Skip to content

Commit 6de20e2

Browse files
Jak-MSJak-MS
authored
Merge pull request #113555 from vhorne/fwm-secure-cloud
UI updates
2 parents 3cf75a4 + 675cef5 commit 6de20e2

File tree

1 file changed

+48
-42
lines changed

1 file changed

+48
-42
lines changed

‎articles/firewall-manager/secure-cloud-network.md

Lines changed: 48 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ services: firewall-manager
55
author: vhorne
66
ms.service: firewall-manager
77
ms.topic: tutorial
8-
ms.date: 02/18/2020
8+
ms.date: 05/01/2020
99
ms.author: victorh
1010
---
1111

@@ -31,66 +31,73 @@ In this tutorial, you learn how to:
3131
3232
## Create a hub and spoke architecture
3333

34-
First, create a spoke VNet where you can place your servers.
34+
First, create a spoke virtual network where you can place your servers.
3535

36-
### Create a spoke VNet and subnets
36+
### Create a spoke virtual network and subnets
3737

3838
1. From the Azure portal home page, select **Create a resource**.
3939
2. Under **Networking**, select **Virtual network**.
40-
4. For **Name**, type **Spoke-01**.
41-
5. For **Address space**, type **10.0.0.0/16**.
42-
6. For **Subscription**, select your subscription.
43-
7. For **Resource group**, select **Create new**, and type **FW-Manager** for the name and select **OK**.
44-
8. For **Location**, select **(US) East US**.
45-
9. Under **Subnet**, for **Name** type **Workload-SN**.
46-
10. For **Address range**, type **10.0.1.0/24**.
47-
11. Accept the other default settings, and then select **Create**.
40+
2. For **Subscription**, select your subscription.
41+
1. For **Resource group**, select **Create new**, and type **FW-Manager** for the name and select **OK**.
42+
2. For **Name**, type **Spoke-01**.
43+
3. For **Region**, select **(US) East US**.
44+
4. Select **Next: IP Addresses**.
45+
1. For **Address space**, accept the default **10.0.0.0/16**.
46+
3. Under **Subnet name**, select **default**.
47+
4. Change the subnet name to **Workload-SN**.
48+
5. For **Subnet address range**, type **10.0.1.0/24**.
49+
6. Select **Save**..
4850

4951
Next, create a subnet for a jump server.
5052

51-
1. On the Azure portal home page, select **Resource groups** > **FW-Manager**.
52-
2. Select the **Spoke-01** virtual network.
53-
3. Select **Subnets** > **+Subnet**.
54-
4. For **Name**, type **Jump-SN**.
55-
5. For **Address range**, type **10.0.2.0/24**.
56-
6. Select **OK**.
53+
1. Select **Add subnet**.
54+
4. For **Subnet name**, type **Jump-SN**.
55+
5. For **Subnet address range**, type **10.0.2.0/24**.
56+
6. Select **Add**.
57+
58+
Now create the virtual network.
59+
60+
1. Select **Review + create**.
61+
2. Select **Create**.
5762

5863
### Create the secured virtual hub
5964

6065
Create your secured virtual hub using Firewall Manager.
6166

6267
1. From the Azure portal home page, select **All services**.
6368
2. In the search box, type **Firewall Manager** and select **Firewall Manager**.
64-
3. On the **Firewall Manager** page, select **Create a Secured Virtual Hub**.
65-
4. On the **Create new Secured virtual hub** page, select your subscription and the **FW-Manager** resource group.
66-
5. For the **Secured virtual hub name**, type **Hub-01**.
67-
6. For **Location**, select **East US**.
68-
7. For **Hub address space**, type **10.1.0.0/16**.
69-
8. For the new vWAN name, type **vwan-01**.
70-
9. Leave the **Include VPN gateway to enable Trusted Security Partners** check box cleared.
71-
10. Select **Next:Azure Firewall**.
72-
11. Accept the default **Azure Firewall** **Enabled** setting and then select **Next: Trusted Security Partner**.
73-
12. Accept the default **Trusted Security Partner** **Disabled** setting, and select **Next: Review + create**.
74-
13. Select **Create**. It will take about 30 minutes to deploy.
69+
3. On the **Firewall Manager** page, select **View secured virtual hubs**.
70+
4. On the **Firewall Manager | Secured virtual hubs** page, select **Create new secured virtual hub**.
71+
5. For **Resource group**, select **FW-Manager**.
72+
7. For **Region**, select **East US**.
73+
1. For the **Secured virtual hub name**, type **Hub-01**.
74+
2. For **Hub address space**, type **10.1.0.0/16**.
75+
3. For the new vWAN name, type **Vwan-01**.
76+
4. Leave the **Include VPN gateway to enable Trusted Security Partners** check box cleared.
77+
5. Select **Next:Azure Firewall**.
78+
6. Accept the default **Azure Firewall** **Enabled** setting and then select **Next: Trusted Security Partner**.
79+
7. Accept the default **Trusted Security Partner** **Disabled** setting, and select **Next: Review + create**.
80+
8. Select **Create**. It will take about 30 minutes to deploy.
7581

7682
### Connect the hub and spoke VNets
7783

7884
Now you can peer the hub and spoke VNets.
7985

80-
1. Select the **FW-Manager** resource group, then select the **vwan-01** virtual WAN.
86+
1. Select the **FW-Manager** resource group, then select the **Vwan-01** virtual WAN.
8187
2. Under **Connectivity**, select **Virtual network connections**.
8288
3. Select **Add connection**.
8389
4. For **Connection name**, type **hub-spoke**.
8490
5. For **Hubs**, select **Hub-01**.
85-
6. For **Virtual network**, select **Spoke-01**.
86-
7. Select **OK**.
91+
6. For **Resource group**, select **FW-Manager**.
92+
7. For **Virtual network**, select **Spoke-01**.
93+
8. Select **OK**.
8794

8895
## Create a firewall policy and secure your hub
8996

9097
A firewall policy defines collections of rules to direct traffic on one or more Secured virtual hubs. You'll create your firewall policy and then secure your hub.
9198

92-
1. From Firewall Manager, select **Create an Azure Firewall Policy**.
93-
2. Select your subscription, and then select the **FW-Manager** resource group.
99+
1. From Firewall Manager, select **View Azure Firewall policies**.
100+
2. Select **Create Azure Firewall Policy**.
94101
3. Under **Policy details**, for the **Name** type **Policy-01** and for **Region** select **East US**.
95102
4. Select **Next:Rules**.
96103
5. On the **Rules** tab, select **Add a rule collection**.
@@ -104,10 +111,11 @@ A firewall policy defines collections of rules to direct traffic on one or more
104111
13. Ensure **Destination type is **FQDN**.
105112
14. For **Destination**, type **\*.microsoft.com**.
106113
15. Select **Add**.
107-
16. Select **Next: Secured virtual hubs**.
108-
17. On the **Secured virtual hubs** tab, select **Hub-01**.
109-
19. Select **Review + create**.
110-
20. Select **Create**.
114+
16. Select **Next: Hubs**.
115+
17. On the **Hubs** tab, select **Associate virtual hubs**.
116+
18. Select **Hub-01** and then select **Add**.
117+
1. Select **Review + create**.
118+
2. Select **Create**.
111119

112120
This can take about five minutes or more to complete.
113121

@@ -121,10 +129,9 @@ Now you must ensure that network traffic gets routed to through your firewall.
121129
4. Under **Internet traffic**, **Traffic from Virtual Networks**, select **Send via Azure Firewall**.
122130
5. Under **Azure private traffic**, **Traffic to Virtual Networks**, select **Send via Azure Firewall**.
123131
6. Select **Edit IP address prefix(es)**.
124-
7. Select **Add an IP address prefix**.
125132
8. Type **10.0.1.0/24** as the address of the Workload subnet and select **Save**.
126133
9. Under **Settings**, select **Connections**.
127-
10. Select the **hub-spoke** connection, and then select **Secure internet traffic** and then select **OK**.
134+
10. Verify that the **hub-spoke** connection shows **Internet Traffic** as **Secured**.
128135

129136

130137
## Test your firewall
@@ -142,12 +149,11 @@ To test your firewall rules, you'll need to deploy a couple servers. You'll depl
142149
|Resource group |**FW-Manager**|
143150
|Virtual machine name |**Jump-Srv**|
144151
|Region |**(US) East US)**|
145-
|Administrator user name |**azureuser**|
146-
|Password |type your password|
152+
|Administrator user name |type a user name|
153+
|Password |type a password|
147154

148155
4. Under **Inbound port rules**, for **Public inbound ports**, select **Allow selected ports**.
149156
5. For **Select inbound ports**, select **RDP (3389)**.
150-
151157
6. Accept the other defaults and select **Next: Disks**.
152158
7. Accept the disk defaults and select **Next: Networking**.
153159
8. Make sure that **Spoke-01** is selected for the virtual network and the subnet is **Jump-SN**.

0 commit comments

Comments
 (0)