Skip to content

Commit ac8734a

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #248558 from bowen5/bowan/patch-vnet
chore: Update the minimal required outbound traffic list for ASA VNet Injection
2 parents 860006a + eee3ee4 commit ac8734a

File tree

2 files changed

+4
-30
lines changed

2 files changed

+4
-30
lines changed

‎articles/spring-apps/how-to-create-user-defined-route-instance.md

Lines changed: 3 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -209,30 +209,12 @@ The following example shows how to add rules to your firewall. For more informat
209209
az network firewall network-rule create \
210210
--resource-group $RG \
211211
--firewall-name $FWNAME \
212-
--collection-name 'asafwnr' -n 'apiudp' \
213-
--protocols 'UDP' \
214-
--source-addresses '*' \
215-
--destination-addresses "AzureCloud" \
216-
--destination-ports 1194 \
217-
--action allow \
218-
--priority 100
219-
az network firewall network-rule create \
220-
--resource-group $RG \
221-
--firewall-name $FWNAME \
222-
--collection-name 'asafwnr' -n 'springcloudtcp' \
212+
--collection-name 'asafwnr' \
213+
--name 'springcloudtcp' \
223214
--protocols 'TCP' \
224215
--source-addresses '*' \
225216
--destination-addresses "AzureCloud" \
226217
--destination-ports 443 445
227-
az network firewall network-rule create \
228-
--resource-group $RG \
229-
--firewall-name $FWNAME \
230-
--collection-name 'asafwnr' \
231-
--name 'time' \
232-
--protocols 'UDP' \
233-
--source-addresses '*' \
234-
--destination-fqdns 'ntp.ubuntu.com' \
235-
--destination-ports 123
236218
237219
# Add firewall application rules.
238220
@@ -242,7 +224,7 @@ az network firewall application-rule create \
242224
--collection-name 'aksfwar'\
243225
--name 'fqdn' \
244226
--source-addresses '*' \
245-
--protocols 'http=80' 'https=443' \
227+
--protocols 'https=443' \
246228
--fqdn-tags "AzureKubernetesService" \
247229
--action allow --priority 100
248230
```

‎articles/spring-apps/vnet-customer-responsibilities.md

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,6 @@ The following list shows the resource requirements for Azure Spring Apps service
3838
| Destination Endpoint | Port | Use | Note |
3939
|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------|-------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------|
4040
| \*:443 *or* [ServiceTag](../virtual-network/service-tags-overview.md#available-service-tags) - AzureCloud:443 | TCP:443 | Azure Spring Apps Service Management. | Information of service instance "requiredTraffics" could be known in resource payload, under "networkProfile" section. |
41-
| \*:123 *or* ntp.ubuntu.com:123 | UDP:123 | NTP time synchronization on Linux nodes. | |
4241
| \*.azurecr.io:443 *or* [ServiceTag](../virtual-network/service-tags-overview.md#available-service-tags) - AzureContainerRegistry:443 | TCP:443 | Azure Container Registry. | Can be replaced by enabling *Azure Container Registry* [service endpoint in virtual network](../virtual-network/virtual-network-service-endpoints-overview.md). |
4342
| \*.core.windows.net:443 and \*.core.windows.net:445 *or* [ServiceTag](../virtual-network/service-tags-overview.md#available-service-tags) - Storage:443 and Storage:445 | TCP:443, TCP:445 | Azure Files | Can be replaced by enabling *Azure Storage* [service endpoint in virtual network](../virtual-network/virtual-network-service-endpoints-overview.md). |
4443
| \*.servicebus.windows.net:443 *or* [ServiceTag](../virtual-network/service-tags-overview.md#available-service-tags) - EventHub:443 | TCP:443 | Azure Event Hubs. | Can be replaced by enabling *Azure Event Hubs* [service endpoint in virtual network](../virtual-network/virtual-network-service-endpoints-overview.md). |
@@ -51,18 +50,11 @@ Azure Firewall provides the FQDN tag **AzureKubernetesService** to simplify the
5150
|-----------------------------------|-----------|------------------------------------------------------------------------------|
5251
| <i>*.azmk8s.io</i> | HTTPS:443 | Underlying Kubernetes Cluster management. |
5352
| <i>mcr.microsoft.com</i> | HTTPS:443 | Microsoft Container Registry (MCR). |
54-
| <i>*.cdn.mscr.io</i> | HTTPS:443 | MCR storage backed by the Azure CDN. |
5553
| <i>*.data.mcr.microsoft.com</i> | HTTPS:443 | MCR storage backed by the Azure CDN. |
5654
| <i>management.azure.com</i> | HTTPS:443 | Underlying Kubernetes Cluster management. |
57-
| <i>*login.microsoftonline.com</i> | HTTPS:443 | Azure Active Directory authentication. |
58-
| <i>*login.microsoft.com</i> | HTTPS:443 | Azure Active Directory authentication. |
55+
| <i>login.microsoftonline.com</i> | HTTPS:443 | Azure Active Directory authentication. |
5956
| <i>packages.microsoft.com</i> | HTTPS:443 | Microsoft packages repository. |
6057
| <i>acs-mirror.azureedge.net</i> | HTTPS:443 | Repository required to install required binaries like kubenet and Azure CNI. |
61-
| *mscrl.microsoft.com*<sup>1</sup> | HTTPS:80 | Required Microsoft Certificate Chain Paths. |
62-
| *crl.microsoft.com*<sup>1</sup> | HTTPS:80 | Required Microsoft Certificate Chain Paths. |
63-
| *crl3.digicert.com*<sup>1</sup> | HTTPS:80 | Third-Party TLS/SSL Certificate Chain Paths. |
64-
65-
<sup>1</sup> Please note that these FQDNs aren't included in the FQDN tag.
6658

6759
## Azure Spring Apps optional FQDN for third-party application performance management
6860

0 commit comments

Comments
 (0)