Skip to content

Commit a1bfe52

Browse files
asudbringasudbring
committed
updated commands and removed username and password login
1 parent 0a3c9a1 commit a1bfe52

File tree

1 file changed

+92
-62
lines changed

1 file changed

+92
-62
lines changed

‎articles/virtual-network/tutorial-filter-network-traffic-cli.md

Lines changed: 92 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -31,37 +31,37 @@ A network security group contains security rules. Security rules specify a sourc
3131

3232
### Create application security groups
3333

34-
First create a resource group for all the resources created in this article with [az group create](/cli/azure/group). The following example creates a resource group in the *eastus* location:
34+
First create a resource group for all the resources created in this article with [az group create](/cli/azure/group). The following example creates a resource group in the *westus2* location:
3535

3636
```azurecli-interactive
3737
az group create \
38-
--name myResourceGroup \
39-
--location eastus
38+
--name test-rg \
39+
--location westus2
4040
```
4141

4242
Create an application security group with [az network asg create](/cli/azure/network/asg). An application security group enables you to group servers with similar port filtering requirements. The following example creates two application security groups.
4343

4444
```azurecli-interactive
4545
az network asg create \
46-
--resource-group myResourceGroup \
47-
--name myAsgWebServers \
48-
--location eastus
46+
--resource-group test-rg \
47+
--name asg-web-servers \
48+
--location westus2
4949
5050
az network asg create \
51-
--resource-group myResourceGroup \
52-
--name myAsgMgmtServers \
53-
--location eastus
51+
--resource-group test-rg \
52+
--name asg-mgmt-servers \
53+
--location westus2
5454
```
5555

5656
### Create a network security group
5757

58-
Create a network security group with [az network nsg create](/cli/azure/network/nsg). The following example creates a network security group named *myNsg*:
58+
Create a network security group with [az network nsg create](/cli/azure/network/nsg). The following example creates a network security group named *nsg-1*:
5959

6060
```azurecli-interactive
6161
# Create a network security group
6262
az network nsg create \
63-
--resource-group myResourceGroup \
64-
--name myNsg
63+
--resource-group test-rg \
64+
--name nsg-1
6565
```
6666

6767
### Create security rules
@@ -70,136 +70,163 @@ Create a security rule with [az network nsg rule create](/cli/azure/network/nsg/
7070

7171
```azurecli-interactive
7272
az network nsg rule create \
73-
--resource-group myResourceGroup \
74-
--nsg-name myNsg \
73+
--resource-group test-rg \
74+
--nsg-name nsg-1 \
7575
--name Allow-Web-All \
7676
--access Allow \
7777
--protocol Tcp \
7878
--direction Inbound \
7979
--priority 100 \
8080
--source-address-prefix Internet \
8181
--source-port-range "*" \
82-
--destination-asgs "myAsgWebServers" \
82+
--destination-asgs "asg-web-servers" \
8383
--destination-port-range 80 443
8484
```
8585

8686
The following example creates a rule that allows traffic inbound from the Internet to the *myMgmtServers* application security group over port 22:
8787

8888
```azurecli-interactive
8989
az network nsg rule create \
90-
--resource-group myResourceGroup \
91-
--nsg-name myNsg \
90+
--resource-group test-rg \
91+
--nsg-name nsg-1 \
9292
--name Allow-SSH-All \
9393
--access Allow \
9494
--protocol Tcp \
9595
--direction Inbound \
9696
--priority 110 \
9797
--source-address-prefix Internet \
9898
--source-port-range "*" \
99-
--destination-asgs "myAsgMgmtServers" \
99+
--destination-asgs "asg-mgmt-servers" \
100100
--destination-port-range 22
101101
```
102102

103-
In this article, SSH (port 22) is exposed to the internet for the *myAsgMgmtServers* VM. For production environments, instead of exposing port 22 to the internet, it's recommended that you connect to Azure resources that you want to manage using a [VPN](../vpn-gateway/vpn-gateway-about-vpngateways.md?toc=%2fazure%2fvirtual-network%2ftoc.json) or [private](../expressroute/expressroute-introduction.md?toc=%2fazure%2fvirtual-network%2ftoc.json) network connection.
103+
In this article, SSH (port 22) is exposed to the internet for the *asg-mgmt-servers* VM. For production environments, instead of exposing port 22 to the internet, it's recommended that you connect to Azure resources that you want to manage using a [VPN](../vpn-gateway/vpn-gateway-about-vpngateways.md?toc=%2fazure%2fvirtual-network%2ftoc.json) or [private](../expressroute/expressroute-introduction.md?toc=%2fazure%2fvirtual-network%2ftoc.json) network connection.
104104

105105
## Create a virtual network
106106

107-
Create a virtual network with [az network vnet create](/cli/azure/network/vnet). The following example creates a virtual named *myVirtualNetwork*:
107+
Create a virtual network with [az network vnet create](/cli/azure/network/vnet). The following example creates a virtual named *vnet-1*:
108108

109109
```azurecli-interactive
110110
az network vnet create \
111-
--name myVirtualNetwork \
112-
--resource-group myResourceGroup \
111+
--name vnet-1 \
112+
--resource-group test-rg \
113113
--address-prefixes 10.0.0.0/16
114114
```
115115

116-
Add a subnet to a virtual network with [az network vnet subnet create](/cli/azure/network/vnet/subnet). The following example adds a subnet named *mySubnet* to the virtual network and associates the *myNsg* network security group to it:
116+
Add a subnet to a virtual network with [az network vnet subnet create](/cli/azure/network/vnet/subnet). The following example adds a subnet named *subnet-1* to the virtual network and associates the *nsg-1* network security group to it:
117117

118118
```azurecli-interactive
119119
az network vnet subnet create \
120-
--vnet-name myVirtualNetwork \
121-
--resource-group myResourceGroup \
122-
--name mySubnet \
120+
--vnet-name vnet-1 \
121+
--resource-group test-rg \
122+
--name subnet-1 \
123123
--address-prefix 10.0.0.0/24 \
124-
--network-security-group myNsg
124+
--network-security-group nsg-1
125125
```
126126

127127
## Create virtual machines
128128

129129
Create two VMs in the virtual network so you can validate traffic filtering in a later step.
130130

131-
Create a VM with [az vm create](/cli/azure/vm). The following example creates a VM that will serve as a web server. The `--asgs myAsgWebServers` option causes Azure to make the network interface it creates for the VM a member of the *myAsgWebServers* application security group.
131+
Create a VM with [az vm create](/cli/azure/vm). The following example creates a VM that will serve as a web server. The `--asgs asg-web-servers` option causes Azure to make the network interface it creates for the VM a member of the *asg-web-servers* application security group.
132132

133-
The `--nsg ""` option is specified to prevent Azure from creating a default network security group for the network interface Azure creates when it creates the VM. To streamline this article, a password is used. Keys are typically used in production deployments. If you use keys, you must also configure SSH agent forwarding for the remaining steps. For more information, see the documentation for your SSH client. Replace `<replace-with-your-password>` in the following command with a password of your choosing.
133+
The `--nsg ""` option is specified to prevent Azure from creating a default network security group for the network interface Azure creates when it creates the VM. The following example creates a VM and adds a user account. The `--generate-ssh-keys` parameter causes the CLI to look for an available ssh key in `~/.ssh`. If one is found, that key is used. If not, one is generated and stored in `~/.ssh`. Finally, we deploy the latest `Ubuntu 22.04` image.
134134

135135
```azurecli-interactive
136-
adminPassword="<replace-with-your-password>"
137-
138136
az vm create \
139-
--resource-group myResourceGroup \
140-
--name myVmWeb \
137+
--resource-group test-rg \
138+
--name vm-web \
141139
--image Ubuntu2204 \
142-
--vnet-name myVirtualNetwork \
143-
--subnet mySubnet \
140+
--vnet-name vnet-1 \
141+
--subnet subnet-1 \
144142
--nsg "" \
145-
--asgs myAsgWebServers \
143+
--asgs asg-web-servers \
146144
--admin-username azureuser \
147-
--admin-password $adminPassword
145+
--generate-ssh-keys
148146
```
149147

150148
The VM takes a few minutes to create. After the VM is created, output similar to the following example is returned:
151149

152150
```output
153151
{
154152
"fqdns": "",
155-
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVmWeb",
156-
"location": "eastus",
153+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.Compute/virtualMachines/vm-web",
154+
"location": "westus2",
157155
"macAddress": "00-0D-3A-23-9A-49",
158156
"powerState": "VM running",
159157
"privateIpAddress": "10.0.0.4",
160-
"publicIpAddress": "13.90.242.231",
161-
"resourceGroup": "myResourceGroup"
158+
"publicIpAddress": "203.0.113.24",
159+
"resourceGroup": "test-rg"
162160
}
163161
```
164162

165-
Take note of the **publicIpAddress**. This address is used to access the VM from the internet in a later step. Create a VM to serve as a management server:
163+
Create a VM to serve as a management server:
166164

167165
```azurecli-interactive
168166
az vm create \
169-
--resource-group myResourceGroup \
170-
--name myVmMgmt \
167+
--resource-group test-rg \
168+
--name vm-mgmt \
171169
--image Ubuntu2204 \
172-
--vnet-name myVirtualNetwork \
173-
--subnet mySubnet \
170+
--vnet-name vnet-1 \
171+
--subnet subnet-1 \
174172
--nsg "" \
175-
--asgs myAsgMgmtServers \
173+
--asgs asg-mgmt-servers \
176174
--admin-username azureuser \
177-
--admin-password $adminPassword
175+
--generate-ssh-keys
178176
```
179177

180-
The VM takes a few minutes to create. After the VM is created, note the **publicIpAddress** in the returned output. This address is used to access the VM in the next step. Don't continue with the next step until Azure finishes creating the VM.
178+
The VM takes a few minutes to create. Don't continue with the next step until Azure finishes creating the VM.
179+
180+
## Enable Microsoft Entra ID sign in for the virtual machines
181+
182+
The following code example the extension to enable a Microsoft Entra ID sign-in for a Linux VM. VM extensions are small applications that provide post-deployment configuration and automation tasks on Azure virtual machines.
183+
184+
```bash
185+
az vm extension set \
186+
--publisher Microsoft.Azure.ActiveDirectory \
187+
--name AADSSHLoginForLinux \
188+
--resource-group test-rg \
189+
--vm-name vm-web
190+
```
191+
192+
```bash
193+
az vm extension set \
194+
--publisher Microsoft.Azure.ActiveDirectory \
195+
--name AADSSHLoginForLinux \
196+
--resource-group test-rg \
197+
--vm-name vm-mgmt
198+
```
181199

182200
## Test traffic filters
183201

184-
Use the command that follows to create an SSH session with the *myVmMgmt* VM. Replace *\<publicIpAddress>* with the public IP address of your VM. In the example above, the IP address is *13.90.242.231*.
202+
Using an SSH client of your choice, connect to the VMs created previously. For example, the following command can be used from a command line interface such as [Windows Subsystem for Linux](/windows/wsl/install) to create an SSH session with the *vm-mgmt* VM. In the previous steps, we enabled Microsoft Entra ID sign-in for the VMs. You can login to the virtual machines using your Microsoft Entra ID credentials or you can use the SSH key that you used to create the VMs. In the following example, we use the SSH key to login to the VMs.
185203

186-
```bash
187-
ssh azureuser@<publicIpAddress>
204+
For more information about how to SSH to a Linux VM and sign in with Microsoft Entra ID, see [Sign in to a Linux virtual machine in Azure by using Microsoft Entra ID and OpenSSH](/entra/identity/devices/howto-vm-sign-in-azure-ad-linux).
205+
206+
207+
### Store IP address of VM in order to SSH
208+
209+
Run the following command to store the IP address of the VM as an environment variable:
210+
211+
```bash
212+
export IP_ADDRESS=$(az vm show --show-details --resource-group test-rg --name vm-mgmt --query publicIps --output tsv)
188213
```
189214

190-
When prompted for a password, enter the password you entered in [Create VMs](#create-virtual-machines).
215+
```bash
216+
ssh -o StrictHostKeyChecking=no azureuser@$IP_ADDRESS
217+
```
191218

192-
The connection succeeds, because port 22 is allowed inbound from the Internet to the *myAsgMgmtServers* application security group that the network interface attached to the *myVmMgmt* VM is in.
219+
The connection succeeds, because port 22 is allowed inbound from the Internet to the *asg-mgmt-servers* application security group that the network interface attached to the *vm-mgmt* VM is in.
193220

194-
Use the following command to SSH to the *myVmWeb* VM from the *myVmMgmt* VM:
221+
Use the following command to SSH to the *vm-web* VM from the *vm-mgmt* VM:
195222

196223
```bash
197-
ssh azureuser@myVmWeb
224+
ssh -o StrictHostKeyChecking=no azureuser@vm-web
198225
```
199226

200-
The connection succeeds because a default security rule within each network security group allows traffic over all ports between all IP addresses within a virtual network. You can't SSH to the *myVmWeb* VM from the Internet because the security rule for the *myAsgWebServers* doesn't allow port 22 inbound from the Internet.
227+
The connection succeeds because a default security rule within each network security group allows traffic over all ports between all IP addresses within a virtual network. You can't SSH to the *vm-web* VM from the Internet because the security rule for the *asg-web-servers* doesn't allow port 22 inbound from the Internet.
201228

202-
Use the following commands to install the nginx web server on the *myVmWeb* VM:
229+
Use the following commands to install the nginx web server on the *vm-web* VM:
203230

204231
```bash
205232
# Update package source
@@ -209,20 +236,23 @@ sudo apt-get -y update
209236
sudo apt-get -y install nginx
210237
```
211238

212-
The *myVmWeb* VM is allowed outbound to the Internet to retrieve nginx because a default security rule allows all outbound traffic to the Internet. Exit the *myVmWeb* SSH session, which leaves you at the `username@myVmMgmt:~$` prompt of the *myVmMgmt* VM. To retrieve the nginx welcome screen from the *myVmWeb* VM, enter the following command:
239+
The *vm-web* VM is allowed outbound to the Internet to retrieve nginx because a default security rule allows all outbound traffic to the Internet. Exit the *vm-web* SSH session, which leaves you at the `username@vm-mgmt:~$` prompt of the *vm-mgmt* VM. To retrieve the nginx welcome screen from the *vm-web* VM, enter the following command:
213240

214241
```bash
215-
curl myVmWeb
242+
curl vm-web
216243
```
217244

218-
Logout of the *myVmMgmt* VM. To confirm that you can access the *myVmWeb* web server from outside of Azure, enter `curl <publicIpAddress>` from your own computer. The connection succeeds, because port 80 is allowed inbound from the Internet to the *myAsgWebServers* application security group that the network interface attached to the *myVmWeb* VM is in.
245+
Logout of the *vm-mgmt* VM. To confirm that you can access the *vm-web* web server from outside of Azure, enter `curl <publicIpAddress>` from your own computer. The connection succeeds, because port 80 is allowed inbound from the Internet to the *asg-web-servers* application security group that the network interface attached to the *vm-web* VM is in.
219246

220247
## Clean up resources
221248

222249
When no longer needed, use [az group delete](/cli/azure/group) to remove the resource group and all of the resources it contains.
223250

224251
```azurecli-interactive
225-
az group delete --name myResourceGroup --yes
252+
az group delete \
253+
--name test-rg \
254+
--yes \
255+
--no-wait
226256
```
227257

228258
## Next steps

0 commit comments

Comments
 (0)