Skip to content

Commit ab22613

Browse files
joemarshallmsftjoemarshallmsft
committed
ACL configuration examples topic.
1 parent 92eb140 commit ab22613

File tree

1 file changed

+144
-0
lines changed

1 file changed

+144
-0
lines changed

‎articles/operator-nexus/reference-acl-examples.md

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
---
2+
title: Azure Operator Nexus Access Control Lists Examples
3+
description: Examples of configuring and creating Azure Operator Nexus Access Control Lists.
4+
author: joemarshallmsft
5+
ms.author: joemarshall
6+
ms.service: azure-operator-nexus
7+
ms.topic: reference
8+
ms.date: 02/09/2024
9+
---
10+
11+
# Access Control List Creation and Configuration Examples
12+
13+
## Overview of the ACL Create Flow
14+
15+
Creating an Access Control List (ACL) associated with a Network-to-Network Interconnect (NNI) involves these steps:
16+
17+
- Create a Network Fabric resource and add an NNI child resource to it.
18+
19+
- Create ingress and egress ACL resources using the `az networkfabric acl create` command. You can provide match configurations and the default action for the ACL. You can also provide dynamic match configurations either inline, or in a file stored in your Azure storage account blob container.
20+
21+
- Update the NNI resource with the ingress and egress ACL IDs using the `az networkfabric nni update` command. You need to provide valid ACL resource IDs in the `--ingress-acl-id` and `--egress-acl-id` parameters.
22+
23+
- Provision the Network Fabric resource using the `az networkfabric fabric provision` command. This generates the base configuration and the dynamic match configuration for the ACLs and sends them to the devices.
24+
25+
## Overview of the ACL Update Flow
26+
27+
- Create ingress and egress ACL resources using `az networkfabric acl create` as described in the previous section.
28+
29+
- Update the ingress or egress ACL using the `az networkfabric acl update` command.
30+
31+
- Verify the configuration state of the ACL is `accepted`.
32+
33+
- Verify the configuration state of the fabric is `accepted`.
34+
35+
- Execute Fabric Commit to update the ACL.
36+
37+
## Example commands
38+
39+
### Access Control list on a Network-to-Network Interconnect
40+
41+
This example shows you how to create an NNI with two ACLs - one for ingress and one for egress.
42+
43+
The ACLs must be applied before provisioning the Network Fabric. This limitation is temporary and will be removed in future release. The ingress and egress ACLs are created before the NNI resource and referenced when the NNI is created, which also triggers the creation of the ACLs. This configuration must be done before provisioning the network fabric.
44+
45+
#### Create Ingress ACL: Example Command
46+
47+
```azurecli
48+
az networkfabric acl create \
49+
--resource-group "example-rg"
50+
--location "eastus2euap" \
51+
--resource-name "example-Ipv4ingressACL" \
52+
--configuration-type "Inline" \
53+
--default-action "Permit" \
54+
--dynamic-match-configurations "[{ipGroups:[{name:'example-ipGroup',ipAddressType:IPv4,ipPrefixes:['10.20.3.1/20']}],vlanGroups:[{name:'example-vlanGroup',vlans:['20-30']}],portGroups:[{name:'example-portGroup',ports:['100-200']}]}]" \
55+
--match-configurations "[{matchConfigurationName:'example-match',sequenceNumber:123,ipAddressType:IPv4,matchConditions:[{etherTypes:['0x1'],fragments:['0xff00-0xffff'],ipLengths:['4094-9214'],ttlValues:[23],dscpMarkings:[32],portCondition:{flags:[established],portType:SourcePort,layer4Protocol:TCP,ports:['1-20']},protocolTypes:[TCP],vlanMatchCondition:{vlans:['20-30'],innerVlans:[30]},ipCondition:{type:SourceIP,prefixType:Prefix,ipPrefixValues:['10.20.20.20/12']}}],actions:[{type:Count,counterName:'example-counter'}]}]"
56+
```
57+
58+
#### Create Egress ACL: Example Command
59+
60+
```azurecli
61+
az networkfabric acl create \
62+
--resource-group "example-rg" \
63+
--location "eastus2euap" \
64+
--resource-name "example-Ipv4egressACL" \
65+
--configuration-type "File" \
66+
--acls-url "https://ACL-Storage-URL" \
67+
--default-action "Permit" \
68+
--dynamic-match-configurations "[{ipGroups:[{name:'example-ipGroup',ipAddressType:IPv4,ipPrefixes:['10.20.3.1/20']}],vlanGroups:[{name:'example-vlanGroup',vlans:['20-30']}],portGroups:[{name:'example-portGroup',ports:['100-200']}]}]"
69+
```
70+
71+
### Access Control List on an Isolation Domain External Network
72+
73+
Use the `az networkfabric acl create` command to create ingress and egress ACLs for the external network. In the example, we specify the resource group, name, location, network fabric ID, external network ID, and other parameters. You can also specify the match conditions and actions for the ACL rules using the `--match` and `--action` parameters.
74+
75+
This command creates an ingress ACL named `acl-ingress` that allows ICMP traffic from any source to the external network:
76+
77+
```azurecli
78+
az networkfabric acl create \
79+
--resource-group myResourceGroup \
80+
--name acl-ingress \
81+
--location eastus \
82+
--network-fabric-id /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myResourceGroup/providers/Microsoft.NetworkFabric/networkFabrics/myNetworkFabric \
83+
--external-network-id /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myResourceGroup/providers/Microsoft.NetworkFabric/externalNetworks/ext-net \
84+
--match "ip protocol icmp" \
85+
--action allow
86+
```
87+
88+
Use the `az networkfabric externalnetwork update` command to update the external network with the resource group, name, and network fabric ID. You also need to specify the ingress and egress ACL IDs using the `--ingress-acl-id` and `--egress-acl-id` parameters. For example, the following command updates the external network named `ext-net` to reference the ingress ACL named `acl-ingress`:
89+
90+
```azurecli
91+
az networkfabric externalnetwork update \
92+
--resource-group myResourceGroup \
93+
--name ext-net \
94+
--network-fabric-id /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myResourceGroup/providers/Microsoft.NetworkFabric/networkFabrics/myNetworkFabric \
95+
--ingress-acl-id /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myResourceGroup/providers/Microsoft.NetworkFabric/acls/acl-ingress
96+
```
97+
98+
### More example scenarios and commands
99+
100+
To create an egress ACL for an NNI that denies all traffic except for HTTP and HTTPS, you can use this command:
101+
102+
```azurecli
103+
az networkfabric acl create \
104+
--name acl-egress \
105+
--resource-group myResourceGroup \
106+
--nni-id /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myResourceGroup/providers/Microsoft.NetworkFabric/networkInterfaces/myNni \
107+
--match "ip protocol tcp destination port 80 or 443" \
108+
--action allow \
109+
--default-action deny
110+
```
111+
112+
To update an existing ACL to add a new match condition and action, you can use this command:
113+
114+
```azurecli
115+
az networkfabric acl update \
116+
--name acl-ingress \
117+
--resource-group myResourceGroup \
118+
--match "ip protocol icmp" \
119+
--action allow \
120+
--append-match-configurations
121+
```
122+
123+
To list all the ACLs in a resource group, you can use this command:
124+
125+
```azurecli
126+
az networkfabric acl list --resource-group myResourceGroup
127+
```
128+
129+
To show the details of a specific ACL, you can use this command:
130+
131+
```azurecli
132+
az networkfabric acl show \
133+
--name acl-ingress \
134+
--resource-group myResourceGroup
135+
```
136+
137+
To delete an ACL, you can use this command:
138+
139+
```azurecli
140+
az networkfabric acl delete \
141+
--name acl-egress \
142+
--resource-group myResourceGroup
143+
```
144+

0 commit comments

Comments
 (0)