Skip to content

Commit ab230a9

Browse files
tamarakhadertamarakhader
authored
Merge pull request #191740 from madsd/asenetworksettings
ASE network configurations
2 parents d3a9e63 + 8f687d6 commit ab230a9

File tree

4 files changed

+137
-8
lines changed

4 files changed

+137
-8
lines changed

‎articles/app-service/environment/configure-network-settings.md

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
---
2+
title: Configure App Service Environment v3 network settings
3+
description: Configure network settings that apply to the entire Azure App Service environment. Learn how to do it with Azure Resource Manager templates.
4+
author: madsd
5+
6+
ms.topic: tutorial
7+
ms.date: 03/20/2022
8+
ms.author: madsd
9+
---
10+
11+
# Network configuration settings
12+
13+
Because App Service Environments are isolated to the individual customer, there are certain configuration settings that can be applied exclusively to App Service Environments. This article documents the various specific network customizations that are available for App Service Environment v3.
14+
15+
> [!NOTE]
16+
> This article is about App Service Environment v3, which is used with isolated v2 App Service plans.
17+
18+
If you don't have an App Service Environment, see [How to Create an App Service Environment v3](./creation.md).
19+
20+
App Service Environment network customizations are stored in a subresource of the *hostingEnvironments* Azure Resource Manager entity called networking.
21+
22+
The following abbreviated Resource Manager template snippet shows the **networking** resource:
23+
24+
```json
25+
"resources": [
26+
{
27+
"apiVersion": "2021-03-01",
28+
"type": "Microsoft.Web/hostingEnvironments",
29+
"name": "[parameter('aseName')]",
30+
"location": ...,
31+
"properties": {
32+
"internalLoadBalancingMode": ...,
33+
etc...
34+
},
35+
"resources": [
36+
{
37+
"type": "configurations",
38+
"apiVersion": "2021-03-01",
39+
"name": "networking",
40+
"dependsOn": [
41+
"[resourceId('Microsoft.Web/hostingEnvironments', parameters('aseName'))]"
42+
],
43+
"properties": {
44+
"remoteDebugEnabled": true,
45+
"ftpEnabled": true,
46+
"allowNewPrivateEndpointConnections": true
47+
}
48+
}
49+
]
50+
}
51+
```
52+
53+
The **networking** resource can be included in a Resource Manager template to update the App Service Environment.
54+
55+
## Configure using Azure Resource Explorer
56+
Alternatively, you can update the App Service Environment by using [Azure Resource Explorer](https://resources.azure.com).
57+
58+
1. In Resource Explorer, go to the node for the App Service Environment (**subscriptions** > **{your Subscription}** > **resourceGroups** > **{your Resource Group}** > **providers** > **Microsoft.Web** > **hostingEnvironments** > **App Service Environment name** > **configurations** > **networking**).
59+
2. Select **Read/Write** in the upper toolbar to allow interactive editing in Resource Explorer.
60+
3. Select the blue **Edit** button to make the Resource Manager template editable.
61+
4. Modify one or more of the settings ftpEnabled, remoteDebugEnabled, allowNewPrivateEndpointConnections, that you want to change.
62+
5. Select the green **PUT** button that's located at the top of the right pane to commit the change to the App Service Environment.
63+
6. You may need to select the green **GET** button again to see the changed values.
64+
65+
The change takes effect within a minute.
66+
67+
## Allow new private endpoint connections
68+
69+
For apps hosted on both ILB and External App Service Environment, you can allow creation of private endpoints. The setting is default disabled. If private endpoint has been created while the setting was enabled, they won't be deleted and will continue to work. The setting only prevents new private endpoints from being created.
70+
71+
The following Azure CLI command will enable allowNewPrivateEndpointConnections:
72+
73+
```azurecli
74+
ASE_NAME="[myAseName]"
75+
RESOURCE_GROUP_NAME="[myResourceGroup]"
76+
az appservice ase update --name $ASE_NAME -g $RESOURCE_GROUP_NAME --allow-new-private-endpoint-connection true
77+
78+
az appservice ase list-addresses -n --name $ASE_NAME -g $RESOURCE_GROUP_NAME --query properties.allowNewPrivateEndpointConnections
79+
```
80+
81+
The setting is also available for configuration through Azure portal at the App Service Environment configuration:
82+
83+
:::image type="content" source="./media/configure-network-settings/configure-allow-private-endpoint.png" alt-text="Configure allow private endpoint access through Azure portal.":::
84+
85+
## FTP access
86+
87+
This ftpEnabled setting allows you to allow or deny FTP connections are the App Service Environment level. Individual apps will still need to configure FTP access. If you enable FTP at the App Service Environment level, you may want to [enforce FTPS](../deploy-ftp.md?tabs=cli#enforce-ftps) at the individual app level. The setting is default disabled.
88+
89+
If you want to enable FTP access, you can run the following Azure CLI command:
90+
91+
```azurecli
92+
ASE_NAME="[myAseName]"
93+
RESOURCE_GROUP_NAME="[myResourceGroup]"
94+
az resource update --name $ASE_NAME/configurations/networking --set properties.ftpEnabled=true -g $RESOURCE_GROUP_NAME --resource-type "Microsoft.Web/hostingEnvironments/networkingConfiguration"
95+
96+
az resource show --name $ASE_NAME/configurations/networking -g $RESOURCE_GROUP_NAME --resource-type "Microsoft.Web/hostingEnvironments/networkingConfiguration" --query properties.ftpEnabled
97+
```
98+
99+
In addition to enabling access, you need to ensure that you have [configured DNS if you are using ILB App Service Environment](./networking.md#dns-configuration-for-ftp-access).
100+
101+
## Remote debugging access
102+
103+
Remote debugging is default disabled at the App Service Environment level. You can enable network level access for all apps using this configuration. You'll still have to [configure remote debugging](../configure-common.md?tabs=cli#configure-general-settings) at the individual app level.
104+
105+
Run the following Azure CLI command to enable remote debugging access:
106+
107+
```azurecli
108+
ASE_NAME="[myAseName]"
109+
RESOURCE_GROUP_NAME="[myResourceGroup]"
110+
az resource update --name $ASE_NAME/configurations/networking --set properties.RemoteDebugEnabled=true -g $RESOURCE_GROUP_NAME --resource-type "Microsoft.Web/hostingEnvironments/networkingConfiguration"
111+
112+
az resource show --name $ASE_NAME/configurations/networking -g $RESOURCE_GROUP_NAME --resource-type "Microsoft.Web/hostingEnvironments/networkingConfiguration" --query properties.remoteDebugEnabled
113+
```
114+
115+
## Get started
116+
117+
The Azure Quickstart Resource Manager template site includes a template with the base definition for [creating an App Service Environment](https://azure.microsoft.com/resources/templates/web-app-asp-app-on-asev3-create/).

‎articles/app-service/environment/media/configure-network-settings/configure-allow-private-endpoint.png

47.6 KB
Loading

‎articles/app-service/environment/networking.md

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -51,19 +51,20 @@ For your app to receive traffic, ensure that inbound network security group (NSG
5151

5252
It's a good idea to configure the following inbound NSG rule:
5353

54-
|Port|Source|Destination|
55-
|-|-|-|
56-
|80,443|Virtual network|App Service Environment subnet range|
54+
|Source / Destination Port(s)|Direction|Source|Destination|Purpose|
55+
|-|-|-|-|-|
56+
|* / 80,443|Inbound|VirtualNetwork|App Service Environment subnet range|Allow app traffic and internal health ping traffic|
5757

5858
The minimal requirement for App Service Environment to be operational is:
5959

60-
|Port|Source|Destination|
61-
|-|-|-|
62-
|80|Azure Load Balancer|App Service Environment subnet range|
60+
|Source / Destination Port(s)|Direction|Source|Destination|Purpose|
61+
|-|-|-|-|-|
62+
|* / 80|Inbound|AzureLoadBalancer|App Service Environment subnet range|Allow internal health ping traffic|
6363

6464
If you use the minimum required rule, you might need one or more rules for your application traffic. If you're using any of the deployment or debugging options, you must also allow this traffic to the App Service Environment subnet. The source of these rules can be the virtual network, or one or more specific client IPs or IP ranges. The destination is always the App Service Environment subnet range.
65+
The internal health ping traffic on port 80 is isolated between the Load balancer and the internal servers. No outside traffic can reach the health ping endpoint.
6566

66-
The normal app access ports are as follows:
67+
The normal app access ports inbound are as follows:
6768

6869
|Use|Ports|
6970
|-|-|
@@ -117,6 +118,15 @@ To configure DNS in Azure DNS private zones:
117118

118119
In addition to the default domain provided when an app is created, you can also add a custom domain to your app. You can set a custom domain name without any validation on your apps. If you're using custom domains, you need to ensure they have DNS records configured. You can follow the preceding guidance to configure DNS zones and records for a custom domain name (simply replace the default domain name with the custom domain name). The custom domain name works for app requests, but doesn't work for the `scm` site. The `scm` site is only available at *<appname>.scm.<asename>.appserviceenvironment.net*.
119120

121+
### DNS configuration for FTP access
122+
123+
For FTP access to Internal Load balancer (ILB) App Service Environment v3 specifically, you need to ensure DNS is configured. Configure an Azure DNS private zone or equivalent custom DNS with the following settings:
124+
125+
1. Create an Azure DNS private zone named `ftp.appserviceenvironment.net`.
126+
1. Create an A record in that zone that points `<App Service Environment-name>` to the inbound IP address.
127+
128+
In addition to setting up DNS, you also need to enable it in the [App Service Environment configuration](./configure-network-settings.md#ftp-access) as well as at the [app level](../deploy-ftp.md?tabs=cli#enforce-ftps).
129+
120130
### DNS configuration from your App Service Environment
121131

122132
The apps in your App Service Environment will use the DNS that your virtual network is configured with. If you want some apps to use a different DNS server, you can manually set it on a per app basis, with the app settings `WEBSITE_DNS_SERVER` and `WEBSITE_DNS_ALT_SERVER`. `WEBSITE_DNS_ALT_SERVER` configures the secondary DNS server. The secondary DNS server is only used when there is no response from the primary DNS server.

‎articles/app-service/environment/toc.yml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,10 +31,12 @@
3131
items:
3232
- name: Using App Service Environment
3333
href: using.md
34-
- name: Provision App Service Environment from an ARM template
34+
- name: Create App Service Environment from template
3535
href: create-from-template.md
3636
- name: App Service Environment custom settings
3737
href: app-service-app-service-environment-custom-settings.md
38+
- name: App Service Environment v3 network settings
39+
href: configure-network-settings.md
3840
- name: Migrate to App Service Environment v3
3941
href: migration-alternatives.md
4042
- name: Use the migration feature

0 commit comments

Comments
 (0)