Skip to content

Commit aecbb4d

Browse files
v-regandownerv-regandowner
authored
Merge pull request #208745 from mbender-ms/avnm-qs-cli
AVNM - Custom Policy QS Update CLI
2 parents 430315d + 1922bcc commit aecbb4d

File tree

1 file changed

+198
-42
lines changed

1 file changed

+198
-42
lines changed

‎articles/virtual-network-manager/create-virtual-network-manager-cli.md

Lines changed: 198 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ author: mbender-ms
55
ms.author: mbender
66
ms.service: virtual-network-manager
77
ms.topic: quickstart
8-
ms.date: 11/16/2021
8+
ms.date: 08/23/2022
99
ms.custom: mode-api, devx-track-azurecli
1010
ms.devlang: azurecli
1111
---
@@ -31,66 +31,94 @@ In this quickstart, you'll deploy three virtual networks and use Azure Virtual N
3131

3232
To begin your configuration, sign in to your Azure account. If you use the Cloud Shell "Try It", you're signed in automatically. Use the following examples to help you connect:
3333

34-
```azurecli-interactive
34+
```azurecli
3535
az login
3636
```
3737

3838
Select the subscription where network manager will be deployed.
3939

40-
```azurecli-interactive
40+
```azurecli
4141
az account set \
42-
--subscription "<subscription ID>"
42+
--subscription "<subscription_id>"
4343
```
44+
Update the Azure Virtual Network Manager extension for Azure CLI.
4445

46+
```azurecli
47+
az extension update --name virtual-network-manager
48+
```
4549
## Create a resource group
4650

47-
Before you can deploy Azure Virtual Network Manager, you have to create a resource group to host the . Create a rnetwork manager esource group with [az group create](/cli/azure/group#az-group-create). This example creates a resource group named **myAVNMResourceGroup** in the **westus** location:
51+
Before you can deploy Azure Virtual Network Manager, you have to create a resource group to host a network manager with [az group create](/cli/azure/group#az-group-create). This example creates a resource group named **myAVNMResourceGroup** in the **westus** location:
4852

49-
```azurecli-interactive
53+
```azurecli
5054
az group create \
5155
--name "myAVNMResourceGroup" \
5256
--location "westus"
5357
```
5458

5559
## Create a Virtual Network Manager
5660

57-
Define the scope and access type this Network Manager instance will have. Create the scope by using [az network manager create](/cli/azure/network/manager#az-network-manager-create). Replace the value *{mgName}* with management group name or *{subscriptionId}* with subscriptions you want Virtual Network Manager to manage virtual networks for.
61+
Define the scope and access type this Network Manager instance will have. Create the scope by using [az network manager create](/cli/azure/network/manager#az-network-manager-create). Replace the value *<subscription_id>* with the subscription you want Virtual Network Manager to manage virtual networks for. For management groups, replace *<mgName\>* with the management group to manage.
5862

59-
```azurecli-interactive
63+
```azurecli
6064
az network manager create \
6165
--location "westus" \
6266
--name "myAVNM" \
6367
--resource-group "myAVNMResourceGroup" \
6468
--scope-accesses "Connectivity" "SecurityAdmin" \
65-
--network-manager-scopes management-groups="/Microsoft.Management/{mgName}" subscriptions="/subscriptions/{subscriptionId}"
69+
--network-manager-scopes subscriptions="/subscriptions/<subscription_id>"
6670
```
71+
## Create a network group
6772

68-
## Create three virtual networks
73+
Virtual Network Manager applies configurations to groups of VNets by placing them in **Network Groups.** Create a network group with [az network manager group create](/cli/azure/network/manager/group#az-network-manager-group-create).
74+
75+
```azurecli
76+
az network manager group create \
77+
--name "myNetworkGroup" \
78+
--network-manager-name "myAVNM" \
79+
--resource-group "myAVNMResourceGroup" \
80+
--description "Network Group for Production virtual networks"
81+
```
82+
## Create virtual networks
6983

70-
Create three virtual networks with [az network vnet create](/cli/azure/network/vnet#az-network-vnet-create). This example creates virtual networks named **VNetA**, **VNetB** and **VNetC** in the **westus** location. If you already have virtual networks you want create a mesh network with, you can skip to the next section.
84+
Create five virtual networks with [az network vnet create](/cli/azure/network/vnet#az-network-vnet-create). This example creates virtual networks named **VNetA**, **VNetB**,**VNetC** and **VNetD** in the **West US** location. Each virtual network will have a tag of **networkType** used for dynamic membership. If you already have virtual networks you want create a mesh network with, you can skip to the next section.
7185

72-
```azurecli-interactive
86+
```azurecli
7387
az network vnet create \
7488
--name "VNetA" \
7589
--resource-group "myAVNMResourceGroup" \
76-
--address-prefix "10.0.0.0/16"
90+
--address-prefix "10.0.0.0/16" \
91+
--tags "NetworkType=Prod"
7792
7893
az network vnet create \
7994
--name "VNetB" \
8095
--resource-group "myAVNMResourceGroup" \
81-
--address-prefix "10.1.0.0/16"
96+
--address-prefix "10.1.0.0/16" \
97+
--tags "NetworkType=Prod"
8298
8399
az network vnet create \
84100
--name "VNetC" \
85101
--resource-group "myAVNMResourceGroup" \
86-
--address-prefix "10.2.0.0/16"
87-
```
102+
--address-prefix "10.2.0.0/16" \
103+
--tags "NetworkType=Prod"
104+
105+
az network vnet create \
106+
--name "VNetD" \
107+
--resource-group "myAVNMResourceGroup" \
108+
--address-prefix "10.3.0.0/16" \
109+
--tags "NetworkType=Test"
88110
111+
az network vnet create \
112+
--name "VNetE" \
113+
--resource-group "myAVNMResourceGroup" \
114+
--address-prefix "10.4.0.0/16" \
115+
--tags "NetworkType=Test"
116+
```
89117
### Add a subnet to each virtual network
90118

91119
To complete the configuration of the virtual networks add a /24 subnet to each one. Create a subnet configuration named **default** with [az network vnet subnet create](/cli/azure/network/vnet/subnet#az-network-vnet-subnet-create):
92120

93-
```azurecli-interactive
121+
```azurecli
94122
az network vnet subnet create \
95123
--name "default" \
96124
--resource-group "myAVNMResourceGroup" \
@@ -108,50 +136,177 @@ az network vnet subnet create \
108136
--resource-group "myAVNMResourceGroup" \
109137
--vnet-name "VNetC" \
110138
--address-prefix "10.2.0.0/24"
139+
140+
az network vnet subnet create \
141+
--name "default" \
142+
--resource-group "myAVNMResourceGroup" \
143+
--vnet-name "VNetD" \
144+
--address-prefix "10.3.0.0/24"
145+
146+
az network vnet subnet create \
147+
--name "default" \
148+
--resource-group "myAVNMResourceGroup" \
149+
--vnet-name "VNetE" \
150+
--address-prefix "10.4.0.0/24"
111151
```
152+
## Define membership for a mesh configuration
112153

113-
## Create a network group
154+
Azure Virtual Network manager allows you two methods for adding membership to a network group. Static membership involves manually adding virtual networks, and dynamic membership involves using Azure Policy to dynamically add virtual networks based on conditions. Choose the option you wish to complete for your mesh configuration membership:
114155

115-
Create a network group using static membership with [az network manager group create](/cli/azure/network/manager/group#az-network-manager-group-create). Replace the value *{subscriptionId}* with the subscription the virtual network is in.
156+
### Static membership option
116157

117-
```azurecli-interactive
118-
az network manager group create \
119-
--name "myNetworkGroup" \
120-
--network-manager-name "myAVNM" \
121-
--group-members resource-id="/subscriptions/{subscriptionId}/resourceGroups/myAVNMResourceGroup/providers/Microsoft.Network/virtualNetworks/VNetA" \
122-
--group-members resource-id="/subscriptions/{subscriptionId}/resourceGroups/myAVNMResourceGroup/providers/Microsoft.Network/virtualNetworks/VNetB" \
123-
--group-members resource-id="/subscriptions/{subscriptionId}/resourceGroups/myAVNMResourceGroup/providers/Microsoft.Network/virtualNetworks/VNetC" \
124-
--resource-group "myAVNMResourceGroup"
158+
Using **static membership**, you'll manually add 3 VNets for your Mesh configuration to your Network Group with [az network manager group static-member create](/cli/azure/network/manager/group/static-member#az-network-manager-group-static-member-create). Replace <subscription_id> with the subscription these VNets were created under.
159+
160+
```azurecli
161+
az network manager group static-member create \
162+
--name "VNetA" \
163+
--network-group "myNetworkGroup" \
164+
--network-manager "myAVNM" \
165+
--resource-group "myAVNMResourceGroup" \
166+
--resource-id "/subscriptions/<subscription_id>/resourceGroups/myAVNMResourceGroup/providers/Microsoft.Network/virtualnetworks/VNetA"
167+
```
168+
169+
```azurecli
170+
az network manager group static-member create \
171+
--name "VNetB" \
172+
--network-group "myNetworkGroup" \
173+
--network-manager "myAVNM" \
174+
--resource-group "myAVNMResourceGroup" \
175+
--resource-id "/subscriptions/<subscription_id>/resourceGroups/myAVNMResourceGroup/providers/Microsoft.Network/virtualnetworks/VNetB"
176+
```
177+
178+
```azurecli
179+
az network manager group static-member create \
180+
--name "VNetC" \
181+
--network-group "myNetworkGroup" \
182+
--network-manager "myAVNM" \
183+
--resource-group "myAVNMResourceGroup" \
184+
--resource-id "/subscriptions/<subscription_id>/resourceGroups/myAVNMResourceGroup/providers/Microsoft.Network/virtualnetworks/VNetC"
185+
```
186+
### Dynamic membership option
187+
188+
Using [Azure Policy](concept-azure-policy-integration.md), you'll dynamically add the three VNets with a tag **networkType** value of *Prod* to the Network Group. These are the three virtual networks to become part of the mesh configuration.
189+
190+
> [!NOTE]
191+
> Policies can be applied to a subscription or management group, and must always be defined *at or above* the level they're created. Only virtual networks within a policy scope are added to a Network Group.
192+
193+
### Create a Policy definition
194+
Create a Policy definition with [az policy definition create](/cli/azure/policy/definition#az-policy-definition-create) for virtual networks tagged as **Prod**. Replace *<subscription_id>* with the subscription you want to apply this policy to. If you want to apply it to a management group, replace `--subscription <subscription_id>` with `--management-group <mgName>`
195+
196+
```azurecli
197+
az policy definition create \
198+
--name "ProdVNets" \
199+
--description "Choose Prod virtual networks only" \
200+
--rules "{\"if\":{\"allOf\":[{\"field\":\"Name\",\"contains\":\"VNet\"},{\"field\":\"tags['NetworkType']\",\"equals\":\"Prod\"}]},\"then\":{\"effect\":\"addToNetworkGroup\",\"details\":{\"networkGroupId\":\"/subscriptions/<subscription_id>/resourceGroups/myAVNMResourceGroup/providers/Microsoft.Network/networkManagers/myAVNM/networkGroups/myNetworkGroup\"}}}" \
201+
--subscription <subscription_id> \
202+
--mode "Microsoft.Network.Data"
203+
204+
```
205+
### Apply a Policy definition
206+
207+
Once a policy is defined, it must also be applied with [az policy assignment create](/cli/azure/policy/assignment#az-policy-assignment-create). Replace *<subscription_id>* with the subscription you want to apply this policy to. If you want to apply it to a management group, replace `--scope "/subscriptions/<subscription_id>"` with `--scope "/providers/Microsoft.Management/managementGroups/<mgName>`, and replace *<mgName\>* with your management group.
208+
209+
```azurecli
210+
211+
212+
az policy assignment create \
213+
--name "ProdVNets" \
214+
--description "Take only virtual networks tagged NetworkType:Prod" \
215+
--scope "/subscriptions/<subscription_id>" \
216+
--policy "/subscriptions/<subscription_id>/providers/Microsoft.Authorization/policyDefinitions/ProdVNets"
125217
```
126218

127219
## Create a configuration
128220

129-
Create a mesh network topology configuration with [az network manager connect-config create](/cli/azure/network/manager/connect-config#az-network-manager-connect-config-create):
221+
Now that the Network Group is created, and has the correct VNets, create a mesh network topology configuration with [az network manager connect-config create](/cli/azure/network/manager/connect-config#az-network-manager-connect-config-create). Replace <subscription_id> with your subscription.
130222

131-
```azurecli-interactive
223+
```azurecli
132224
az network manager connect-config create \
133225
--configuration-name "connectivityconfig" \
134-
--description "CLI Mesh Connectivity Config Example" \
135-
--applies-to-groups network-group-id="/subscriptions/{subscriptionId}/resourceGroups/myAVNMResourceGroup/providers/Microsoft.Network/networkManagers/myAVNM/networkGroups/myNetworkGroup" \
226+
--description "Production Mesh Connectivity Config Example" \
227+
--applies-to-groups network-group-id="/subscriptions/<subscription_id>/resourceGroups/myAVNMResourceGroup/providers/Microsoft.Network/networkManagers/myAVNM/networkGroups/myNetworkGroup" \
136228
--connectivity-topology "Mesh" \
137-
--delete-existing-peering true \
138229
--network-manager-name "myAVNM" \
139230
--resource-group "myAVNMResourceGroup"
140231
```
141-
142232
## Commit deployment
143233

144-
Commit a connectivity configuration with [az network manager post-commit](/cli/azure/network/manager#az-network-manager-post-commit):
234+
For the configuration to take effect, commit the configuration to the target regions with [az network manager post-commit](/cli/azure/network/manager#az-network-manager-post-commit):
145235

146-
```azurecli-interactive
236+
```azurecli
237+
#Currently broken - can only do via portal
147238
az network manager post-commit \
148239
--network-manager-name "myAVNM" \
149240
--commit-type "Connectivity" \
150-
--configuration-ids "/subscriptions/{subscriptionId}/resourceGroups/myANVMResourceGroup/providers/Microsoft.Network/networkManagers/myAVNM/connectivityConfigurations/connectivityconfig" \
241+
--configuration-ids "/subscriptions/<subscription_id>/resourceGroups/myANVMResourceGroup/providers/Microsoft.Network/networkManagers/myAVNM/connectivityConfigurations/connectivityconfig" \
151242
--target-locations "westus" \
152243
--resource-group "myAVNMResourceGroup"
153244
```
245+
## Verify configuration
246+
Virtual Networks will display configurations applied to them with [az network manager list-effective-connectivity-config](/cli/azure/network/manager#az-network-manager-list-effective-connectivity-config):
247+
248+
```azurecli
249+
az network manager list-effective-connectivity-config \
250+
--resource-group "myAVNMResourceGroup" \
251+
--virtual-network-name "VNetA"
252+
253+
az network manager list-effective-connectivity-config \
254+
--resource-group "myAVNMResourceGroup" \
255+
--virtual-network-name "VNetB"
154256
257+
258+
az network manager list-effective-connectivity-config \
259+
--resource-group "myAVNMResourceGroup" \
260+
--virtual-network-name "VNetC"
261+
262+
az network manager list-effective-connectivity-config \
263+
--resource-group "myAVNMResourceGroup" \
264+
--virtual-network-name "VNetD"
265+
```
266+
For the virtual networks that are part of the connectivity configuration, you'll see an output similar to this:
267+
268+
```json
269+
{
270+
"skipToken": "",
271+
"value": [
272+
{
273+
"appliesToGroups": [
274+
{
275+
"groupConnectivity": "None",
276+
"isGlobal": "False",
277+
"networkGroupId": "/subscriptions/<subscription_id>/resourceGroups/myAVNMResourceGroup/providers/Microsoft.Network/networkManagers/myAVNM/networkGroups/myNetworkGroup",
278+
"useHubGateway": "False"
279+
}
280+
],
281+
"configurationGroups": [
282+
{
283+
"description": "Network Group for Production virtual networks",
284+
"id": "/subscriptions/<subscription_id>/resourceGroups/myAVNMResourceGroup/providers/Microsoft.Network/networkManagers/myAVNM/networkGroups/myNetworkGroup",
285+
"provisioningState": "Succeeded",
286+
"resourceGroup": "myAVNMResourceGroup"
287+
}
288+
],
289+
"connectivityTopology": "Mesh",
290+
"deleteExistingPeering": "False",
291+
"description": "Production Mesh Connectivity Config Example",
292+
"hubs": [],
293+
"id": "/subscriptions/<subscription_id>/resourceGroups/myAVNMResourceGroup/providers/Microsoft.Network/networkManagers/myAVNM/connectivityConfigurations/connectivityconfig",
294+
"isGlobal": "False",
295+
"provisioningState": "Succeeded",
296+
"resourceGroup": "myAVNMResourceGroup"
297+
}
298+
]
299+
}
300+
```
301+
For virtual networks not part of the network group like **VNetD**, you'll see an output similar to this:
302+
303+
```json
304+
az network manager list-effective-connectivity-config --resource-group "myAVNMResourceGroup" --virtual-network-name "VNetD-test"
305+
{
306+
"skipToken": "",
307+
"value": []
308+
}
309+
```
155310
## Clean up resources
156311

157312
If you no longer need the Azure Virtual Network Manager, you'll need to make sure all of following are true before you can delete the resource:
@@ -162,7 +317,7 @@ If you no longer need the Azure Virtual Network Manager, you'll need to make sur
162317

163318
1. Remove the connectivity deployment by committing no configurations with [az network manager post-commit](/cli/azure/network/manager#az-network-manager-post-commit):
164319

165-
```azurecli-interactive
320+
```azurecli
166321
az network manager post-commit \
167322
--network-manager-name "myAVNM" \
168323
--commit-type "Connectivity" \
@@ -172,7 +327,7 @@ If you no longer need the Azure Virtual Network Manager, you'll need to make sur
172327
173328
1. Remove the connectivity configuration with [az network manager connect-config delete](/cli/azure/network/manager/connect-config#az-network-manager-connect-config-delete):
174329
175-
```azurecli-interactive
330+
```azurecli
176331
az network manager connect-config delete \
177332
--configuration-name "connectivityconfig" \
178333
--name "myAVNM" \
@@ -181,7 +336,7 @@ If you no longer need the Azure Virtual Network Manager, you'll need to make sur
181336
182337
1. Remove the network group with [az network manager group delete](/cli/azure/network/manager/group#az-network-manager-group-delete):
183338
184-
```azurecli-interactive
339+
```azurecli
185340
az network manager group delete \
186341
--name "myNetworkGroup" \
187342
--network-manager-name "myAVNM" \
@@ -190,15 +345,15 @@ If you no longer need the Azure Virtual Network Manager, you'll need to make sur
190345
191346
1. Delete the network manager instance with [az network manager delete](/cli/azure/network/manager#az-network-manager-delete):
192347
193-
```azurecli-interactive
348+
```azurecli
194349
az network manager delete \
195350
--name "myAVNM" \
196351
--resource-group "myAVNMResourceGroup"
197352
```
198353
199354
1. If you no longer need the resource created, delete the resource group with [az group delete](/cli/azure/group#az-group-delete):
200355
201-
```azurecli-interactive
356+
```azurecli
202357
az group delete \
203358
--name "myAVNMResourceGroup"
204359
```
@@ -208,4 +363,5 @@ If you no longer need the Azure Virtual Network Manager, you'll need to make sur
208363
After you've created the Azure Virtual Network Manager, continue on to learn how to block network traffic by using the security admin configuration:
209364
210365
> [!div class="nextstepaction"]
211-
> [Block network traffic with security admin rules](how-to-block-network-traffic-portal.md)
366+
[Block network traffic with security admin rules](how-to-block-network-traffic-portal.md)
367+
[Create a secured hub and spoke network](tutorial-create-secured-hub-and-spoke.md)

0 commit comments

Comments
 (0)