Skip to content

Commit a056099

Browse files
alfparkalfpark
committed
Update Batch pool endpoint config for new default
1 parent 4162e99 commit a056099

File tree

1 file changed

+60
-35
lines changed

1 file changed

+60
-35
lines changed

‎articles/batch/pool-endpoint-configuration.md

Lines changed: 60 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -2,28 +2,39 @@
22
title: Configure node endpoints in Azure Batch pool
33
description: How to configure or disable access to SSH or RDP ports on compute nodes in an Azure Batch pool.
44
ms.topic: how-to
5-
ms.date: 06/13/2024
5+
ms.date: 11/08/2024
66
---
77

88
# Configure or disable remote access to compute nodes in an Azure Batch pool
99

10-
By default, Batch allows a [node user](/rest/api/batchservice/computenode/adduser) with network connectivity to connect externally to a compute node in a Batch pool. For example, a user can connect by Remote Desktop (RDP) on port 3389 to a compute node in a Windows pool. Similarly, by default, a user can connect by Secure Shell (SSH) on port 22 to a compute node in a Linux pool.
10+
If configured, you can allow a [node user](/rest/api/batchservice/computenode/adduser) with network connectivity to connect
11+
externally to a compute node in a Batch pool. For example, a user can connect by Remote Desktop (RDP) on port 3389 to a
12+
compute node in a Windows pool. Similarly, by default, a user can connect by Secure Shell (SSH) on port 22 to a compute
13+
node in a Linux pool.
1114

12-
In your environment, you might need to restrict or disable these default external access settings. You can modify these settings by using the Batch APIs to set the [PoolEndpointConfiguration](/rest/api/batchservice/pool/add#poolendpointconfiguration) property.
15+
> [!TIP]
16+
> As of API version `2024-07-01`, Batch no longer automatically maps common remote access ports for SSH and RDP.
17+
> If you wish to allow remote access to your Batch compute nodes with pools created with API version `2024-07-01` or later,
18+
> then you must manually configure the pool endpoint configuration to enable such access.
1319
14-
## About the pool endpoint configuration
15-
The endpoint configuration consists of one or more [network address translation (NAT) pools](/rest/api/batchservice/pool/add#inboundnatpool) of frontend ports. (Do not confuse a NAT pool with the Batch pool of compute nodes.) You set up each NAT pool to override the default connection settings on the pool's compute nodes.
20+
In your environment, you might need to enable, restrict, or disable external access settings or any other ports you wish
21+
on the Batch pool. You can modify these settings by using the Batch APIs to set the
22+
[PoolEndpointConfiguration](/rest/api/batchservice/pool/add#poolendpointconfiguration) property.
23+
24+
## Batch pool endpoint configuration
25+
The endpoint configuration consists of one or more [network address translation (NAT) pools](/rest/api/batchservice/pool/add#inboundnatpool)
26+
of frontend ports. Don't confuse a NAT pool with the Batch pool of compute nodes. You set up each NAT pool to override
27+
the default connection settings on the pool's compute nodes.
1628

1729
Each NAT pool configuration includes one or more [network security group (NSG) rules](/rest/api/batchservice/pool/add#networksecuritygrouprule). Each NSG rule allows or denies certain network traffic to the endpoint. You can choose to allow or deny all traffic, traffic identified by a [service tag](../virtual-network/network-security-groups-overview.md#service-tags) (such as "Internet"), or traffic from specific IP addresses or subnets.
1830

1931
### Considerations
2032
* The pool endpoint configuration is part of the pool's [network configuration](/rest/api/batchservice/pool/add#networkconfiguration). The network configuration can optionally include settings to join the pool to an [Azure virtual network](batch-virtual-network.md). If you set up the pool in a virtual network, you can create NSG rules that use address settings in the virtual network.
2133
* You can configure multiple NSG rules when you configure a NAT pool. The rules are checked in the order of priority. Once a rule applies, no more rules are tested for matching.
2234

35+
## Example: Allow RDP traffic from a specific IP address
2336

24-
## Example: Deny all RDP traffic
25-
26-
The following C# snippet shows how to configure the RDP endpoint on compute nodes in a Windows pool to deny all network traffic. The endpoint uses a frontend pool of ports in the range *60000 - 60099*.
37+
The following C# snippet shows how to configure the RDP endpoint on compute nodes in a Windows pool to allow RDP access only from IP address *198.168.100.7*. The second NSG rule denies traffic that doesn't match the IP address.
2738

2839
```csharp
2940
using Microsoft.Azure.Batch;
@@ -32,24 +43,25 @@ using Microsoft.Azure.Batch.Common;
3243
namespace AzureBatch
3344
{
3445
public void SetPortsPool()
35-
{
46+
{
3647
pool.NetworkConfiguration = new NetworkConfiguration
3748
{
38-
EndpointConfiguration = new PoolEndpointConfiguratio(new InboundNatPool[]
49+
EndpointConfiguration = new PoolEndpointConfiguration(new InboundNatPool[]
3950
{
40-
new InboundNatPool("RDP", InboundEndpointProtocol.Tcp, 3389, 60000, 60099, new NetworkSecurityGroupRule[]
51+
new InboundNatPool("RDP", InboundEndpointProtocol.Tcp, 3389, 7500, 8000, new NetworkSecurityGroupRule[]
4152
{
42-
new NetworkSecurityGroupRule(162, NetworkSecurityGroupRuleAccess.Deny, "*"),
53+
new NetworkSecurityGroupRule(179, NetworkSecurityGroupRuleAccess.Allow, "198.168.100.7"),
54+
new NetworkSecurityGroupRule(180, NetworkSecurityGroupRuleAccess.Deny, "*")
4355
})
44-
})
56+
})
4557
};
4658
}
4759
}
4860
```
4961

50-
## Example: Deny all SSH traffic from the internet
62+
## Example: Allow SSH traffic from a specific subnet
5163

52-
The following Python snippet shows how to configure the SSH endpoint on compute nodes in a Linux pool to deny all internet traffic. The endpoint uses a frontend pool of ports in the range *4000 - 4100*.
64+
The following Python snippet shows how to configure the SSH endpoint on compute nodes in a Linux pool to allow access only from the subnet *192.168.1.0/24*. The second NSG rule denies traffic that doesn't match the subnet.
5365

5466
```python
5567
from azure.batch import models as batchmodels
@@ -67,8 +79,13 @@ class AzureBatch(object):
6779
network_security_group_rules=[
6880
batchmodels.NetworkSecurityGroupRule(
6981
priority=170,
70-
access=batchmodels.NetworkSecurityGroupRuleAccess.deny,
71-
source_address_prefix='Internet'
82+
access='allow',
83+
source_address_prefix='192.168.1.0/24'
84+
),
85+
batchmodels.NetworkSecurityGroupRule(
86+
priority=175,
87+
access='deny',
88+
source_address_prefix='*'
7289
)
7390
]
7491
)
@@ -77,9 +94,17 @@ class AzureBatch(object):
7794
)
7895
```
7996

80-
## Example: Allow RDP traffic from a specific IP address
8197

82-
The following C# snippet shows how to configure the RDP endpoint on compute nodes in a Windows pool to allow RDP access only from IP address *198.51.100.7*. The second NSG rule denies traffic that does not match the IP address.
98+
99+
## Example: Deny all RDP traffic
100+
101+
The following C# snippet shows how to configure the RDP endpoint on compute nodes in a Windows pool to deny all network traffic. The endpoint uses a frontend pool of ports in the range *60000 - 60099*.
102+
103+
> [!NOTE]
104+
> As of Batch API version `2024-07-01`, port 3389 typically associated with RDP is no longer mapped by default.
105+
> Creating an explicit deny rule is no longer required if access is not needed from the Internet for Batch pools
106+
> created with this API version or later. You may still need to specify explicit deny rules to restrict access
107+
> from other sources.
83108
84109
```csharp
85110
using Microsoft.Azure.Batch;
@@ -91,22 +116,27 @@ namespace AzureBatch
91116
{
92117
pool.NetworkConfiguration = new NetworkConfiguration
93118
{
94-
EndpointConfiguration = new PoolEndpointConfiguration(new InboundNatPool[]
119+
EndpointConfiguration = new PoolEndpointConfiguratio(new InboundNatPool[]
95120
{
96-
new InboundNatPool("RDP", InboundEndpointProtocol.Tcp, 3389, 7500, 8000, new NetworkSecurityGroupRule[]
97-
{
98-
new NetworkSecurityGroupRule(179, NetworkSecurityGroupRuleAccess.Allow, "198.51.100.7"),
99-
new NetworkSecurityGroupRule(180, NetworkSecurityGroupRuleAccess.Deny, "*")
121+
new InboundNatPool("RDP", InboundEndpointProtocol.Tcp, 3389, 60000, 60099, new NetworkSecurityGroupRule[]
122+
{
123+
new NetworkSecurityGroupRule(162, NetworkSecurityGroupRuleAccess.Deny, "*"),
100124
})
101-
})
125+
})
102126
};
103127
}
104128
}
105129
```
106130

107-
## Example: Allow SSH traffic from a specific subnet
131+
## Example: Deny all SSH traffic from the internet
132+
133+
The following Python snippet shows how to configure the SSH endpoint on compute nodes in a Linux pool to deny all internet traffic. The endpoint uses a frontend pool of ports in the range *4000 - 4100*.
108134

109-
The following Python snippet shows how to configure the SSH endpoint on compute nodes in a Linux pool to allow access only from the subnet *192.168.1.0/24*. The second NSG rule denies traffic that does not match the subnet.
135+
> [!NOTE]
136+
> As of Batch API version `2024-07-01`, port 22 typically associated with SSH is no longer mapped by default.
137+
> Creating an explicit deny rule is no longer required if access is not needed from the Internet for Batch pools
138+
> created with this API version or later. You may still need to specify explicit deny rules to restrict access
139+
> from other sources.
110140
111141
```python
112142
from azure.batch import models as batchmodels
@@ -124,13 +154,8 @@ class AzureBatch(object):
124154
network_security_group_rules=[
125155
batchmodels.NetworkSecurityGroupRule(
126156
priority=170,
127-
access='allow',
128-
source_address_prefix='192.168.1.0/24'
129-
),
130-
batchmodels.NetworkSecurityGroupRule(
131-
priority=175,
132-
access='deny',
133-
source_address_prefix='*'
157+
access=batchmodels.NetworkSecurityGroupRuleAccess.deny,
158+
source_address_prefix='Internet'
134159
)
135160
]
136161
)
@@ -142,4 +167,4 @@ class AzureBatch(object):
142167
## Next steps
143168

144169
- Learn about the [Batch service workflow and primary resources](batch-service-workflow-features.md) such as pools, nodes, jobs, and tasks.
145-
- For more information about NSG rules in Azure, see [Filter network traffic with network security groups](../virtual-network/network-security-groups-overview.md).
170+
- For more information about NSG rules in Azure, see [Filter network traffic with network security groups](../virtual-network/network-security-groups-overview.md).

0 commit comments

Comments
 (0)