You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/logic-apps/ise-manage-integration-service-environment.md
+121-6Lines changed: 121 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ services: logic-apps
5
5
ms.suite: integration
6
6
ms.reviewer: estfan, azla
7
7
ms.topic: how-to
8
-
ms.date: 08/29/2023
8
+
ms.date: 09/27/2023
9
9
---
10
10
11
11
# Manage your integration service environment (ISE) in Azure Logic Apps
@@ -21,25 +21,27 @@ ms.date: 08/29/2023
21
21
> before this date are supported through August 31, 2024. For more information, see the following resources:
22
22
>
23
23
> -[ISE Retirement - what you need to know](https://techcommunity.microsoft.com/t5/integrations-on-azure-blog/ise-retirement-what-you-need-to-know/ba-p/3645220)
24
-
> -[Single-tenant versus multi-tenant and integration service environment for Azure Logic Apps](single-tenant-overview-compare.md)
24
+
> -[Single-tenant versus multitenant and integration service environment for Azure Logic Apps](single-tenant-overview-compare.md)
> -[Export ISE workflows to a Standard logic app](export-from-ise-to-standard-logic-app.md)
27
27
> -[Integration Services Environment will be retired on 31 August 2024 - transition to Logic Apps Standard](https://azure.microsoft.com/updates/integration-services-environment-will-be-retired-on-31-august-2024-transition-to-logic-apps-standard/)
28
28
> -[Cloud Services (classic) deployment model is retiring on 31 August 2024](https://azure.microsoft.com/updates/cloud-services-retirement-announcement/)
29
29
30
30
This article shows how to perform management tasks for your [integration service environment (ISE)](../logic-apps/connect-virtual-network-vnet-isolated-environment-overview.md), for example:
31
31
32
-
* Manage the resources such as multi-tenant based logic apps, connections, integration accounts, and connectors in your ISE.
32
+
* Find and view your ISE.
33
+
34
+
* Enable access for your ISE.
33
35
34
36
* Check your ISE's network health.
35
37
38
+
* Manage the resources such as multitenant based logic apps, connections, integration accounts, and connectors in your ISE.
39
+
36
40
* Add capacity, restart your ISE, or delete your ISE, follow the steps in this topic. To add these artifacts to your ISE, see [Add artifacts to your integration service environment](../logic-apps/add-artifacts-integration-service-environment-ise.md).
37
41
38
42
## View your ISE
39
43
40
-
1. Sign in to the [Azure portal](https://portal.azure.com).
41
-
42
-
1. In the portal's search box, enter "integration service environments", and then select **Integration Service Environments**.
44
+
1. In the [Azure portal](https://portal.azure.com) search box, enter **integration service environments**, and select **Integration Service Environments**.
43
45
44
46
45
47
@@ -49,6 +51,119 @@ This article shows how to perform management tasks for your [integration service
49
51
50
52
1. Continue to the next sections to find logic apps, connections, connectors, or integration accounts in your ISE.
51
53
54
+
## Enable access for your ISE
55
+
56
+
When you use an ISE with an Azure virtual network, a common setup problem is having one or more blocked ports. The connectors that you use for creating connections between your ISE and destination systems might also have their own port requirements. For example, if you communicate with an FTP system by using the FTP connector, the port that you use on your FTP system needs to be available, for example, port 21 for sending commands.
57
+
58
+
To make sure that your ISE is accessible and that the logic apps in that ISE can communicate across each subnet in your virtual network, [open the ports described in this table for each subnet](#network-ports-for-ise). If any required ports are unavailable, your ISE won't work correctly.
59
+
60
+
* If you have multiple ISE instances that need access to other endpoints that have IP restrictions, deploy an [Azure Firewall](../firewall/overview.md) or a [network virtual appliance](../virtual-network/virtual-networks-overview.md#filter-network-traffic) into your virtual network and route outbound traffic through that firewall or network virtual appliance. You can then [set up a single, outbound, public, static, and predictable IP address](connect-virtual-network-vnet-set-up-single-ip-address.md) that all the ISE instances in your virtual network can use to communicate with destination systems. That way, you don't have to set up extra firewall openings at those destination systems for each ISE.
61
+
62
+
> [!NOTE]
63
+
> You can use this approach for a single ISE when your scenario requires limiting the
64
+
> number of IP addresses that need access. Consider whether the extra costs for
65
+
> the firewall or virtual network appliance make sense for your scenario. Learn more about
* If you created a new Azure virtual network and subnets without any constraints, you don't need to set up [network security groups (NSGs)](../virtual-network/network-security-groups-overview.md#network-security-groups) in your virtual network to control traffic across subnets.
69
+
70
+
* For an existing virtual network, you can *optionally* set up [network security groups (NSGs)](../virtual-network/network-security-groups-overview.md#network-security-groups) to [filter network traffic across subnets](../virtual-network/tutorial-filter-network-traffic.md). If you want to go this route, or if you're already using NSGs, make sure that you [open the ports described in this table](#network-ports-for-ise) for those NSGs.
71
+
72
+
When you set up [NSG security rules](../virtual-network/network-security-groups-overview.md#security-rules), you need to use *both* the **TCP** and **UDP** protocols, or you can select **Any** instead so you don't have to create separate rules for each protocol. NSG security rules describe the ports that you must open for the IP addresses that need access to those ports. Make sure that any firewalls, routers, or other items that exist between these endpoints also keep those ports accessible to those IP addresses.
73
+
74
+
* For an ISE that has *external* endpoint access, you must create a network security group (NSG), if you don't have one already. You need to add an inbound security rule to the NSG to allow traffic from managed connector outbound IP addresses. To set up this rule, follow these steps:
75
+
76
+
1. On your ISE menu, under **Settings**, select **Properties**.
77
+
78
+
1. Under **Connector outgoing IP addresses**, copy the public IP address ranges, which also appear in this article, [Limits and configuration - Outbound IP addresses](logic-apps-limits-and-config.md#outbound).
79
+
80
+
1. Create a network security group, if you don't have one already.
81
+
82
+
1. Based on the following information, add an inbound security rule for the public outbound IP addresses that you copied. For more information, review [Tutorial: Filter network traffic with a network security group using the Azure portal](../virtual-network/tutorial-filter-network-traffic.md#create-a-network-security-group).
83
+
84
+
| Purpose | Source service tag or IP addresses | Source ports | Destination service tag or IP addresses | Destination ports | Notes |
| Permit traffic from connector outbound IP addresses | <*connector-public-outbound-IP-addresses*> | * | Address space for the virtual network with ISE subnets | * ||
87
+
88
+
* If you set up forced tunneling through your firewall to redirect Internet-bound traffic, review the [forced tunneling requirements](#forced-tunneling).
89
+
90
+
<aname="network-ports-for-ise"></a>
91
+
92
+
### Network ports used by your ISE
93
+
94
+
This table describes the ports that your ISE requires to be accessible and the purpose for those ports. To help reduce complexity when you set up security rules, the table uses [service tags](../virtual-network/service-tags-overview.md) that represent groups of IP address prefixes for a specific Azure service. Where noted, *internal ISE* and *external ISE* refer to the [access endpoint that's selected during ISE creation](connect-virtual-network-vnet-isolated-environment.md#create-environment). For more information, review [Endpoint access](connect-virtual-network-vnet-isolated-environment-overview.md#endpoint-access).
95
+
96
+
> [!IMPORTANT]
97
+
>
98
+
> For all rules, make sure that you set source ports to `*` because source ports are ephemeral.
99
+
100
+
#### Inbound security rules
101
+
102
+
| Source ports | Destination ports | Source service tag or IP addresses | Destination service tag or IP addresses | Purpose | Notes |
| * | * | Address space for the virtual network with ISE subnets | Address space for the virtual network with ISE subnets | Intersubnet communication within virtual network. | Required for traffic to flow *between* the subnets in your virtual network. <br><br>**Important**: For traffic to flow between the *components* in each subnet, make sure that you open all the ports within each subnet. |
105
+
| * | 443 | Internal ISE: <br>**VirtualNetwork** <br><br>External ISE: **Internet** or see **Notes**|**VirtualNetwork**| - Communication to your logic app <br><br>- Runs history for your logic app | Rather than use the **Internet** service tag, you can specify the source IP address for these items: <br><br>- The computer or service that calls any request triggers or webhooks in your logic app <br><br>- The computer or service from where you want to access logic app runs history <br><br>**Important**: Closing or blocking this port prevents calls to logic apps that have request triggers or webhooks. You're also prevented from accessing inputs and outputs for each step in runs history. However, you're not prevented from accessing logic app runs history. |
106
+
| * | 454 |**LogicAppsManagement**|**VirtualNetwork**| Azure Logic Apps designer - dynamic properties| Requests come from the Azure Logic Apps access endpoint's [inbound IP addresses](logic-apps-limits-and-config.md#inbound) for that region. <br><br>**Important**: If you're working with Azure Government cloud, the **LogicAppsManagement** service tag won't work. Instead, you have to provide the Azure Logic Apps [inbound IP addresses](logic-apps-limits-and-config.md#azure-government-inbound) for Azure Government. |
107
+
| * | 454 |**LogicApps**|**VirtualNetwork**| Network health check | Requests come from the Azure Logic Apps access endpoint's [inbound IP addresses](logic-apps-limits-and-config.md#inbound) and [outbound IP addresses](logic-apps-limits-and-config.md#outbound) for that region. <br><br>**Important**: If you're working with Azure Government cloud, the **LogicApps** service tag won't work. Instead, you have to provide both the Azure Logic Apps [inbound IP addresses](logic-apps-limits-and-config.md#azure-government-inbound) and [outbound IP addresses](logic-apps-limits-and-config.md#azure-government-outbound) for Azure Government. |
108
+
| * | 454 |**AzureConnectors**|**VirtualNetwork**| Connector deployment | Required to deploy and update connectors. Closing or blocking this port causes ISE deployments to fail and prevents connector updates and fixes. <br><br>**Important**: If you're working with Azure Government cloud, the **AzureConnectors** service tag won't work. Instead, you have to provide the [managed connector outbound IP addresses](logic-apps-limits-and-config.md#azure-government-outbound) for Azure Government. |
| * | Internal ISE: 454 <br><br>External ISE: 443 |**AzureTrafficManager**|**VirtualNetwork**| Communication from Azure Traffic Manager ||
111
+
| * | 3443 |**APIManagement**|**VirtualNetwork**| Connector policy deployment <br><br>API Management - management endpoint | For connector policy deployment, port access is required to deploy and update connectors. Closing or blocking this port causes ISE deployments to fail and prevents connector updates and fixes. |
112
+
| * | 6379 - 6383, plus see **Notes**|**VirtualNetwork**|**VirtualNetwork**| Access Azure Cache for Redis Instances between Role Instances | For ISE to work with Azure Cache for Redis, you must open these [outbound and inbound ports described by the Azure Cache for Redis FAQ](../azure-cache-for-redis/cache-how-to-premium-vnet.md#outbound-port-requirements). |
113
+
114
+
#### Outbound security rules
115
+
116
+
| Source ports | Destination ports | Source service tag or IP addresses | Destination service tag or IP addresses | Purpose | Notes |
| * | * | Address space for the virtual network with ISE subnets | Address space for the virtual network with ISE subnets | Intersubnet communication within virtual network | Required for traffic to flow *between* the subnets in your virtual network. <br><br>**Important**: For traffic to flow between the *components* in each subnet, make sure that you open all the ports within each subnet. |
119
+
| * | 443, 80 |**VirtualNetwork**| Internet | Communication from your logic app | This rule is required for Secure Socket Layer (SSL) certificate verification. This check is for various internal and external sites, which is the reason that the Internet is required as the destination. |
120
+
| * | Varies based on destination |**VirtualNetwork**| Varies based on destination | Communication from your logic app | Destination ports vary based on the endpoints for the external services with which your logic app needs to communicate. <br><br>For example, the destination port is port 25 for an SMTP service, port 22 for an SFTP service, and so on. |
121
+
| * | 80, 443 |**VirtualNetwork**|**AzureActiveDirectory**| Azure Active Directory ||
| * | 1886 |**VirtualNetwork**|**AzureMonitor**| Azure Resource Health | Required for publishing health status to Resource Health. |
127
+
| * | 5672 |**VirtualNetwork**|**EventHub**| Dependency from Log to Event Hubs policy and monitoring agent ||
128
+
| * | 6379 - 6383, plus see **Notes**|**VirtualNetwork**|**VirtualNetwork**| Access Azure Cache for Redis Instances between Role Instances | For ISE to work with Azure Cache for Redis, you must open these [outbound and inbound ports described by the Azure Cache for Redis FAQ](../azure-cache-for-redis/cache-how-to-premium-vnet.md#outbound-port-requirements). |
129
+
| * | 53 |**VirtualNetwork**| IP addresses for any custom Domain Name System (DNS) servers on your virtual network | DNS name resolution | Required only when you use custom DNS servers on your virtual network |
130
+
131
+
In addition, you need to add outbound rules for [App Service Environment (ASE)](../app-service/environment/intro.md):
132
+
133
+
* If you use Azure Firewall, you need to set up your firewall with the App Service Environment (ASE) [fully qualified domain name (FQDN) tag](../firewall/fqdn-tags.md#current-fqdn-tags), which permits outbound access to ASE platform traffic.
134
+
135
+
* If you use a firewall appliance other than Azure Firewall, you need to set up your firewall with *all* the rules listed in the [firewall integration dependencies](../app-service/environment/firewall-integration.md#dependencies) that are required for App Service Environment.
136
+
137
+
<aname="forced-tunneling"></a>
138
+
139
+
#### Forced tunneling requirements
140
+
141
+
If you set up or use [forced tunneling](../firewall/forced-tunneling.md) through your firewall, you have to permit extra external dependencies for your ISE. Forced tunneling lets you redirect Internet-bound traffic to a designated next hop, such as your virtual private network (VPN) or to a virtual appliance, rather than to the Internet so that you can inspect and audit outbound network traffic.
142
+
143
+
If you don't permit access for these dependencies, your ISE deployment fails and your deployed ISE stops working.
144
+
145
+
* User-defined routes
146
+
147
+
To prevent asymmetric routing, you must define a route for each and every IP address that's listed below with **Internet** as the next hop.
148
+
149
+
*[Azure Logic Apps inbound and outbound addresses for the ISE region](logic-apps-limits-and-config.md#firewall-configuration-ip-addresses-and-service-tags)
150
+
*[Azure IP addresses for connectors in the ISE region, available in this download file](https://www.microsoft.com/download/details.aspx?id=56519)
151
+
*[App Service Environment management addresses](../app-service/environment/management-addresses.md)
*[Azure API Management Control Plane IP addresses](../api-management/virtual-network-reference.md#control-plane-ip-addresses)
154
+
155
+
* Service endpoints
156
+
157
+
You need to enable service endpoints for Azure SQL, Storage, Service Bus, KeyVault, and Event Hubs because you can't send traffic through a firewall to these services.
158
+
159
+
* Other inbound and outbound dependencies
160
+
161
+
Your firewall *must* allow the following inbound and outbound dependencies:
162
+
163
+
*[Azure App Service Dependencies](../app-service/environment/firewall-integration.md#deploying-your-ase-behind-a-firewall)
164
+
*[Azure Cache Service Dependencies](../azure-cache-for-redis/cache-how-to-premium-vnet.md#what-are-some-common-misconfiguration-issues-with-azure-cache-for-redis-and-virtual-networks)
165
+
*[Azure API Management Dependencies](../api-management/virtual-network-reference.md)
0 commit comments