Skip to content

Commit 5ff8c60

Browse files
ecfanecfan
committed
Refactor ports table
1 parent 15f8af5 commit 5ff8c60

File tree

1 file changed

+36
-26
lines changed

1 file changed

+36
-26
lines changed

‎articles/logic-apps/connect-virtual-network-vnet-isolated-environment.md

Lines changed: 36 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ services: logic-apps
55
ms.suite: integration
66
ms.reviewer: jonfan, logicappspm
77
ms.topic: conceptual
8-
ms.date: 05/01/2020
8+
ms.date: 05/05/2020
99
---
1010

1111
# Connect to Azure virtual networks from Azure Logic Apps by using an integration service environment (ISE)
@@ -81,7 +81,7 @@ To make sure that your ISE is accessible and that the logic apps in that ISE can
8181
8282
* If you created a new Azure virtual network and subnets without any constraints, you don't need to set up [network security groups (NSGs)](../virtual-network/security-overview.md#network-security-groups) in your virtual network to control traffic across subnets.
8383

84-
* On an existing virtual network, you can *optionally* set up NSGs by [filtering network traffic across subnets](../virtual-network/tutorial-filter-network-traffic.md). If you want to go this route, or if you're already using NSGs, make sure that you [open the ports in this table](#network-ports-for-ise) on the virtual network where you have NSGs or want to set up NSGs.
84+
* On an existing virtual network, you can *optionally* set up NSGs by [filtering network traffic across subnets](../virtual-network/tutorial-filter-network-traffic.md). If you want to go this route, or if you're already using NSGs, make sure that you [open the ports described in this table](#network-ports-for-ise) on the virtual network where you have NSGs or want to set up NSGs.
8585

8686
> [!NOTE]
8787
> If you use [NSG security rules](../virtual-network/security-overview.md#security-rules),
@@ -99,30 +99,40 @@ This table describes the ports in your Azure virtual network that your ISE uses
9999
> [!IMPORTANT]
100100
> Source ports are ephemeral, so make sure that you set them to `*` for all rules. Where noted, internal ISE and external ISE refer to the
101101
> [endpoint that's selected at ISE creation](connect-virtual-network-vnet-isolated-environment.md#create-environment).
102-
> For more information, see [Endpoint access](../logic-apps/connect-virtual-network-vnet-isolated-environment-overview.md#endpoint-access).
103-
104-
| Purpose | Direction | Destination ports | Source service tag | Destination service tag | Notes |
105-
|---------|-----------|-------------------|--------------------|-------------------------|-------|
106-
| Intersubnet communication within your virtual network | Inbound & Outbound | * | The address space for the virtual network that has your ISE's subnets | The address space for the virtual network that has your ISE's subnets | Required for traffic to flow *between* the subnets in your virtual network. <p><p>**Important**: For traffic to flow between the *components* in each subnet, make sure that you open all the ports within each subnet. |
107-
| Communication to your logic app | Inbound | 443 | Internal ISE: <br>VirtualNetwork <p><p>External ISE: <br>Internet <br>(see **Notes** column) | VirtualNetwork | Rather than use the **Internet** service tag, you can specify the source IP address for the computer or service that calls any request triggers or webhooks in your logic app. <p><p>**Important**: Closing or blocking this port prevents HTTP calls to logic apps that have request triggers. |
108-
| Logic app run history | Inbound | 443 | Internal ISE: <br>VirtualNetwork <p><p>External ISE: <br>Internet <br>(see **Notes** column) | VirtualNetwork | Rather than use the **Internet** service tag, you can specify the source IP address for the computer or service from where you want to view your logic app's run history. <p><p>**Important**: Although closing or blocking this port doesn't prevent you from viewing the run history, you can't view the inputs and outputs for each step in that run history. |
109-
| Logic Apps Designer - dynamic properties | Inbound | 454 | LogicAppsManagement | VirtualNetwork | Requests come from the Logic Apps access endpoint [inbound](../logic-apps/logic-apps-limits-and-config.md#inbound) IP addresses for that region. |
110-
| Connector deployment | Inbound | 454 | AzureConnectors | VirtualNetwork | Required for deploying and updating connectors. Closing or blocking this port causes ISE deployments to fail and prevents connector updates or fixes. |
111-
| Network health check | Inbound | 454 | LogicApps | VirtualNetwork | Requests come from the Logic Apps access endpoint for both [inbound](../logic-apps/logic-apps-limits-and-config.md#inbound) and [outbound](../logic-apps/logic-apps-limits-and-config.md#outbound) IP addresses for that region. |
112-
| App Service Management dependency | Inbound | 454, 455 | AppServiceManagement | VirtualNetwork | |
113-
| Communication from Azure Traffic Manager | Inbound | Internal ISE: 454 <p><p>External ISE: 443 | AzureTrafficManager | VirtualNetwork | |
114-
| API Management - management endpoint | Inbound | 3443 | APIManagement | VirtualNetwork | |
115-
| Connector policy deployment | Inbound | 3443 | APIManagement | VirtualNetwork | Required for deploying and updating connectors. Closing or blocking this port causes ISE deployments to fail and prevents connector updates or fixes. |
116-
| Communication from your logic app | Outbound | 80, 443 | VirtualNetwork | Varies based on destination | The endpoints for the external service with which your logic app needs to communicate. |
117-
| Azure Active Directory | Outbound | 80, 443 | VirtualNetwork | AzureActiveDirectory | |
118-
| Connection management | Outbound | 443 | VirtualNetwork | AppService | |
119-
| Publish Diagnostic Logs & Metrics | Outbound | 443 | VirtualNetwork | AzureMonitor | |
120-
| Azure Storage dependency | Outbound | 80, 443, 445 | VirtualNetwork | Storage | |
121-
| Azure SQL dependency | Outbound | 1433 | VirtualNetwork | SQL | |
122-
| Azure Resource Health | Outbound | 1886 | VirtualNetwork | AzureMonitor | Required for publishing health status to Resource Health |
123-
| Dependency from Log to Event Hub policy and monitoring agent | Outbound | 5672 | VirtualNetwork | EventHub | |
124-
| Access Azure Cache for Redis Instances between Role Instances | Inbound <br>Outbound | 6379 - 6383 | VirtualNetwork | VirtualNetwork | Also, for ISE to work with Azure Cache for Redis, you must open these [outbound and inbound ports described in the Azure Cache for Redis FAQ](../azure-cache-for-redis/cache-how-to-premium-vnet.md#outbound-port-requirements). |
125-
||||||
102+
> For more information, see [Endpoint access](../logic-apps/connect-virtual-network-vnet-isolated-environment-overview.md#endpoint-access).
103+
104+
#### Inbound security rules
105+
106+
| Purpose | Source service tag or IP addresses | Source ports | Destination service tag or IP addresses | Destination ports | Notes |
107+
|---------|------------------------------------|--------------|-----------------------------------------|-------------------|-------|
108+
| Intersubnet communication within virtual network | Address space for the virtual network with ISE subnets | * | Address space for the virtual network with ISE subnets | * | Required for traffic to flow *between* the subnets in your virtual network. <p><p>**Important**: For traffic to flow between the *components* in each subnet, make sure that you open all the ports within each subnet. |
109+
| Communication to your logic app | Internal ISE: <br>**VirtualNetwork** <p><p>External ISE: **Internet** or see **Notes** | * | **VirtualNetwork** | 443 | Rather than use the **Internet** service tag, specify the source IP address for the computer or service that calls any request triggers or webhooks in your logic app. <p><p>**Important**: Closing or blocking this port prevents HTTP calls to logic apps that have request triggers or webhooks. |
110+
| Runs history for logic app | Internal ISE: <br>**VirtualNetwork** <p><p>External ISE: **Internet** or see **Notes** | * | **VirtualNetwork** | 443 | Rather than use the **Internet** service tag, specify the source IP address for the computer or service from where you want to view logic app runs history. <p><p>**Important**: Closing or blocking this port prevents you from viewing inputs and outputs for each step in runs history. However, you're not prevented from viewing logic app runs history. |
111+
| Logic Apps designer - dynamic properties | **LogicAppsManagement** | * | **VirtualNetwork** | 454 | Requests come from the Logic Apps access endpoint's [inbound IP addresses](../logic-apps/logic-apps-limits-and-config.md#inbound) for that region. |
112+
| Connector deployment | **AzureConnectors** | * | **VirtualNetwork** | 454 | Required to deploy and update connectors. Closing or blocking this port causes ISE deployments to fail and prevents connector updates and fixes. |
113+
| Network health check | **LogicApps** | * | **VirtualNetwork** | 454 | Requests come from the Logic Apps access endpoint's [inbound IP addresses](../logic-apps/logic-apps-limits-and-config.md#inbound) and [outbound IP addresses](../logic-apps/logic-apps-limits-and-config.md#outbound) for that region. |
114+
| App Service Management dependency | **AppServiceManagement** | * | **VirtualNetwork** | 454, 455 ||
115+
| Communication from Azure Traffic Manager | **AzureTrafficManager** | * | **VirtualNetwork** | Internal ISE: 454 <p><p>External ISE: 443 ||
116+
| API Management - management endpoint | **APIManagement** | * | **VirtualNetwork** | 3443 ||
117+
| Connector policy deployment | **APIManagement** | * | **VirtualNetwork** | 3443 | Required to deploy and update connectors. Closing or blocking this port causes ISE deployments to fail and prevents connector updates and fixes. |
118+
| Access Azure Cache for Redis Instances between Role Instances | **VirtualNetwork** | * | **VirtualNetwork** | 6379 - 6383 | And, for ISE to work with Azure Cache for Redis, you must also open these [outbound and inbound ports described by the Azure Cache for Redis FAQ](../azure-cache-for-redis/cache-how-to-premium-vnet.md#outbound-port-requirements). |
119+
|||||||
120+
121+
#### Outbound
122+
123+
| Purpose | Source service tag or IP addresses | Source ports | Destination service tag or IP addresses | Destination ports | Notes |
124+
|---------|------------------------------------|--------------|-----------------------------------------|-------------------|-------|
125+
| Intersubnet communication within virtual network | Address space for the virtual network with ISE subnets | * | Address space for the virtual network with ISE subnets | * | Required for traffic to flow *between* the subnets in your virtual network. <p><p>**Important**: For traffic to flow between the *components* in each subnet, make sure that you open all the ports within each subnet. |
126+
| Communication from your logic app | **VirtualNetwork** | * | Varies based on destination | 80, 443 | Destination varies based on the endpoints for the external service with which your logic app needs to communicate. |
127+
| Azure Active Directory | **VirtualNetwork** | * | **AzureActiveDirectory** | 80, 443 ||
128+
| Azure Storage dependency | **VirtualNetwork** | * | **Storage** | 80, 443, 445 ||
129+
| Connection management | **VirtualNetwork** | * | **AppService** | 443 ||
130+
| Publish diagnostic logs & metrics | **VirtualNetwork** | * | **AzureMonitor** | 443 ||
131+
| Azure SQL dependency | **VirtualNetwork** | * | **SQL** | 1433 ||
132+
| Azure Resource Health | **VirtualNetwork** | * | **AzureMonitor** | 1886 | Required for publishing health status to Resource Health. |
133+
| Dependency from Log to Event Hub policy and monitoring agent | **VirtualNetwork** | * | **EventHub** | 5672 ||
134+
| Access Azure Cache for Redis Instances between Role Instances | **VirtualNetwork** | * | **VirtualNetwork** | 6379 - 6383 | And, for ISE to work with Azure Cache for Redis, you must also open these [outbound and inbound ports described by the Azure Cache for Redis FAQ](../azure-cache-for-redis/cache-how-to-premium-vnet.md#outbound-port-requirements). |
135+
|||||||
126136

127137
<a name="create-environment"></a>
128138

0 commit comments

Comments
 (0)