Skip to content

Commit 8bb5e68

Browse files
v-dirichardsv-dirichards
authored
Merge pull request #224971 from asudbring/ddos-nat
Added article for enabling DDoS protection for a NAT gateway
2 parents 95d9f22 + e4cab4b commit 8bb5e68

File tree

2 files changed

+240
-0
lines changed

2 files changed

+240
-0
lines changed

‎articles/virtual-network/nat-gateway/toc.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@ items:
3333
href: tutorial-migrate-outbound-nat.md
3434
- name: Migrate a virtual machine public IP address
3535
href: tutorial-migrate-ilip-nat.md
36+
- name: Deploy a NAT gateway with DDoS protection
37+
href: tutorial-protect-nat-gateway.md
3638
expanded: true
3739
- name: Concepts
3840
items:

‎articles/virtual-network/nat-gateway/tutorial-protect-nat-gateway.md

Lines changed: 238 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,238 @@
1+
---
2+
title: 'Tutorial: Protect your NAT gateway with Azure DDoS Protection Standard'
3+
titlesuffix: Azure Virtual Network NAT
4+
description: Learn how to create an NAT gateway in an Azure DDoS Protection Standard protected virtual network.
5+
author: asudbring
6+
ms.author: allensu
7+
ms.service: virtual-network
8+
ms.subservice: nat
9+
ms.topic: tutorial
10+
ms.date: 01/24/2022
11+
---
12+
13+
# Tutorial: Protect your NAT gateway with Azure DDoS Protection Standard
14+
15+
This article helps you create an Azure Virtual Network NAT gateway with a DDoS protected virtual network. Azure DDoS Protection Standard enables enhanced DDoS mitigation capabilities such as adaptive tuning, attack alert notifications, and monitoring to protect your NAT gateway from large scale DDoS attacks.
16+
17+
> [!IMPORTANT]
18+
> Azure DDoS Protection incurs a cost when you use the Standard SKU. Overages charges only apply if more than 100 public IPs are protected in the tenant. Ensure you delete the resources in this tutorial if you aren't using the resources in the future. For information about pricing, see [Azure DDoS Protection Pricing]( https://azure.microsoft.com/pricing/details/ddos-protection/). For more information about Azure DDoS protection, see [What is Azure DDoS Protection?](../../ddos-protection/ddos-protection-overview.md).
19+
20+
In this tutorial, you learn how to:
21+
22+
> [!div class="checklist"]
23+
> * Create a NAT gateway
24+
> * Create a DDoS protection plan
25+
> * Create a virtual network and associate the DDoS protection plan
26+
> * Create a test virtual machine
27+
> * Test the NAT gateway
28+
29+
## Prerequisites
30+
31+
- An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
32+
33+
## Create a NAT gateway
34+
35+
Before you deploy the NAT gateway resource and the other resources, a resource group is required to contain the resources deployed. In the following steps, you'll create a resource group, NAT gateway resource, and a public IP address. You can use one or more public IP address resources, public IP prefixes, or both.
36+
37+
For information about public IP prefixes and a NAT gateway, see [Manage NAT gateway](./manage-nat-gateway.md?tabs=manage-nat-portal#add-or-remove-a-public-ip-prefix).
38+
39+
1. Sign in to the [Azure portal](https://portal.azure.com).
40+
41+
2. In the search box at the top of the portal, enter **NAT gateway**. Select **NAT gateways** in the search results.
42+
43+
3. Select **+ Create**.
44+
45+
4. In **Create network address translation (NAT) gateway**, enter or select this information in the **Basics** tab:
46+
47+
| **Setting** | **Value** |
48+
|------------------|-----------------------------------------------------------------|
49+
| **Project Details** | |
50+
| Subscription | Select your Azure subscription. |
51+
| Resource Group | Select **Create new**. </br> Enter **myResourceGroupNAT**. </br> Select **OK**. |
52+
| **Instance details** | |
53+
| NAT gateway name | Enter **myNATgateway** |
54+
| Region | Select **West Europe** |
55+
| Availability Zone | Select **No Zone**. |
56+
| Idle timeout (minutes) | Enter **10**. |
57+
58+
For information about availability zones and NAT gateway, see [NAT gateway and availability zones](./nat-availability-zones.md).
59+
60+
5. Select the **Outbound IP** tab, or select the **Next: Outbound IP** button at the bottom of the page.
61+
62+
6. In the **Outbound IP** tab, enter or select the following information:
63+
64+
| **Setting** | **Value** |
65+
| ----------- | --------- |
66+
| Public IP addresses | Select **Create a new public IP address**. </br> In **Name**, enter **myPublicIP**. </br> Select **OK**. |
67+
68+
7. Select the **Review + create** tab, or select the blue **Review + create** button at the bottom of the page.
69+
70+
8. Select **Create**.
71+
72+
## Create a DDoS protection plan
73+
74+
1. In the search box at the top of the portal, enter **DDoS protection**. Select **DDoS protection plans** in the search results and then select **+ Create**.
75+
76+
1. In the **Basics** tab of **Create a DDoS protection plan** page, enter or select the following information:
77+
78+
| Setting | Value |
79+
|--|--|
80+
| **Project details** | |
81+
| Subscription | Select your Azure subscription. |
82+
| Resource group | Enter **myResourceGroupNAT**. |
83+
| **Instance details** | |
84+
| Name | Enter **myDDoSProtectionPlan**. |
85+
| Region | Select **West Europe**. |
86+
87+
1. Select **Review + create** and then select **Create** to deploy the DDoS protection plan.
88+
89+
## Create a virtual network
90+
91+
Before you deploy a virtual machine and can use your NAT gateway, you need to create the virtual network. This virtual network will contain the virtual machine created in later steps.
92+
93+
1. In the search box at the top of the portal, enter **Virtual network**. Select **Virtual networks** in the search results.
94+
95+
2. Select **Create**.
96+
97+
3. In **Create virtual network**, enter or select this information in the **Basics** tab:
98+
99+
| **Setting** | **Value** |
100+
|------------------|-----------------------------------------------------------------|
101+
| **Project Details** | |
102+
| Subscription | Select your Azure subscription |
103+
| Resource Group | Select **myResourceGroupNAT**. |
104+
| **Instance details** | |
105+
| Name | Enter **myVNet** |
106+
| Region | Select **(Europe) West Europe** |
107+
108+
4. Select the **IP Addresses** tab or select the **Next: IP Addresses** button at the bottom of the page.
109+
110+
5. Accept the default IPv4 address space of **10.1.0.0/16**.
111+
112+
6. In the subnet section in **Subnet name**, select the **default** subnet.
113+
114+
7. In **Edit subnet**, enter this information:
115+
116+
| Setting | Value |
117+
|--------------------|----------------------------|
118+
| Subnet name | Enter **mySubnet** |
119+
| Subnet address range | Enter **10.1.0.0/24** |
120+
| **NAT GATEWAY** |
121+
| NAT gateway | Select **myNATgateway**. |
122+
123+
8. Select **Save**.
124+
125+
9. Select the **Security** tab.
126+
127+
10. In **BastionHost**, select **Enable**. Enter this information:
128+
129+
| Setting | Value |
130+
|--------------------|----------------------------|
131+
| Bastion name | Enter **myBastionHost** |
132+
| AzureBastionSubnet address space | Enter **10.1.1.0/26** |
133+
| Public IP Address | Select **Create new**. </br> For **Name**, enter **myBastionIP**. </br> Select **OK**. |
134+
135+
11. In **DDoS protection** select **Enable**. Select **myDDoSProtectionPlan** in DDoS protection plan.
136+
137+
12. Select the **Review + create** tab or select the **Review + create** button.
138+
139+
13. Select **Create**.
140+
141+
It can take a few minutes for the deployment of the virtual network to complete. Proceed to the next steps when the deployment completes.
142+
143+
## Create test virtual machine
144+
145+
In this section, you'll create a virtual machine to test the NAT gateway and verify the public IP address of the outbound connection.
146+
147+
1. In the search box at the top of the portal, enter **Virtual machine**. Select **Virtual machines** in the search results.
148+
149+
2. Select **+ Create** > **Azure virtual machine**.
150+
151+
2. In the **Create a virtual machine** page in the **Basics** tab, enter, or select the following information:
152+
153+
| **Setting** | **Value** |
154+
| ----------- | --------- |
155+
| **Project details** | |
156+
| Subscription | Select your subscription. |
157+
| Resource group | Select **myResourceGroupNAT**. |
158+
| **Instance details** | |
159+
| Virtual machine name | Enter **myVM**. |
160+
| Region | Select **(Europe) West Europe**. |
161+
| Availability options | Select **No infrastructure redundancy required**. |
162+
| Security type | Select **Standard**. |
163+
| Image | Select **Windows Server 2022 Datacenter: Azure Edition - Gen2**. |
164+
| Size | Select a size. |
165+
| **Administrator account** | |
166+
| Username | Enter a username for the virtual machine. |
167+
| Password | Enter a password. |
168+
| Confirm password | Confirm password. |
169+
| **Inbound port rules** | |
170+
| Public inbound ports | Select **None**. |
171+
172+
3. Select the **Disks** tab, or select the **Next: Disks** button at the bottom of the page.
173+
174+
4. Leave the default in the **Disks** tab.
175+
176+
5. Select the **Networking** tab, or select the **Next: Networking** button at the bottom of the page.
177+
178+
6. In the **Networking** tab, enter or select the following information:
179+
180+
| **Setting** | **Value** |
181+
| ----------- | --------- |
182+
| **Network interface** | |
183+
| Virtual network | Select **myVNet**. |
184+
| Subnet | Select **mySubnet (10.1.0.0/24)**. |
185+
| Public IP | Select **None**. |
186+
| NIC network security group | Select **Basic**. |
187+
| Public inbound ports | Select **None**. |
188+
189+
7. Select the **Review + create** tab, or select the blue **Review + create** button at the bottom of the page.
190+
191+
8. Select **Create**.
192+
193+
## Test NAT gateway
194+
195+
In this section, you'll test the NAT gateway. You'll first discover the public IP of the NAT gateway. You'll then connect to the test virtual machine and verify the outbound connection through the NAT gateway.
196+
197+
1. In the search box at the top of the portal, enter **Public IP**. Select **Public IP addresses** in the search results.
198+
199+
2. Select **myPublicIP**.
200+
201+
3. Make note of the public IP address:
202+
203+
:::image type="content" source="./media/quickstart-create-nat-gateway-portal/find-public-ip.png" alt-text="Screenshot of discover public IP address of NAT gateway." border="true":::
204+
205+
4. In the search box at the top of the portal, enter **Virtual machine**. Select **Virtual machines** in the search results.
206+
207+
5. Select **myVM**.
208+
209+
4. On the **Overview** page, select **Connect**, then **Bastion**.
210+
211+
6. Enter the username and password entered during VM creation. Select **Connect**.
212+
213+
7. Open **Microsoft Edge** on **myTestVM**.
214+
215+
8. Enter **https://whatsmyip.com** in the address bar.
216+
217+
9. Verify the IP address displayed matches the NAT gateway address you noted in the previous step:
218+
219+
:::image type="content" source="./media/quickstart-create-nat-gateway-portal/my-ip.png" alt-text="Screenshot of Internet Explorer showing external outbound IP." border="true":::
220+
221+
## Clean up resources
222+
223+
If you're not going to continue to use this application, delete
224+
the virtual network, virtual machine, and NAT gateway with the following steps:
225+
226+
1. From the left-hand menu, select **Resource groups**.
227+
228+
2. Select the **myResourceGroupNAT** resource group.
229+
230+
3. Select **Delete resource group**.
231+
232+
4. Enter **myResourceGroupNAT** and select **Delete**.
233+
234+
## Next steps
235+
236+
For more information on Azure Virtual Network NAT, see:
237+
> [!div class="nextstepaction"]
238+
> [Virtual Network NAT overview](nat-overview.md)

0 commit comments

Comments
 (0)