Skip to content

Commit b2d9e9a

Browse files
spelluruspelluru
committed
Updating networking articles with latest info
1 parent 38aedd7 commit b2d9e9a

File tree

2 files changed

+98
-56
lines changed

2 files changed

+98
-56
lines changed

‎articles/event-hubs/event-hubs-ip-filtering.md

Lines changed: 71 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Azure Event Hubs Firewall Rules | Microsoft Docs
33
description: Use Firewall Rules to allow connections from specific IP addresses to Azure Event Hubs.
44
ms.topic: article
5-
ms.date: 10/28/2021
5+
ms.date: 02/23/2022
66
---
77

88
# Allow access to Azure Event Hubs namespaces from specific IP addresses or ranges
@@ -63,75 +63,94 @@ The following Resource Manager template enables adding an IP filter rule to an e
6363

6464
**ipMask** in the template is a single IPv4 address or a block of IP addresses in CIDR notation. For example, in CIDR notation 70.37.104.0/24 represents the 256 IPv4 addresses from 70.37.104.0 to 70.37.104.255, with 24 indicating the number of significant prefix bits for the range.
6565

66-
When adding virtual network or firewalls rules, set the value of `defaultAction` to `Deny`.
66+
> [!NOTE]
67+
> The default value of the `defaultAction` is `Allow`. When adding virtual network or firewalls rules, make sure you set the `defaultAction` to `Deny`.
6768
6869
```json
6970
{
70-
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
71+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
7172
"contentVersion": "1.0.0.0",
7273
"parameters": {
73-
"eventhubNamespaceName": {
74-
"type": "string",
75-
"metadata": {
76-
"description": "Name of the Event Hubs namespace"
74+
"eventhubNamespaceName": {
75+
"type": "String"
7776
}
78-
},
79-
"location": {
80-
"type": "string",
81-
"metadata": {
82-
"description": "Location for Namespace"
83-
}
84-
}
85-
},
86-
"variables": {
87-
"namespaceNetworkRuleSetName": "[concat(parameters('eventhubNamespaceName'), concat('/', 'default'))]",
8877
},
8978
"resources": [
90-
{
91-
"apiVersion": "2018-01-01-preview",
92-
"name": "[parameters('eventhubNamespaceName')]",
93-
"type": "Microsoft.EventHub/namespaces",
94-
"location": "[parameters('location')]",
95-
"sku": {
96-
"name": "Standard",
97-
"tier": "Standard"
98-
},
99-
"properties": { }
100-
},
101-
{
102-
"apiVersion": "2018-01-01-preview",
103-
"name": "[variables('namespaceNetworkRuleSetName')]",
104-
"type": "Microsoft.EventHub/namespaces/networkrulesets",
105-
"dependsOn": [
106-
"[concat('Microsoft.EventHub/namespaces/', parameters('eventhubNamespaceName'))]"
107-
],
108-
"properties": {
109-
"virtualNetworkRules": [<YOUR EXISTING VIRTUAL NETWORK RULES>],
110-
"ipRules":
111-
[
112-
{
113-
"ipMask":"10.1.1.1",
114-
"action":"Allow"
79+
{
80+
"type": "Microsoft.EventHub/namespaces",
81+
"apiVersion": "2021-11-01",
82+
"name": "[parameters('eventhubNamespaceName')]",
83+
"location": "East US",
84+
"sku": {
85+
"name": "Standard",
86+
"tier": "Standard",
87+
"capacity": 1
11588
},
116-
{
117-
"ipMask":"11.0.0.0/24",
118-
"action":"Allow"
89+
"properties": {
90+
"disableLocalAuth": false,
91+
"zoneRedundant": true,
92+
"isAutoInflateEnabled": false,
93+
"maximumThroughputUnits": 0,
94+
"kafkaEnabled": true
95+
}
96+
},
97+
{
98+
"type": "Microsoft.EventHub/namespaces/networkRuleSets",
99+
"apiVersion": "2021-11-01",
100+
"name": "[concat(parameters('eventhubNamespaceName'), '/default')]",
101+
"location": "East US",
102+
"dependsOn": [
103+
"[resourceId('Microsoft.EventHub/namespaces', parameters('eventhubNamespaceName'))]"
104+
],
105+
"properties": {
106+
"publicNetworkAccess": "Enabled",
107+
"defaultAction": "Deny",
108+
"virtualNetworkRules": [],
109+
"ipRules": [
110+
{
111+
"ipMask":"10.1.1.1",
112+
"action":"Allow"
113+
},
114+
{
115+
"ipMask":"11.0.0.0/24",
116+
"action":"Allow"
117+
}
118+
]
119119
}
120-
],
121-
"trustedServiceAccessEnabled": false,
122-
"defaultAction": "Deny"
123120
}
124-
}
125-
],
126-
"outputs": { }
127-
}
121+
]
122+
}
123+
128124
```
129125

130126
To deploy the template, follow the instructions for [Azure Resource Manager][lnk-deploy].
131127

132128
> [!IMPORTANT]
133129
> If there are no IP and virtual network rules, all the traffic flows into the namespace even if you set the `defaultAction` to `deny`. The namespace can be accessed over the public internet (using the access key). Specify at least one IP rule or virtual network rule for the namespace to allow traffic only from the specified IP addresses or subnet of a virtual network.
134130
131+
## default action and public network access
132+
133+
### REST API
134+
135+
The default value of the `defaultAction` property was `Deny` for API version **2021-01-01-preview and earlier**. However, the deny rule isn't enforced unless you set IP filters or virtual network (VNet) rules. That is, if you didn't have any IP filters or VNet rules, it's treated as `Allow`.
136+
137+
From API version **2021-06-01-preview onwards**, the default value of the `defaultAction` property is `Allow`, to accurately reflect the service-side enforcement. If the default action is set to `Deny`, IP filters and VNet rules are enforced. If the default action is set to `Allow`, IP filters and VNet rules aren't enforced. The service remembers the rules when you turn them off and then back on again.
138+
139+
The API version **2021-06-01-preview onwards** also introduces a new property named `publicNetworkAccess`. If it's set to `Disabled`, operations are restricted to private links only. If it's set to `Enabled`, operations are allowed over the public internet.
140+
141+
For more information about these properties, see [Create or Update Network Rule Set](/rest/api/eventhub/preview/namespaces-network-rule-set/create-or-update-network-rule-set) and [Create or Update Private Endpoint Connections](/rest/api/eventhub/preview/private-endpoint-connections/create-or-update).
142+
143+
> [!NOTE]
144+
> None of the above settings bypass validation of claims via SAS or Azure AD authentication. The authentication check always runs after the service validates the network checks that are configured by `defaultAction`, `publicNetworkAccess`, `privateEndpointConnections` settings.
145+
146+
### Azure portal
147+
148+
Azure portal always uses the latest API version to get and set properties. If you had previously configured your namespace using **2021-01-01-preview and earlier** with `defaultAction` set to `Deny`, and specified zero IP filters and VNet rules, the portal would have previously checked **Selected Networks** on the **Networking** page of your namespace. Now, it checks the **All networks** option.
149+
150+
:::image type="content" source="./media/event-hubs-firewall/firewall-all-networks-selected.png" lightbox="./media/event-hubs-firewall/firewall-all-networks-selected.png" alt-text="Screenshot that shows the Public access page with the All networks option selected.":::
151+
152+
153+
135154
## Next steps
136155

137156
For constraining access to Event Hubs to Azure virtual networks, see the following link:

‎articles/event-hubs/event-hubs-service-endpoints.md

Lines changed: 27 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Virtual Network service endpoints - Azure Event Hubs | Microsoft Docs
33
description: This article provides information on how to add a Microsoft.EventHub service endpoint to a virtual network.
44
ms.topic: article
5-
ms.date: 10/28/2021
5+
ms.date: 02/23/2021
66
---
77

88
# Allow access to Azure Event Hubs namespaces from specific virtual networks
@@ -166,6 +166,8 @@ When adding virtual network or firewalls rules, set the value of `defaultAction`
166166
"[concat('Microsoft.EventHub/namespaces/', parameters('eventhubNamespaceName'))]"
167167
],
168168
"properties": {
169+
"publicNetworkAccess": "Enabled",
170+
"defaultAction": "Deny",
169171
"virtualNetworkRules":
170172
[
171173
{
@@ -175,9 +177,8 @@ When adding virtual network or firewalls rules, set the value of `defaultAction`
175177
"ignoreMissingVnetServiceEndpoint": false
176178
}
177179
],
178-
"ipRules":[<YOUR EXISTING IP RULES>],
179-
"trustedServiceAccessEnabled": false,
180-
"defaultAction": "Deny"
180+
"ipRules":[],
181+
"trustedServiceAccessEnabled": false
181182
}
182183
}
183184
],
@@ -190,6 +191,28 @@ To deploy the template, follow the instructions for [Azure Resource Manager][lnk
190191
> [!IMPORTANT]
191192
> If there are no IP and virtual network rules, all the traffic flows into the namespace even if you set the `defaultAction` to `deny`. The namespace can be accessed over the public internet (using the access key). Specify at least one IP rule or virtual network rule for the namespace to allow traffic only from the specified IP addresses or subnet of a virtual network.
192193
194+
## default action and public network access
195+
196+
### REST API
197+
198+
The default value of the `defaultAction` property was `Deny` for API version **2021-01-01-preview and earlier**. However, the deny rule isn't enforced unless you set IP filters or virtual network (VNet) rules. That is, if you didn't have any IP filters or VNet rules, it's treated as `Allow`.
199+
200+
From API version **2021-06-01-preview onwards**, the default value of the `defaultAction` property is `Allow`, to accurately reflect the service-side enforcement. If the default action is set to `Deny`, IP filters and VNet rules are enforced. If the default action is set to `Allow`, IP filters and VNet rules aren't enforced. The service remembers the rules when you turn them off and then back on again.
201+
202+
The API version **2021-06-01-preview onwards** also introduces a new property named `publicNetworkAccess`. If it's set to `Disabled`, operations are restricted to private links only. If it's set to `Enabled`, operations are allowed over the public internet.
203+
204+
For more information about these properties, see [Create or Update Network Rule Set](/rest/api/eventhub/preview/namespaces-network-rule-set/create-or-update-network-rule-set) and [Create or Update Private Endpoint Connections](/rest/api/eventhub/preview/private-endpoint-connections/create-or-update).
205+
206+
> [!NOTE]
207+
> None of the above settings bypass validation of claims via SAS or Azure AD authentication. The authentication check always runs after the service validates the network checks that are configured by `defaultAction`, `publicNetworkAccess`, `privateEndpointConnections` settings.
208+
209+
### Azure portal
210+
211+
Azure portal always uses the latest API version to get and set properties. If you had previously configured your namespace using **2021-01-01-preview and earlier** with `defaultAction` set to `Deny`, and specified zero IP filters and VNet rules, the portal would have previously checked **Selected Networks** on the **Networking** page of your namespace. Now, it checks the **All networks** option.
212+
213+
:::image type="content" source="./media/event-hubs-firewall/firewall-all-networks-selected.png" lightbox="./media/event-hubs-firewall/firewall-all-networks-selected.png" alt-text="Screenshot that shows the Public access page with the All networks option selected.":::
214+
215+
193216
## Next steps
194217

195218
For more information about virtual networks, see the following links:

0 commit comments

Comments
 (0)