Merge pull request #268171 from vhorne/fwm-tut-fresh

fix tutorial

Author: prmerger-automator[bot]

articles/firewall-manager/secure-cloud-network.md

@@ -5,7 +5,7 @@ services: firewall-manager
 author: vhorne
 ms.service: firewall-manager
 ms.topic: tutorial
-ms.date: 01/12/2023
+ms.date: 03/05/2024
 ms.author: victorh
 ---
 
@@ -44,29 +44,30 @@ First, create spoke virtual networks where you can place your servers.
 
 ### Create two spoke virtual networks and subnets
 
-The two virtual networks will each have a workload server in them and will be protected by the firewall.
+The two virtual networks each have a workload server in them and are protected by the firewall.
 
 1. From the Azure portal home page, select **Create a resource**.
-2. Search for **Virtual network**, and select **Create**.
+2. Search for **Virtual network**, select it, and select **Create**.
 3. For **Subscription**, select your subscription.
 4. For **Resource group**, select **Create new**, and type **fw-manager-rg** for the name and select **OK**.
-5. For **Name**, type **Spoke-01**.
+5. For **Virtual network name**, type **Spoke-01**.
 6. For **Region**, select **East US**.
-7. Select **Next: IP Addresses**.
-8. For **Address space**, accept the default **10.0.0.0/16**.
-9. Select **Add subnet**.
-10. For **Subnet name**, type  **Workload-01-SN**.
-11. For **Subnet address range**, type **10.0.1.0/24**.
-12. Select **Add**.
-13. Select **Review + create**.
-14. Select **Create**.
+7. Select **Next**.
+1. On the **Security** page, select **Next**.
+1. Under **Add IPv4 address space**, accept the default **10.0.0.0/16**.
+1. Under **Subnets**, select **default**.
+1. For **Name**, type  **Workload-01-SN**.
+1. For **Starting address**, type **10.0.1.0/24**.
+1. Select **Save**.
+1. Select **Review + create**.
+1. Select **Create**.
 
 Repeat this procedure to create another similar virtual network in the **fw-manager-rg** resource group:
 
 Name: **Spoke-02**<br>
 Address space: **10.1.0.0/16**<br>
 Subnet name: **Workload-02-SN**<br>
-Subnet address range: **10.1.1.0/24**
+Starting address: **10.1.1.0/24**
 
 ### Create the secured virtual hub
 
@@ -101,7 +102,9 @@ Create your secured virtual hub using Firewall Manager.
 
    :::image type="content" source="./media/secure-cloud-network/3-azure-firewall-parameters-with-zones.png" alt-text="Screenshot of configuring Azure Firewall parameters." lightbox="./media/secure-cloud-network/3-azure-firewall-parameters-with-zones.png":::
 
-16. Select the **Firewall Policy** to apply at the new Azure Firewall instance. Select **Default Deny Policy**, you'll refine your settings later in this article.
+
+16. Type **1** in the **Specify number of Public IP addressees** text box.
+16. Under **Firewall Policy** ensure the **Default Deny Policy** is selected. You refine your settings later in this article.
 17. Select **Next: Security Partner Provider**.
 
     :::image type="content" source="./media/secure-cloud-network/4-trusted-security-partner.png" alt-text="Screenshot of configuring Trusted Partners parameters." lightbox="./media/secure-cloud-network/4-trusted-security-partner.png":::
@@ -114,13 +117,13 @@ Create your secured virtual hub using Firewall Manager.
 > [!NOTE]
 > It may take up to 30 minutes to create a secured virtual hub.
 
-You can get the firewall public IP address after the deployment completes.
+You can find the firewall public IP address after the deployment completes.
 
 1. Open **Firewall Manager**.
 2. Select **Virtual hubs**.
 3. Select **hub-01**.
-4. Under **Azure Firewall**, select **Public IP configuration**.
-5. Note the public IP address to use later.
+1. Select **AzureFirewall_Hub-01**.
+1. Note the public IP address to use later.
 
 ### Connect the hub and spoke virtual networks
 
@@ -137,7 +140,7 @@ Now you can peer the hub and spoke virtual networks.
 6. For **Resource group**, select **fw-manager-rg**.
 7. For **Virtual network**, select **Spoke-01**.
 8. Select **Create**.
-9. Repeat to connect the **Spoke-02** virtual network: connection name - **hub-spoke-02**
+9. Repeat to connect the **Spoke-02** virtual network: connection name - **hub-spoke-02**.
 
 ## Deploy the servers
 
@@ -174,7 +177,7 @@ After the servers are deployed, select a server resource, and in **Networking**
 
 ## Create a firewall policy and secure your hub
 
-A firewall policy defines collections of rules to direct traffic on one or more Secured virtual hubs. You'll create your firewall policy and then secure your hub.
+A firewall policy defines collections of rules to direct traffic on one or more Secured virtual hubs. You create your firewall policy and then secure your hub.
 
 1. From Firewall Manager, select **Azure Firewall policies**.
 
@@ -204,7 +207,7 @@ A firewall policy defines collections of rules to direct traffic on one or more
 11. For **Rule collection type**, select **Application**.
 12. For **Priority**, type **100**.
 13. Ensure **Rule collection action** is **Allow**.
-14. For the rule **Name** type **Allow-msft**.
+14. For the rule **Name**, type **Allow-msft**.
 15. For the **Source type**, select **IP address**.
 16. For **Source**, type **\***.
 17. For **Protocol**, type **http,https**.
@@ -214,16 +217,15 @@ A firewall policy defines collections of rules to direct traffic on one or more
 
 21. Add a **DNAT rule** so you can connect a remote desktop to the **Srv-Workload-01** virtual machine.
 
-    1. Select **Add/Rule collection**.
+    1. Select **Add a rule collection**.
     2. For **Name**, type **dnat-rdp**.
     3. For **Rule collection type**, select **DNAT**.
     4. For **Priority**, type **100**.
-    5. For the rule **Name** type **Allow-rdp**.
+    5. For the rule **Name**, type **Allow-rdp**.
     6. For the **Source type**, select **IP address**.
     7. For **Source**, type **\***.
     8. For **Protocol**, select **TCP**.
     9. For **Destination Ports**, type **3389**.
-    10. For **Destination Type**, select **IP Address**.
     11. For **Destination**, type the firewall public IP address that you noted previously.
     1. For **Translated type**, select **IP Address**.
     1. For **Translated address**, type the private IP address for **Srv-Workload-01** that you noted previously.
@@ -289,17 +291,19 @@ Now you must ensure that network traffic gets routed through your firewall.
 9. Select **OK** on the **Warning** dialog.
 
    :::image type="content" source="./media/secure-cloud-network/9a-firewall-warning.png" alt-text="Screenshot of Secure Connections." lightbox="./media/secure-cloud-network/9a-firewall-warning.png":::
+9. Select **OK** on the **Migrate to use inter-hub** dialog.
 
    > [!NOTE]
    > It takes a few minutes to update the route tables.
 
+
 8. Verify that the two connections show Azure Firewall secures both Internet and private traffic.
 
    :::image type="content" source="./media/secure-cloud-network/9b-secured-connections.png" alt-text="Screenshot of Secure Connections final status." lightbox="./media/secure-cloud-network/9b-secured-connections.png":::
 
 ## Test the firewall
 
-To test the firewall rules, you'll connect a remote desktop using the firewall public IP address, which is NATed to **Srv-Workload-01**. From there you'll use a browser to test the application rule and connect a remote desktop to **Srv-Workload-02** to test the network rule.
+To test the firewall rules, connect a remote desktop using the firewall public IP address, which is NATed to **Srv-Workload-01**. From there, use a browser to test the application rule and connect a remote desktop to **Srv-Workload-02** to test the network rule.
 
 ### Test the application rule
 
@@ -314,9 +318,9 @@ Now, test the firewall rules to confirm that it works as expected.
 
 4. Browse to `https://www.google.com`.
 
-   You should be blocked by the firewall.
+   The firewall should block this.
 
-So now you've verified that the firewall application rule is working:
+So now you verified that the firewall application rule is working:
 
 * You can browse to the one allowed FQDN, but not to any others.
 
@@ -328,7 +332,7 @@ Now test the network rule.
 
    A remote desktop should connect to Srv-Workload-02.
 
-So now you've verified that the firewall network rule is working:
+So now you verified that the firewall network rule is working:
 * You can connect a remote desktop to a server located in another virtual network.
 
 ## Clean up resources