|
| 1 | +--- |
| 2 | +title: 'Connect Azure Front Door Premium to an Azure API Management origin with Private Link (Preview)' |
| 3 | +titleSuffix: Azure Private Link |
| 4 | +description: Learn how to connect your Azure Front Door Premium to an Azure API Management privately. |
| 5 | +services: frontdoor |
| 6 | +author: duongau |
| 7 | +ms.service: azure-frontdoor |
| 8 | +ms.topic: how-to |
| 9 | +ms.date: 09/26/2024 |
| 10 | +ms.author: duau |
| 11 | +zone_pivot_groups: front-door-dev-exp-ps-cli |
| 12 | +ms.custom: ai-usage |
| 13 | +--- |
| 14 | + |
| 15 | +# Connect Azure Front Door Premium to an Azure API Management with Private Link (Preview) |
| 16 | + |
| 17 | +This article guides you through the steps to configure an Azure Front Door Premium to connect privately to your Azure API Management origin using Azure Private Link. |
| 18 | + |
| 19 | +::: zone pivot="front-door-ps" |
| 20 | + |
| 21 | +## Prerequisites |
| 22 | + |
| 23 | +- An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F). |
| 24 | + |
| 25 | +- Azure PowerShell installed locally or Azure Cloud Shell. |
| 26 | + |
| 27 | +[!INCLUDE [updated-for-az](~/reusable-content/ce-skilling/azure/includes/updated-for-az.md)] |
| 28 | + |
| 29 | +[!INCLUDE [cloud-shell-try-it.md](~/reusable-content/ce-skilling/azure/includes/cloud-shell-try-it.md)] |
| 30 | + |
| 31 | +- Have a functioning Azure API Management instance. For more information on how to create an API Management instance, see [Create a new Azure API Management instance by using PowerShell](../../api-management/powershell-create-service-instance.md) |
| 32 | + |
| 33 | +- Have a functioning Azure Front Door Premium profile and an endpoint. For more information on how to create an Azure Front Door profile, see [Create a Front Door - PowerShell](../create-front-door-powershell.md) |
| 34 | + |
| 35 | +## Create an origin group and add the API Management instance as an origin |
| 36 | + |
| 37 | +1. Use [New-AzFrontDoorCdnOriginGroupHealthProbeSettingObject](/powershell/module/az.cdn/new-azfrontdoorcdnorigingrouphealthprobesettingobject) to create an in-memory object for storing the health probe settings. |
| 38 | + |
| 39 | + ```azurepowershell-interactive |
| 40 | + $healthProbeSetting = New-AzFrontDoorCdnOriginGroupHealthProbeSettingObject ` |
| 41 | + -ProbeIntervalInSecond 60 ` |
| 42 | + -ProbePath "/" ` |
| 43 | + -ProbeRequestType GET ` |
| 44 | + -ProbeProtocol Http |
| 45 | + ``` |
| 46 | +
|
| 47 | +1. Use [New-AzFrontDoorCdnOriginGroupLoadBalancingSettingObject](/powershell/module/az.cdn/new-azfrontdoorcdnorigingrouploadbalancingsettingobject) to create an in-memory object for storing load balancing settings. |
| 48 | +
|
| 49 | + ```azurepowershell-interactive |
| 50 | + $loadBalancingSetting = New-AzFrontDoorCdnOriginGroupLoadBalancingSettingObject ` |
| 51 | + -AdditionalLatencyInMillisecond 50 ` |
| 52 | + -SampleSize 4 ` |
| 53 | + -SuccessfulSamplesRequired 3 |
| 54 | + ``` |
| 55 | +
|
| 56 | +1. Run [New-AzFrontDoorCdnOriginGroup](/powershell/module/az.cdn/new-azfrontdoorcdnorigingroup) to create an origin group that contains your API Management instance. |
| 57 | +
|
| 58 | + ```azurepowershell-interactive |
| 59 | + $origingroup = New-AzFrontDoorCdnOriginGroup ` |
| 60 | + -OriginGroupName myOriginGroup ` |
| 61 | + -ProfileName myFrontDoorProfile ` |
| 62 | + -ResourceGroupName myResourceGroup ` |
| 63 | + -HealthProbeSetting $healthProbeSetting ` |
| 64 | + -LoadBalancingSetting $loadBalancingSetting |
| 65 | + ``` |
| 66 | +
|
| 67 | +1. Use the [New-AzFrontDoorCdnOrigin](/powershell/module/az.cdn/new-azfrontdoorcdnorigin) command to add your API Management instance to the origin group. |
| 68 | +
|
| 69 | + ```azurepowershell-interactive |
| 70 | + New-AzFrontDoorCdnOrigin ` |
| 71 | + -OriginGroupName myOriginGroup ` |
| 72 | + -OriginName myAPIMOrigin ` |
| 73 | + -ProfileName myFrontDoorProfile ` |
| 74 | + -ResourceGroupName myResourceGroup ` |
| 75 | + -HostName myapim.azure-api.net ` |
| 76 | + -HttpPort 80 ` |
| 77 | + -HttpsPort 443 ` |
| 78 | + -OriginHostHeader myapim.azure-api.net ` |
| 79 | + -Priority 1 ` |
| 80 | + -PrivateLinkId /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.ApiManagement/service/myAPIM ` |
| 81 | + -SharedPrivateLinkResourceGroupId Gateway ` |
| 82 | + -SharedPrivateLinkResourcePrivateLinkLocation CentralUS ` |
| 83 | + -SharedPrivateLinkResourceRequestMessage 'Azure Front Door private connectivity request' ` |
| 84 | + -Weight 1000 ` |
| 85 | + ``` |
| 86 | +
|
| 87 | +## Approve the private endpoint |
| 88 | +
|
| 89 | +1. Run [Get-AzPrivateEndpointConnection](/powershell/module/az.network/get-azprivateendpointconnection) to retrieve the connection name of the private endpoint connection that needs approval. |
| 90 | +
|
| 91 | + ```azurepowershell-interactive |
| 92 | + $PrivateEndpoint = Get-AzPrivateEndpointConnection -ResourceGroupName myResourceGroup -ServiceName myAPIM -PrivateLinkResourceType Microsoft.ApiManagement/service |
| 93 | + ``` |
| 94 | +
|
| 95 | +2. Run [Approve-AzPrivateEndpointConnection](/powershell/module/az.network/approve-azprivateendpointconnection) to approve the private endpoint connection details. Use the *Name* value from the output in the previous step for approving the connection. |
| 96 | +
|
| 97 | + ```azurepowershell-interactive |
| 98 | + Get-AzPrivateEndpointConnection -Name $PrivateEndpoint.Name -ResourceGroupName myResourceGroup -ServiceName myAPIM -PrivateLinkResourceType Microsoft.ApiManagement/service |
| 99 | + ``` |
| 100 | +
|
| 101 | +## Complete Azure Front Door setup |
| 102 | +
|
| 103 | +Use the [New-AzFrontDoorCdnRoute](/powershell/module/az.cdn/new-azfrontdoorcdnroute) command to create a route that maps your endpoint to the origin group. This route forwards requests from the endpoint to your origin group. |
| 104 | +
|
| 105 | +```azurepowershell-interactive |
| 106 | +# Create a route to map the endpoint to the origin group |
| 107 | +
|
| 108 | +$Route = New-AzFrontDoorCdnRoute ` |
| 109 | + -EndpointName myFrontDoorEndpoint ` |
| 110 | + -Name myRoute ` |
| 111 | + -ProfileName myFrontDoorProfile ` |
| 112 | + -ResourceGroupName myResourceGroup ` |
| 113 | + -ForwardingProtocol MatchRequest ` |
| 114 | + -HttpsRedirect Enabled ` |
| 115 | + -LinkToDefaultDomain Enabled ` |
| 116 | + -OriginGroupId $origingroup.Id ` |
| 117 | + -SupportedProtocol Http,Https |
| 118 | +``` |
| 119 | + |
| 120 | +Your Azure Front Door profile is now fully functional after completing the final step. |
| 121 | + |
| 122 | +::: zone-end |
| 123 | + |
| 124 | +::: zone pivot="front-door-cli" |
| 125 | + |
| 126 | +[!INCLUDE[azure-cli-prepare-your-environment](~/reusable-content/azure-cli/azure-cli-prepare-your-environment.md)] |
| 127 | + |
| 128 | +- An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F). |
| 129 | + |
| 130 | +- A functioning Azure Front Door Premium profile and endpoint. See [Create a Front Door - CLI](../create-front-door-cli.md). |
| 131 | + |
| 132 | +- A functioning Azure API Management instance. See [Create a new Azure API Management instance by using the Azure CLI](../../api-management/get-started-create-service-instance-cli.md) |
| 133 | + |
| 134 | +## Create an origin group and add the API Management instance as an origin |
| 135 | + |
| 136 | +1. Run [az afd origin-group create](/cli/azure/afd/origin-group#az-afd-origin-group-create) to create an origin group. |
| 137 | + |
| 138 | + ```azurecli-interactive |
| 139 | + az afd origin-group create \ |
| 140 | + --resource-group myResourceGroup \ |
| 141 | + --origin-group-name myOriginGroup \ |
| 142 | + --profile-name myFrontDoorProfile \ |
| 143 | + --probe-request-type GET \ |
| 144 | + --probe-protocol Http \ |
| 145 | + --probe-interval-in-seconds 60 \ |
| 146 | + --probe-path / \ |
| 147 | + --sample-size 4 \ |
| 148 | + --successful-samples-required 3 \ |
| 149 | + --additional-latency-in-milliseconds 50 |
| 150 | + ``` |
| 151 | +
|
| 152 | +1. Run [az afd origin create](/cli/azure/afd/origin#az-afd-origin-create) to add the API Management instance as an origin to the origin group. |
| 153 | +
|
| 154 | + ```azurecli-interactive |
| 155 | + az afd origin create \ |
| 156 | + --enabled-state Enabled \ |
| 157 | + --resource-group myResourceGroup \ |
| 158 | + --origin-group-name myOriginGroup \ |
| 159 | + --origin-name myAPIMOrigin \ |
| 160 | + --profile-name myFrontDoorProfile \ |
| 161 | + --host-name myapim.azure-api.net \ |
| 162 | + --origin-host-header myapim.azure-api.net \ |
| 163 | + --http-port 80 \ |
| 164 | + --https-port 443 \ |
| 165 | + --priority 1 \ |
| 166 | + --weight 500 \ |
| 167 | + --enable-private-link true \ |
| 168 | + --private-link-location centralus \ |
| 169 | + --private-link-request-message 'Azure Front Door private connectivity request.' \ |
| 170 | + --private-link-resource /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.ApiManagement/service/myAPIM \ |
| 171 | + --private-link-sub-resource-type Gateway |
| 172 | + ``` |
| 173 | +
|
| 174 | +
|
| 175 | +## Approve the private endpoint connection |
| 176 | +
|
| 177 | +1. Run [az network private-endpoint-connection list](/cli/azure/network/private-endpoint-connection#az-network-private-endpoint-connection-list) to get the **name** of the private endpoint connection that needs approval. |
| 178 | +
|
| 179 | + ```azurecli-interactive |
| 180 | + az network private-endpoint-connection list --name myAPIM --resource-group myResourceGroup --type Microsoft.ApiManagement/service |
| 181 | + ``` |
| 182 | +
|
| 183 | +1. Run [az network private-endpoint-connection approve](/cli/azure/network/private-endpoint-connection#az-network-private-endpoint-connection-approve) to approve the private endpoint connection using the **name** from the previous step. |
| 184 | +
|
| 185 | + ```azurecli-interactive |
| 186 | + az network private-endpoint-connection approve --id /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.ApiManagement/service/myAPIM/privateEndpointConnections/aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb |
| 187 | + ``` |
| 188 | +
|
| 189 | +## Complete Azure Front Door setup |
| 190 | +
|
| 191 | +Run [az afd route create](/cli/azure/afd/route#az-afd-route-create) to create a route that maps your endpoint to the origin group. This route forwards requests from the endpoint to your origin group. |
| 192 | +
|
| 193 | +```azurecli-interactive |
| 194 | +az afd route create \ |
| 195 | + --resource-group myResourceGroup \ |
| 196 | + --profile-name myFrontDoorProfile \ |
| 197 | + --endpoint-name myFrontDoorEndpoint \ |
| 198 | + --forwarding-protocol MatchRequest \ |
| 199 | + --route-name myRoute \ |
| 200 | + --https-redirect Enabled \ |
| 201 | + --origin-group myOriginGroup \ |
| 202 | + --supported-protocols Http Https \ |
| 203 | + --link-to-default-domain Enabled |
| 204 | +``` |
| 205 | + |
| 206 | +Your Azure Front Door profile is now fully functional after completing the final step. |
| 207 | + |
| 208 | +::: zone-end |
| 209 | + |
| 210 | +## Next steps |
| 211 | + |
| 212 | +Learn about [Private Link service with storage account](../../storage/common/storage-private-endpoints.md). |
0 commit comments