72-
```
73-
74-
For a complete overview of the NSG flow logs object properties, see [Microsoft.Network networkWatchers/flowLogs](/azure/templates/microsoft.network/networkwatchers/flowlogs).
75-
76-
## Create your template
77-
78-
If you're using ARM templates for the first time, see the following articles to learn more about ARM templates:
79-
80-
- [Deploy resources with ARM templates and Azure PowerShell](../azure-resource-manager/templates/deploy-powershell.md#deploy-local-template)
81-
- [Tutorial: Create and deploy your first ARM template](../azure-resource-manager/templates/template-tutorial-create-first-template.md)
82-
83-
The following example is a complete template. It's also the simplest version of the template. The example contains the minimum parameters that are passed to set up NSG flow logs. For more examples, see the overview article [Configure NSG flow logs from an Azure Resource Manager template](network-watcher-nsg-flow-logging-azure-resource-manager.md).
84-
85-
### Example
86-
87-
The following template enables flow logs for an NSG, and then stores the logs in a specific storage account:
88-
89-
```json
90-
{
91-
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
92-
"contentVersion": "1.0.0.0",
93-
"apiProfile": "2019-09-01",
94-
"resources": [
95-
{
96-
"name": "NetworkWatcher_centraluseuap/Microsoft.NetworkDalanDemoPerimeterNSG",
97-
"type": "Microsoft.Network/networkWatchers/FlowLogs/",
98-
"location": "centraluseuap",
99-
"apiVersion": "2019-09-01",
100-
"properties": {
101-
"targetResourceId": "/subscriptions/<subscription Id>/resourceGroups/DalanDemo/providers/Microsoft.Network/networkSecurityGroups/PerimeterNSG",
102-
"storageId": "/subscriptions/<subscription Id>/resourceGroups/MyCanaryFlowLog/providers/Microsoft.Storage/storageAccounts/storagev2ira",
103-
"enabled": true,
104-
"flowAnalyticsConfiguration": {},
105-
"retentionPolicy": {},
106-
"format": {}
107-
}
108-
}
109-
]
110-
}
111-
```
38+
- [Microsoft.Storage/storageAccounts](/azure/templates/microsoft.storage/storageaccounts?pivots=deployment-language-arm-template)
39+
- [Microsoft.Network networkWatchers](/azure/templates/microsoft.network/networkwatchers?tabs=bicep&pivots=deployment-language-arm-template)
40+
- [Microsoft.Network networkWatchers/flowLogs](/azure/templates/microsoft.network/networkwatchers/flowlogs?tabs=bicep&pivots=deployment-language-arm-template)
11241

113-
> [!NOTE]
114-
> - The resource name uses the format _ParentResource_ChildResource_. In our example, the parent resource is the regional Azure Network Watcher instance:
115-
> - **Format**: NetworkWatcher_RegionName
116-
> - **Example**: NetworkWatcher_centraluseuap
117-
> - `targetResourceId` is the resource ID of the target NSG.
118-
> - `storageId` is the resource ID of the destination storage account.
42+
The highlighted code in the preceding sample shows an NSG flow logs resource definition.
11943

12044
## Deploy the template
12145

‎articles/network-watcher/quickstart-configure-network-security-group-flow-logs-from-bicep.md

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
---
2+
title: 'Quickstart: Configure Network Watcher network security group flow logs by using a Bicep file'
3+
description: Learn how to enable network security group (NSG) flow logs programmatically by using Bicep and Azure PowerShell.
4+
services: network-watcher
5+
author: damendo
6+
ms.author: damendo
7+
ms.date: 08/26/2022
8+
ms.topic: quickstart
9+
ms.service: network-watcher
10+
ms.custom: devx-track-azurepowershell, subject-bicepqs, mode-arm
11+
#Customer intent: I need to enable the network security group flow logs by using a Bicep file.
12+
---
13+
14+
# Quickstart: Configure network security group flow logs by using a Bicep file
15+
16+
In this quickstart, you learn how to enable [network security group (NSG) flow logs](network-watcher-nsg-flow-logging-overview.md) by using a Bicep file
17+
18+
[!INCLUDE [About Bicep](../../includes/resource-manager-quickstart-bicep-introduction.md)]
19+
20+
We start with an overview of the properties of the NSG flow log object. We provide a sample Bicep file. Then, we deploy the Bicep file.
21+
22+
## Prerequisites
23+
24+
If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
25+
26+
## Review the Bicep file
27+
28+
The Bicep file that we use in this quickstart is from [Azure Quickstart Templates](https://azure.microsoft.com/resources/templates/networkwatcher-flowlogs-create/).
29+
30+
:::code language="bicep" source="~/quickstart-templates/quickstarts/microsoft.network/networkwatcher-flowLogs-create/main.bicep" range="1-67" highlight="51-67":::
31+
32+
These resources are defined in the Bicep file:
33+
34+
- [Microsoft.Storage/storageAccounts](/azure/templates/microsoft.storage/storageaccounts?pivots=deployment-language-bicep)
35+
- [Microsoft.Network networkWatchers](/azure/templates/microsoft.network/networkwatchers?tabs=bicep&pivots=deployment-language-bicep)
36+
- [Microsoft.Network networkWatchers/flowLogs](/azure/templates/microsoft.network/networkwatchers/flowlogs?tabs=bicep&pivots=deployment-language-bicep)
37+
38+
The highlighted code in the preceding sample shows an NSG flow resource definition.
39+
40+
## Deploy the Bicep file
41+
42+
This tutorial assumes that you have a network security group that you can enable flow logging on.
43+
44+
1. Save the Bicep file as **main.bicep** to your local computer.
45+
1. Deploy the Bicep file using either Azure CLI or Azure PowerShell.
46+
47+
# [CLI](#tab/CLI)
48+
49+
```azurecli
50+
az group create --name exampleRG --location eastus
51+
az deployment group create --resource-group exampleRG --template-file main.bicep
52+
```
53+
54+
# [PowerShell](#tab/PowerShell)
55+
56+
```azurepowershell
57+
New-AzResourceGroup -Name exampleRG -Location eastus
58+
New-AzResourceGroupDeployment -ResourceGroupName exampleRG -TemplateFile ./main.bicep
59+
```
60+
61+
---
62+
63+
You will be prompted to enter the resource ID of the existing network security group. The syntax of the network security group resource ID is:
64+
65+
```json
66+
"/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/networkSecurityGroups/<network-security-group-name>"
67+
```
68+
69+
When the deployment finishes, you should see a message indicating the deployment succeeded.
70+
71+
## Validate the deployment
72+
73+
You have two options to see whether your deployment succeeded:
74+
75+
- Your console shows `ProvisioningState` as `Succeeded`.
76+
- Go to the [NSG flow logs portal page](https://portal.azure.com/#blade/Microsoft_Azure_Network/NetworkWatcherMenuBlade/flowLogs) to confirm your changes.
77+
78+
If there were issues with the deployment, see [Troubleshoot common Azure deployment errors with Azure Resource Manager](../azure-resource-manager/troubleshooting/common-deployment-errors.md).
79+
80+
## Clean up resources
81+
82+
You can delete Azure resources by using complete deployment mode. To delete a flow logs resource, specify a deployment in complete mode without including the resource you want to delete. Read more about [complete deployment mode](../azure-resource-manager/templates/deployment-modes.md#complete-mode).
83+
84+
You also can disable an NSG flow log in the Azure portal:
85+
86+
1. Sign in to the Azure portal.
87+
1. Select **All services**. In the **Filter** box, enter **network watcher**. In the search results, select **Network Watcher**.
88+
1. Under **Logs**, select **NSG flow logs**.
89+
1. In the list of NSGs, select the NSG for which you want to disable flow logs.
90+
1. Under **Flow logs settings**, select **Off**.
91+
1. Select **Save**.
92+
93+
## Next steps
94+
95+
In this quickstart, you learned how to enable NSG flow logs by using a Bicep file. Next, learn how to visualize your NSG flow data by using one of these options:
96+
97+
- [Microsoft Power BI](network-watcher-visualize-nsg-flow-logs-power-bi.md)
98+
- [Open-source tools](network-watcher-visualize-nsg-flow-logs-open-source-tools.md)
99+
- [Azure Traffic Analytics](traffic-analytics.md)

‎articles/network-watcher/toc.yml

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@
1313
href: diagnose-vm-network-traffic-filtering-problem-powershell.md
1414
- name: Diagnose VM traffic filter problem - Azure CLI
1515
href: diagnose-vm-network-traffic-filtering-problem-cli.md
16+
- name: Configure NSG flow logs using Bicep
17+
displayName: Resource Manager,arm,template
18+
href: quickstart-configure-network-security-group-flow-logs-from-bicep.md
1619
- name: Configure NSG flow logs using ARM template
1720
displayName: Resource Manager
1821
href: quickstart-configure-network-security-group-flow-logs-from-arm-template.md
@@ -22,7 +25,7 @@
2225
href: diagnose-vm-network-routing-problem.md
2326
- name: Monitor communication between VMs
2427
href: connection-monitor.md
25-
- name: Monitor communication with virtual machine scale set
28+
- name: Monitor communication with virtual machine scale set
2629
href: connection-monitor-virtual-machine-scale-set.md
2730
- name: Diagnose a communication problem between networks
2831
href: diagnose-communication-problem-between-networks.md
@@ -58,7 +61,7 @@
5861
href: network-watcher-troubleshoot-overview.md
5962
- name: Variable packet capture
6063
href: network-watcher-packet-capture-overview.md
61-
- name: Traffic Analytics overview
64+
- name: Traffic Analytics overview
6265
items:
6366
- name: Overview
6467
href: traffic-analytics.md
@@ -93,7 +96,7 @@
9396
- name: Using ARMClient
9497
href: connection-monitor-create-using-template.md
9598
- name: Using PowerShell
96-
href: connection-monitor-create-using-powershell.md
99+
href: connection-monitor-create-using-powershell.md
97100
- name: Migrate to Connection Monitor
98101
items:
99102
- name: From Network Performance Monitor

0 commit comments

Comments
 (0)