|
| 1 | +--- |
| 2 | +title: 'Create an Azure private endpoint using Azure CLI| Microsoft Docs' |
| 3 | +description: Learn about Azure private endpoint |
| 4 | +services: virtual-network |
| 5 | +author: KumudD |
| 6 | +ms.service: virtual-network |
| 7 | +ms.topic: article |
| 8 | +ms.date: 09/16/2019 |
| 9 | +ms.author: kumud |
| 10 | + |
| 11 | +--- |
| 12 | +# Create a private endpoint using Azure CLI |
| 13 | +Private Endpoint is the fundamental building block for Private Link in Azure. It enables Azure resources, like virtual machines (VMs), to communicate privately with Private Link Resources. In this Quickstart, you will learn how to create a VM on a virtual network, a SQL Database Server with a Private Endpoint using Azure CLI. Then, you can access the VM to and securely access the private link resource (a private Azure SQL Database server in this example). |
| 14 | + |
| 15 | +[!INCLUDE [cloud-shell-try-it.md](../../includes/cloud-shell-try-it.md)] |
| 16 | + |
| 17 | +If you decide to install and use Azure CLI locally instead, this quickstart requires you to use Azure CLI version 2.0.28 or later. To find your installed version, run `az --version`. See [Install Azure CLI](/cli/azure/install-azure-cli) for install or upgrade info. |
| 18 | + |
| 19 | +## Create a resource group |
| 20 | + |
| 21 | +Before you can create any resource, you have to create a resource group to host the Virtual Network. Create a resource group with [az group create](/cli/azure/group). This example creates a resource group named *myResourceGroup* in the *westcentralus* location: |
| 22 | + |
| 23 | +```azurecli-interactive |
| 24 | +az group create --name myResourceGroup --location westcentralus |
| 25 | +``` |
| 26 | + |
| 27 | +## Create a Virtual Network |
| 28 | +Create a Virtual Network with [az network vnet create](/cli/azure/network/vnet). This example creates a default Virtual Network named *myVirtualNetwork* with one subnet named *mySubnet*: |
| 29 | + |
| 30 | +```azurecli-interactive |
| 31 | +az network vnet create \ |
| 32 | + --name myVirtualNetwork \ |
| 33 | + --resource-group myResourceGroup \ |
| 34 | + --subnet-name mySubnet |
| 35 | +``` |
| 36 | +## Disable subnet private endpoint policies |
| 37 | +Azure deploys resources to a subnet within a virtual network, so you need to create or update the subnet to disable private endpoint network policies. Update a subnet configuration named *mySubnet** with [az network vnet subnet update](https://docs.microsoft.com/cli/azure/network/vnet/subnet?view=azure-cli-latest#az-network-vnet-subnet-update): |
| 38 | + |
| 39 | +```azurecli-interactive |
| 40 | +az network vnet subnet update \ |
| 41 | + --name mySubnet \ |
| 42 | + --resource-group myResourceGroup \ |
| 43 | + --vnet-name myVirtualNetwork \ |
| 44 | + --disable-private-endpoint-network-policies true |
| 45 | +``` |
| 46 | +## Create the VM |
| 47 | +Create a VM with az vm create. When prompted, provide a password to be used as the sign-in credentials for the VM. This example creates a VM named *myVm*: |
| 48 | +```azurecli-interactive |
| 49 | +az vm create \ |
| 50 | + --resource-group myResourceGroup \ |
| 51 | + --name myVm \ |
| 52 | + --image Win2019Datacenter |
| 53 | +``` |
| 54 | + Note the public IP address of the VM. You will use this address to connect to the VM from the internet in the next step. |
| 55 | + |
| 56 | +## Create a SQL Database Server |
| 57 | +Create a SQL Database Server with the az sql server create command. Remember that the name of your SQL Server must be unique across Azure, so replace the placeholder value in brackets with your own unique value: |
| 58 | + |
| 59 | +```azurecli-interactive |
| 60 | +# Create a logical server in the resource group |
| 61 | +az sql server create \ |
| 62 | + --name "myserver"\ |
| 63 | + --resource-group myResourceGroup \ |
| 64 | + --location WestUS \ |
| 65 | + --admin-user "sqladmin" \ |
| 66 | + --admin-password "CHANGE_PASSWORD_1" |
| 67 | + |
| 68 | +# Create a database in the server with zone redundancy as false |
| 69 | +az sql db create \ |
| 70 | + --resource-group myResourceGroup \ |
| 71 | + --server myserver \ |
| 72 | + --name mySampleDatabase \ |
| 73 | + --sample-name AdventureWorksLT \ |
| 74 | + --edition GeneralPurpose \ |
| 75 | + --family Gen4 \ |
| 76 | + --capacity 1 |
| 77 | +``` |
| 78 | + |
| 79 | +Note the SQL Server ID is similar to ```/subscriptions/subscriptionId/resourceGroups/myResourceGroup/providers/Microsoft.Sql/servers/myserver.``` |
| 80 | +You will use the SQL Server ID in the next step. |
| 81 | + |
| 82 | +## Create the Private Endpoint |
| 83 | +Create a private endpoint for the SQL Database server in your Virtual Network: |
| 84 | +```azurecli-interactive |
| 85 | +az network private-endpoint create \ |
| 86 | + --name myPrivateEndpoint \ |
| 87 | + --resource-group myResourceGroup \ |
| 88 | + --vnet-name myVirtualNetwork \ |
| 89 | + --subnet mySubnet \ |
| 90 | + --private-connection-resource-id "<SQL Server ID>" \ |
| 91 | + --group-ids sqlServer \ |
| 92 | + --connection-name myConnection |
| 93 | + ``` |
| 94 | +## Configure the Private DNS Zone |
| 95 | +Create a Private DNS Zone for SQL Database server domain and create an association link with the Virtual Network. |
| 96 | +```azurecli-interactive |
| 97 | +az network private-dns zone create --resource-group myResourceGroup \ |
| 98 | + --name "privatelink.database.windows.net" |
| 99 | +az network private-dns link vnet create --resource-group myResourceGroup \ |
| 100 | + --zone-name "privatelink.database.windows.net"\ |
| 101 | + --name MyDNSLink \ |
| 102 | + --virtual-network myVirtualNetwork \ |
| 103 | + --registration-enabled false |
| 104 | +
|
| 105 | +#Query for the network interface ID |
| 106 | +az network private-endpoint show --name myPrivateEndpoint --resource-group myResourceGroup --query 'networkInterfaces[0].id' |
| 107 | + |
| 108 | + |
| 109 | +az resource show --ids $networkInterfaceId --api-version 2019-04-01 -o json |
| 110 | +# Copy the content for privateIPAddress and FQDN matching the SQL server name |
| 111 | + |
| 112 | + |
| 113 | +#Create DNS records |
| 114 | +az network private-dns record-set a create --name myserver --zone-name privatelink.database.windows.net --resource-group myResourceGroup |
| 115 | +az network private-dns record-set a add-record --record-set-name myserver --zone-name privatelink.database.windows.net --resource-group myResourceGroup -a <Private IP Address> |
| 116 | +``` |
| 117 | + |
| 118 | +## Connect to a VM from the internet |
| 119 | + |
| 120 | +Connect to the VM *myVm* from the internet as follows: |
| 121 | + |
| 122 | +1. In the portal's search bar, enter *myVm*. |
| 123 | + |
| 124 | +1. Select the **Connect** button. After selecting the **Connect** button, **Connect to virtual machine** opens. |
| 125 | + |
| 126 | +1. Select **Download RDP File**. Azure creates a Remote Desktop Protocol (*.rdp*) file and downloads it to your computer. |
| 127 | + |
| 128 | +1. Open the downloaded.rdp* file. |
| 129 | + |
| 130 | + 1. If prompted, select **Connect**. |
| 131 | + |
| 132 | + 1. Enter the username and password you specified when creating the VM. |
| 133 | + |
| 134 | + > [!NOTE] |
| 135 | + > You may need to select **More choices** > **Use a different account**, to specify the credentials you entered when you created the VM. |
| 136 | +
|
| 137 | +1. Select **OK**. |
| 138 | + |
| 139 | +1. You may receive a certificate warning during the sign-in process. If you receive a certificate warning, select **Yes** or **Continue**. |
| 140 | + |
| 141 | +1. Once the VM desktop appears, minimize it to go back to your local desktop. |
| 142 | + |
| 143 | +## Access DQL Database Server privately from the VM |
| 144 | + |
| 145 | +In this section, you will connect to the SQL Database Server from the VM using the Private Endpoint. |
| 146 | + |
| 147 | + 1. In the Remote Desktop of *myVM*, open PowerShell. |
| 148 | + 2. Enter nslookup myserver.database.windows.net |
| 149 | + You'll receive a message similar to this: |
| 150 | + |
| 151 | +``` |
| 152 | + Server: UnKnown |
| 153 | + Address: 168.63.129.16 |
| 154 | + Non-authoritative answer: |
| 155 | + Name: myserver.privatelink.database.windows.net |
| 156 | + Address: 10.0.0.5 |
| 157 | + Aliases: myserver.database.windows.net |
| 158 | +``` |
| 159 | + 3. Install SQL Server Management Studio |
| 160 | + 4. In Connect to server, enter or select this information: |
| 161 | + Server type: Select Database Engine. |
| 162 | + Server name: Select myserver.database.windows.net |
| 163 | + Username: Enter a username provided during creation. |
| 164 | + Password: Enter a password provided during creation. |
| 165 | + Remember password: Select Yes. |
| 166 | + |
| 167 | + 5. Select **Connect**. |
| 168 | + 6. Browse **Databases** from left menu. |
| 169 | + 7. (Optionally) Create or query information from *mydatabase* |
| 170 | + 8. Close the remote desktop connection to *myVm*. |
| 171 | + |
| 172 | +## Clean up resources |
| 173 | +When no longer needed, you can use az group delete to remove the resource group and all the resources it has: |
| 174 | + |
| 175 | +```azurecli-interactive |
| 176 | +az group delete --name myResourceGroup --yes |
| 177 | +``` |
| 178 | + |
| 179 | +## Next steps |
| 180 | +- Learn more about [Azure Private Link](private-link-overview.md) |
| 181 | + |
0 commit comments