You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/virtual-network-manager/how-to-block-high-risk-ports.md
+10-11Lines changed: 10 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,15 +5,15 @@ author: mbender-ms
5
5
ms.author: mbender
6
6
ms.service: virtual-network-manager
7
7
ms.topic: how-to #Required; leave this attribute/value as-is.
8
-
ms.date: 06/28/2022
8
+
ms.date: 01/10/2023
9
9
ms.custom: template-how-to #Required; leave this attribute/value as-is.
10
10
---
11
11
# Protect high-risk network ports with Security Admin Rules in Azure Virtual Network Manager
12
12
13
13
14
-
In this article, you'll learn to block high risk network ports using [Azure Virtual Network Manager](overview.md) and Security Admin Rules. You'll walk through the creation of an Azure Virtual Network Manager instance, group your virtual networks (VNets) with [network groups](concept-network-groups.md), and create & deploy security admin configurations for your organization. You'll deploy a general block rule for high risk ports. Then you'll create an exception for managing a specific application's VNet. This allows you to manage access to the application VNets using network security groups.
14
+
In this article, you'll learn to block high risk network ports using [Azure Virtual Network Manager](overview.md) and Security Admin Rules. You'll walk through the creation of an Azure Virtual Network Manager instance, group your virtual networks (VNets) with [network groups](concept-network-groups.md), and create & deploy security admin configurations for your organization. You'll deploy a general block rule for high risk ports. Then you'll create an exception for managing a specific application's VNet using network security groups.
15
15
16
-
While this article focuses on a single port, SSH, you can use protect any high-risk ports in your environment with the same steps. To learn more, review this list of [high risk ports](concept-security-admins.md#protect-high-risk-ports)
16
+
While this article focuses on a single port, SSH, you can protect any high-risk ports in your environment with the same steps. To learn more, review this list of [high risk ports](concept-security-admins.md#protect-high-risk-ports)
17
17
18
18
> [!IMPORTANT]
19
19
> Azure Virtual Network Manager is currently in public preview.
@@ -26,8 +26,7 @@ While this article focuses on a single port, SSH, you can use protect any high-r
26
26
* A group of virtual networks that can be split into network groups for applying granular security admin rules.
27
27
28
28
## Deploy virtual network environment
29
-
30
-
For this how-to, you'll need a virtual network environment that includes virtual networks that can be segregated for allowing and blocking specific network traffic. You may use the following table or your own configuration of virtual networks:
29
+
You'll need a virtual network environment that includes virtual networks that can be segregated for allowing and blocking specific network traffic. You may use the following table or your own configuration of virtual networks:
31
30
32
31
| Name | IPv4 address space | subnet |
33
32
| ---- | ----| ---- |
@@ -66,7 +65,7 @@ In this section, you'll deploy a Virtual Network Manager instance with the Secur
66
65
67
66
## Create a network group
68
67
69
-
With your virtual network manager created, you now create a network group to encapsulate the VNets you want to protect. This will include all of the VNets in the organization as a general all-encompassing rule to block high risk network ports is needed. You'll manually add all of the VNets.
68
+
With your virtual network manager created, you now create a network group containing all of the VNets in the organization. You'll manually add all of the VNets.
70
69
1. Select **Network Groups**, under **Settings**.
71
70
1. Select **+ Create**, enter a *name* for the network group, and select **Add**.
72
71
1. On the *Network groups* page, select the network group you created.
@@ -82,9 +81,9 @@ It’s time to construct our security admin rules within a configuration in orde
82
81
83
82
:::image type="content" source="./media/create-virtual-network-manager-portal/add-configuration.png" alt-text="Screenshot of add a security admin configuration.":::
84
83
85
-
1. Select **Security admin configuration** from the drop-down menu.
84
+
1. Select **Security configuration** from the drop-down menu.
86
85
87
-
:::image type="content" source="./media/how-to-block-network-traffic-portal/security-admin-drop-down.png" alt-text="Screenshot of add a configuration drop-down.":::
86
+
:::image type="content" source="./media/create-virtual-network-manager-portal/security-admin-dropdown.png" alt-text="Screenshot of add a configuration drop-down.":::
88
87
89
88
1. On the **Basics** tab, enter a *Name* to identify this security configuration and select **Next: Rule collections**.
90
89
@@ -136,7 +135,7 @@ In this section, you define the security rule to block high-risk network traffic
136
135
1. Then select **Review + Create** and **Create** to complete the security configuration.
137
136
## Deploy a security admin configuration
138
137
139
-
In this section, you deploy the newly created security admin configuration to block high-risk ports to your network group. This is how the security admin configuration will take effect on the virtual networks included in the network group
138
+
In this section, the rules created will take effect when you deploy the security admin configuration.
140
139
141
140
1. Select **Deployments** under *Settings*, then select **Deploy configuration**.
142
141
@@ -149,7 +148,7 @@ In this section, you deploy the newly created security admin configuration to bl
149
148
1. Select **Next** and **Deploy** to deploy the security admin configuration.
150
149
## Create a network group for exception virtual networks
151
150
152
-
With traffic blocked across all of your VNets, you need an exception to allow traffic to specific virtual networks. To do this, you'll create a network group specifically for the VNets needing exclusion from the other security admin rule above.
151
+
With traffic blocked across all of your VNets, you need an exception to allow traffic to specific virtual networks. You'll create a network group specifically for the VNets needing exclusion from the other security admin rule.
153
152
154
153
1. From your virtual network manager, select **Network Groups**, under **Settings**.
155
154
1. Select **+ Create**, enter a *name* for the application network group, and select **Add**.
@@ -162,7 +161,7 @@ With traffic blocked across all of your VNets, you need an exception to allow tr
162
161
163
162
## Create an exception Security Admin Rule collection and Rule
164
163
165
-
In this section, you create a new rule collection that will allow high-risk traffic to a subset of virtual networks you've defined in a network group, and create security admin rule to add to our existing security admin configuration.
164
+
In this section, you create a new rule collection and security admin rule that will allow high-risk traffic to the subset of virtual networks you've defined as exceptions. Next, you'll add it to your existing security admin configuration.
166
165
167
166
> [!IMPORTANT]
168
167
> In order for your security admin rule to allow traffic to your application virtual networks, the priority needs to be set to a **lower number** than existing rules blocking traffic.
Copy file name to clipboardExpand all lines: articles/virtual-network-manager/how-to-block-network-traffic-portal.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ author: mbender-ms
5
5
ms.author: mbender
6
6
ms.service: virtual-network-manager
7
7
ms.topic: how-to
8
-
ms.date: 07/01/2022
8
+
ms.date: 01/10/2023
9
9
ms.custom: template-how-to, ignite-fall-2021
10
10
---
11
11
@@ -31,9 +31,9 @@ Before you start to configure security admin rules, confirm that you've done the
31
31
32
32
:::image type="content" source="./media/create-virtual-network-manager-portal/add-configuration.png" alt-text="Screenshot of add a security admin configuration.":::
33
33
34
-
1. Select **Security admin configuration** from the drop-down menu.
34
+
1. Select **Security configuration** from the drop-down menu.
35
35
36
-
:::image type="content" source="./media/how-to-block-network-traffic-portal/security-admin-drop-down.png" alt-text="Screenshot of add a configuration drop-down.":::
36
+
:::image type="content" source="./media/create-virtual-network-manager-portal/security-admin-dropdown.png" alt-text="Screenshot of add a configuration drop-down.":::
37
37
38
38
1. On the **Basics** tab, enter a *Name* to identify this security configuration and select **Next: Rule collections**.
39
39
@@ -68,7 +68,7 @@ Before you start to configure security admin rules, confirm that you've done the
68
68
| Source IP addresses | This field will appear when you select the source type of *IP address*. Enter an IPv4 or IPv6 address or a range using CIDR notation. When defining more than one address or blocks of addresses separate using a comma. Leave blank for this example.|
69
69
| Source service tag | This field will appear when you select the source type of *Service tag*. Select service tag(s) for services you want to specify as the source. See [Available service tags](../virtual-network/service-tags-overview.md#available-service-tags), for the list of supported tags. |
70
70
| Source port | Enter a single port number or a port range such as (1024-65535). When defining more than one port or port ranges, separate them using a comma. To specify any port, enter *. Leave blank for this example.|
71
-
|**Desination**||
71
+
|**Destination**||
72
72
| Destination type | Select the destination type of either **IP address** or **Service tags**. |
73
73
| Destination IP addresses | This field will appear when you select the destination type of *IP address*. Enter an IPv4 or IPv6 address or a range using CIDR notation. When defining more than one address or blocks of addresses separate using a comma. |
74
74
| Destination service tag | This field will appear when you select the destination type of *Service tag*. Select service tag(s) for services you want to specify as the destination. See [Available service tags](../virtual-network/service-tags-overview.md#available-service-tags), for the list of supported tags. |
# Tutorial: Create a secured hub and spoke network
@@ -150,7 +150,7 @@ Deploy a virtual network gateway into the hub virtual network. This virtual netw
150
150
151
151
1. Select **Configuration** under *Settings*, then select **+ Add a configuration**. Select **Connectivity** from the drop-down menu.
152
152
153
-
:::image type="content" source="./media/tutorial-create-secured-hub-and-spoke/add-configuration.png" alt-text="Screenshot of add a configuration button for Network Manager.":::
153
+
:::image type="content" source="./media/create-virtual-network-manager-portal/connectivity-configuration-dropdown.png" alt-text="Screenshot of configuration drop-down menu.":::
154
154
155
155
1. On the **Basics** tab, enter and select the following information for the connectivity configuration:
0 commit comments