Skip to content

Commit b3f973a

Browse files
v-dirichardsv-dirichards
authored
Merge pull request #211637 from brianlehr/newbranch
Added Granular commissioning info and IPv6
2 parents 1d8be67 + 08c55c6 commit b3f973a

File tree

8 files changed

+191
-36
lines changed

8 files changed

+191
-36
lines changed

‎articles/virtual-network/ip-services/create-custom-ip-address-prefix-cli.md‎

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
title: Create a custom IP address prefix - Azure CLI
2+
title: Create a custom IPv4 address prefix - Azure CLI
33
titleSuffix: Azure Virtual Network
44
description: Learn about how to create a custom IP address prefix using the Azure CLI
55
author: asudbring
@@ -9,9 +9,9 @@ ms.topic: how-to
99
ms.date: 03/31/2022
1010
ms.author: allensu
1111
---
12-
# Create a custom IP address prefix using the Azure CLI
12+
# Create a custom IPv4 address prefix using the Azure CLI
1313

14-
A custom IP address prefix enables you to bring your own IP ranges to Microsoft and associate it to your Azure subscription. The range would continue to be owned by you, though Microsoft would be permitted to advertise it to the Internet. A custom IP address prefix functions as a regional resource that represents a contiguous block of customer owned IP addresses.
14+
A custom IPv4 address prefix enables you to bring your own IPv4 ranges to Microsoft and associate it to your Azure subscription. The range would continue to be owned by you, though Microsoft would be permitted to advertise it to the Internet. A custom IP address prefix functions as a regional resource that represents a contiguous block of customer owned IP addresses.
1515

1616
The steps in this article detail the process to:
1717

@@ -26,18 +26,16 @@ The steps in this article detail the process to:
2626
[!INCLUDE [azure-cli-prepare-your-environment.md](../../../includes/azure-cli-prepare-your-environment.md)]
2727

2828
- This tutorial requires version 2.28 or later of the Azure CLI (you can run az version to determine which you have). If using Azure Cloud Shell, the latest version is already installed.
29-
3029
- Sign in to Azure CLI and ensure you've selected the subscription with which you want to use this feature using `az account`.
31-
32-
- A customer owned IP range to provision in Azure.
30+
- A customer owned IPv4 range to provision in Azure.
3331
- A sample customer range (1.2.3.0/24) is used for this example. This range won't be validated by Azure. Replace the example range with yours.
3432

3533
> [!NOTE]
3634
> For problems encountered during the provisioning process, please see [Troubleshooting for custom IP prefix](manage-custom-ip-address-prefix.md#troubleshooting-and-faqs).
3735
3836
## Pre-provisioning steps
3937

40-
To utilize the Azure BYOIP feature, you must perform the following steps prior to the provisioning of your IP address range.
38+
To utilize the Azure BYOIP feature, you must perform the following steps prior to the provisioning of your IPv4 address range.
4139

4240
### Requirements and prefix readiness
4341

@@ -49,7 +47,7 @@ To utilize the Azure BYOIP feature, you must perform the following steps prior t
4947

5048
For this ROA:
5149

52-
* The Origin AS must be listed as 8075.
50+
* The Origin AS must be listed as 8075 for the Public Cloud. (If the range will be onboarded to the US Gov Cloud, the Origin AS must be listed as 8070.)
5351

5452
* The validity end date (expiration date) needs to account for the time you intend to have the prefix advertised by Microsoft. Some RIRs don't present validity end date as an option and or choose the date for you.
5553

@@ -64,7 +62,7 @@ To utilize the Azure BYOIP feature, you must perform the following steps prior t
6462

6563
To authorize Microsoft to associate a prefix with a customer subscription, a public certificate must be compared against a signed message.
6664

67-
The following steps show the steps required to prepare sample customer range (1.2.3.0/24) for provisioning.
65+
The following steps show the steps required to prepare sample customer range (1.2.3.0/24) for provisioning to the Public cloud.
6866

6967
> [!NOTE]
7068
> Execute the following commands in PowerShell with OpenSSL installed.
@@ -191,7 +189,7 @@ As before, the operation is asynchronous. Use [az network custom-ip prefix show]
191189
> The estimated time to fully complete the commissioning process is 3-4 hours.
192190
193191
> [!IMPORTANT]
194-
> As the custom IP prefix transitions to a **Commissioned** state, the range is being advertised with Microsoft from the local Azure region and globally to the Internet by Microsoft's wide area network under Autonomous System Number (ASN) 8075. Advertising this same range to the Internet from a location other than Microsoft at the same time could potentially create BGP routing instability or traffic loss. For example, a customer on-premises building. Plan any migration of an active range during a maintenance period to avoid impact.
192+
> As the custom IP prefix transitions to a **Commissioned** state, the range is being advertised with Microsoft from the local Azure region and globally to the Internet by Microsoft's wide area network under Autonomous System Number (ASN) 8075. Advertising this same range to the Internet from a location other than Microsoft at the same time could potentially create BGP routing instability or traffic loss. For example, a customer on-premises building. Plan any migration of an active range during a maintenance period to avoid impact. Additionally, you could take advantage of the regional commissioning feature to put a custom IP prefix into a state where it is only advertised within the Azure region it is deployed in-- see [Manage a custom IP address prefix (BYOIP)](manage-custom-ip-address-prefix.md) for more information.
195193
196194
## Next steps
197195

‎articles/virtual-network/ip-services/create-custom-ip-address-prefix-ipv6.md‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
---
2+
title: Create a custom IPv6 address prefix
3+
titleSuffix: Azure Virtual Network
4+
description: Learn about how to create a custom IPv6 address prefix using Azure PowerShell
5+
author: asudbring
6+
ms.service: virtual-network
7+
ms.subservice: ip-services
8+
ms.topic: how-to
9+
ms.date: 03/31/2022
10+
ms.author: allensu
11+
---
12+
# Create a custom IPv6 address prefix using Azure PowerShell
13+
14+
A custom IPv6 address prefix enables you to bring your own IPv6 ranges to Microsoft and associate it to your Azure subscription. The range would continue to be owned by you, though Microsoft would be permitted to advertise it to the Internet. A custom IP address prefix functions as a regional resource that represents a contiguous block of customer owned IP addresses.
15+
16+
The steps in this article detail the process to:
17+
18+
* Prepare a range to provision
19+
20+
* Provision the range for IP allocation
21+
22+
* Enable the range to be advertised by Microsoft
23+
24+
## Differences between using BYOIPv4 and BYOIPv6
25+
26+
> [!IMPORTANT]
27+
> Onboarded custom IPv6 address prefixes are have several unique attributes which make them different than custom IPv4 address prefixes.
28+
29+
* Custom IPv6 prefixes use a "parent"/"child" model, where the global (parent) range is advertised by the Microsoft Wide Area Network (WAN) and the regional (child) range(s) are advertised by their respective region(s). Note that global ranges must be /48 in size, while regional ranges must always be /64 size.
30+
31+
* Only the global range needs to be validated using the steps detailed in the [Create Custom IP Address Prefix](create-custom-ip-address-prefix-portal.md) articles. The regional ranges are derived from the global range in a similar manner to the way public IP prefixes are derived from custom IP prefixes.
32+
33+
* Public IPv6 prefixes must be derived from the regional ranges. Only the first 2048 IPv6 addresses of each regional /64 custom IP prefix can be utilized as valid IPv6 space. Attempting to create public IPv6 prefixes that span beyond this will result in an error.
34+
35+
## Prerequisites
36+
37+
- An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
38+
- Azure PowerShell installed locally or Azure Cloud Shell.
39+
- Sign in to Azure PowerShell and ensure you've selected the subscription with which you want to use this feature. For more information, see [Sign in with Azure PowerShell](/powershell/azure/authenticate-azureps).
40+
- Ensure your Az.Network module is 4.21.0 or later. To verify the installed module, use the command Get-InstalledModule -Name "Az.Network". If the module requires an update, use the command Update-Module -Name "Az.Network" if necessary.
41+
- A customer owned IP range to provision in Azure.
42+
- A sample customer range (2a05:f500:2::/48) is used for this example. This range won't be validated by Azure. Replace the example range with yours.
43+
44+
If you choose to install and use PowerShell locally, this article requires the Azure PowerShell module version 5.4.1 or later. Run `Get-Module -ListAvailable Az` to find the installed version. If you need to upgrade, see [Install Azure PowerShell module](/powershell/azure/install-Az-ps). If you're running PowerShell locally, you also need to run `Connect-AzAccount` to create a connection with Azure.
45+
46+
> [!NOTE]
47+
> For problems encountered during the provisioning process, please see [Troubleshooting for custom IP prefix](manage-custom-ip-address-prefix.md#troubleshooting-and-faqs).
48+
49+
## Pre-provisioning steps
50+
51+
To utilize the Azure BYOIP feature, you must perform and number of steps prior to the provisioning of your IPv6 address range. Please refer to the [IPv4 instructions](create-custom-ip-address-prefix-powershell.md#pre-provisioning-steps) for details. Note all these steps should be completed for the IPv6 global (parent) range.
52+
53+
## Provisioning for IPv6
54+
55+
The following steps display the modified steps for provisioning a sample global (parent) IPv6 range (2a05:f500:2::/48) and regional (child) IPv6 ranges. Note that some of the steps have been abbreviated or condensed from the [IPv4 instructions](create-custom-ip-address-prefix-powershell.md) to focus on the differences between IPv4 and IPv6.
56+
57+
### Create a resource group and specify the prefix and authorization messages
58+
59+
Create a resource group in the desired location for provisioning the global range resource.
60+
61+
> [!IMPORTANT]
62+
> Although the resource for the global range will be associated with a region, the prefix will be advertised by the Microsoft WAN globally.
63+
64+
```azurepowershell-interactive
65+
$rg =@{
66+
Name = 'myResourceGroup'
67+
Location = 'WestUS2'
68+
}
69+
New-AzResourceGroup @rg
70+
```
71+
72+
### Provision a global custom IPv6 address prefix
73+
74+
The following command creates a custom IP prefix in the specified region and resource group. Specify the exact prefix in CIDR notation as a string to ensure there's no syntax error. (The `-AuthorizationMessage` and `-SignedMessage` parameters are constructed in the same manner as they are for IPv4; for more information, see [Create a custom IP prefix - PowerShell](create-custom-ip-address-prefix-powershell.md).) Note that no zonal properties are provided because the global range isn't associated with any particular region (and therefore no regional availability zones).
75+
76+
```azurepowershell-interactive
77+
$prefix =@{
78+
Name = 'myCustomIPv6GlobalPrefix'
79+
ResourceGroupName = 'myResourceGroup'
80+
Location = 'WestUS'
81+
CIDR = '2a05:f500:2::/48'
82+
AuthorizationMessage = 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx|2a05:f500:2::/48|yyyymmdd'
83+
SignedMessage = $byoipauthsigned
84+
}
85+
$myCustomIpPrefix = New-AzCustomIPPrefix @prefix
86+
```
87+
88+
### Provision a regional custom IPv6 address prefix
89+
90+
After the global custom IP prefix is in a **Provisioned** state, regional custom IP prefixes can be created. These ranges must always be of size /64 to be considered valid. The ranges can be created in any region (it doesn't need to be the same as the global custom IP prefix), keeping in mind any geolocation restrictions associated with the original global range. The "children" custom IP prefixes will be advertised locally from the region they are created in. Because the validation is only done for global custom IP prefix provision, no Authorization or Signed message is required. (Because these ranges will be advertised from a specific region, zones can be utilized.)
91+
92+
```azurepowershell-interactive
93+
$prefix =@{
94+
Name = 'myCustomIPv6RegionalPrefix'
95+
ResourceGroupName = 'myResourceGroup'
96+
Location = 'EastUS2'
97+
CIDR = '2a05:f500:2:1::/64'
98+
}
99+
$myCustomIpPrefix = New-AzCustomIPPrefix @prefix -Zone 1,2,3
100+
```
101+
Similar to IPv4 custom IP prefixes, after the regional custom IP prefix is in a **Provisioned** state, public IP prefixes can be derived from the regional custom IP prefix. These public IP prefixes and any public IP addresses derived from them can be attached to networking resources, though they are not yet being advertised.
102+
103+
> [!IMPORTANT]
104+
> Public IPv6 prefixes derived from regional custom IPv6 prefixes can only utilize the first 2048 IPs of the /64 range.
105+
106+
### Commission the custom IPv6 address prefixes
107+
108+
When commissioning custom IPv6 prefixes, the global and regional prefixes are treated separately. In other words, commissioning a regional custom IPv6 prefix isn't connected to commissioning the global custom IPv6 prefix.
109+
110+
:::image type="content" source="./media/create-custom-ip-address-prefix-ipv6/any-region-prefix.png" alt-text="Diagram of custom IPv6 prefix showing parent prefix and child prefixes across multiple regions.":::
111+
112+
The safest strategy for range migrations is as follows:
113+
1. Provision all required regional custom IPv6 prefixes in their respective regions. Create public IPv6 prefixes and public IP addresses and attach to resources.
114+
2. Commission each regional custom IPv6 prefix and test connectivity to the IPs within the region. Repeat for each regional custom IPv6 prefix.
115+
3. After all regional custom IPv6 prefixes (and derived prefixes/IPs) have been verified to work as expected, commission the global custom IPv6 prefix, which will advertise the larger range to the Internet.
116+
117+
Using the example ranges above, the command sequence would be:
118+
119+
```azurepowershell-interactive
120+
Update-AzCustomIpPrefix -ResourceId $myCustomIPv6RegionalPrefix.Id -Commission
121+
```
122+
Followed by:
123+
124+
```azurepowershell-interactive
125+
Update-AzCustomIpPrefix -ResourceId $myCustomIPv6GlobalPrefix.Id -Commission
126+
```
127+
128+
It is possible to commission the global custom IPv6 prefix prior to the regional custom IPv6 prefixes; however, note that this will mean the global range is being advertised to the Internet before the regional prefixes are ready, so this is not recommended for migrations of active ranges. Additionally, it is possible to decommission a global custom IPv6 prefix while there are still active (commissioned) regional custom IPv6 prefixes or to decommission a regional custom IP prefix while the global prefix is still active (commissioned).
129+
130+
## Next steps
131+
132+
- To learn about scenarios and benefits of using a custom IP prefix, see [Custom IP address prefix (BYOIP)](custom-ip-address-prefix.md).
133+
134+
- For more information on managing a custom IP prefix, see [Manage a custom IP address prefix (BYOIP)](manage-custom-ip-address-prefix.md).

‎articles/virtual-network/ip-services/create-custom-ip-address-prefix-portal.md‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
title: Create a custom IP address prefix - Azure portal
2+
title: Create a custom IPv4 address prefix - Azure portal
33
titleSuffix: Azure Virtual Network
44
description: Learn about how to onboard a custom IP address prefix using the Azure portal
55
author: asudbring
@@ -10,9 +10,9 @@ ms.date: 03/31/2022
1010
ms.author: allensu
1111

1212
---
13-
# Create a custom IP address prefix using the Azure portal
13+
# Create a custom IPv4 address prefix using the Azure portal
1414

15-
A custom IP address prefix enables you to bring your own IP ranges to Microsoft and associate it to your Azure subscription. The range would continue to be owned by you, though Microsoft would be permitted to advertise it to the Internet. A custom IP address prefix functions as a regional resource that represents a contiguous block of customer owned IP addresses.
15+
A custom IPv4 address prefix enables you to bring your own IPv4 ranges to Microsoft and associate it to your Azure subscription. The range would continue to be owned by you, though Microsoft would be permitted to advertise it to the Internet. A custom IP address prefix functions as a regional resource that represents a contiguous block of customer owned IP addresses.
1616

1717
The steps in this article detail the process to:
1818

@@ -26,15 +26,15 @@ The steps in this article detail the process to:
2626

2727
- An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
2828

29-
- A customer owned IP range to provision in Azure.
29+
- A customer owned IPv4 range to provision in Azure.
3030
- A sample customer range (1.2.3.0/24) is used for this example. This range won't be validated by Azure. Replace the example range with yours.
3131

3232
> [!NOTE]
3333
> For problems encountered during the provisioning process, please see [Troubleshooting for custom IP prefix](manage-custom-ip-address-prefix.md#troubleshooting-and-faqs).
3434
3535
## Pre-provisioning steps
3636

37-
To utilize the Azure BYOIP feature, you must perform the following steps prior to the provisioning of your IP address range.
37+
To utilize the Azure BYOIP feature, you must perform the following steps prior to the provisioning of your IPv4 address range.
3838

3939
### Requirements and prefix readiness
4040

@@ -46,7 +46,7 @@ To utilize the Azure BYOIP feature, you must perform the following steps prior t
4646

4747
For this ROA:
4848

49-
* The Origin AS must be listed as 8075.
49+
* The Origin AS must be listed as 8075 for the Public Cloud. (If the range will be onboarded to the US Gov Cloud, the Origin AS must be listed as 8070.)
5050

5151
* The validity end date (expiration date) needs to account for the time you intend to have the prefix advertised by Microsoft. Some RIRs don't present validity end date as an option and or choose the date for you.
5252

@@ -61,7 +61,7 @@ To utilize the Azure BYOIP feature, you must perform the following steps prior t
6161

6262
To authorize Microsoft to associate a prefix with a customer subscription, a public certificate must be compared against a signed message.
6363

64-
The following steps show the steps required to prepare sample customer range (1.2.3.0/24) for provisioning.
64+
The following steps show the steps required to prepare sample customer range (1.2.3.0/24) for provisioning to the Public cloud.
6565

6666
> [!NOTE]
6767
> Execute the following commands in PowerShell with OpenSSL installed.
@@ -210,7 +210,7 @@ The operation is asynchronous. You can check the status by reviewing the **Commi
210210
> The estimated time to fully complete the commissioning process is 3-4 hours.
211211
212212
> [!IMPORTANT]
213-
> As the custom IP prefix transitions to a **Commissioned** state, the range is being advertised with Microsoft from the local Azure region and globally to the Internet by Microsoft's wide area network under Autonomous System Number (ASN) 8075. Advertising this same range to the Internet from a location other than Microsoft at the same time could potentially create BGP routing instability or traffic loss. For example, a customer on-premises building. Plan any migration of an active range during a maintenance period to avoid impact.
213+
> As the custom IP prefix transitions to a **Commissioned** state, the range is being advertised with Microsoft from the local Azure region and globally to the Internet by Microsoft's wide area network under Autonomous System Number (ASN) 8075. Advertising this same range to the Internet from a location other than Microsoft at the same time could potentially create BGP routing instability or traffic loss. For example, a customer on-premises building. Plan any migration of an active range during a maintenance period to avoid impact. Additionally, you could take advantage of the regional commissioning feature to put a custom IP prefix into a state where it is only advertised within the Azure region it is deployed in-- see [Manage a custom IP address prefix (BYOIP)](manage-custom-ip-address-prefix.md) for more information.
214214
215215
## Next steps
216216

0 commit comments

Comments
 (0)