Skip to content

Commit bea1a04

Browse files
v-stsavellv-stsavell
authored
Merge pull request #212891 from SteveSaunders1952/v-ssaunders-YinglueZhang-MS
Edits to ASA VNet UDR Doc
2 parents f84707a + 90e22ef commit bea1a04

File tree

4 files changed

+356
-0
lines changed

4 files changed

+356
-0
lines changed

‎articles/spring-apps/concept-outbound-type.md

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
title: Customize Azure Spring Cloud egress with a user-defined route
3+
description: Learn how to customize Azure Spring Cloud egress with a user-defined route.
4+
author: karlerickson
5+
ms.author: yinglzh
6+
ms.service: spring-apps
7+
ms.topic: article
8+
ms.date: 09/25/2021
9+
ms.custom: devx-track-java, devx-track-azurecli
10+
---
11+
12+
# Customize Azure Spring Cloud egress with a user-defined route
13+
14+
**This article applies to:** ✔️ Java ✔️ C#
15+
16+
**This article applies to:** ✔️ Basic/Standard tier ✔️ Enterprise tier
17+
18+
This article describes how to customize an instance's egress route to support custom network scenarios. For example, you might want to customize an instance's egress route for networks that disallow public IPs and require the instance to sit behind a network virtual appliance (NVA).
19+
20+
By default, Azure Spring Apps provisions a Standard SKU Load Balancer that you can set up and use for egress. However, the default setup may not meet the requirements of all scenarios. For example, public IPs may not be allowed, or more hops may be required for egress.
21+
22+
## Prerequisites
23+
24+
- All prerequisites for deploying Azure Spring Apps in a virtual network. For more information, see [Deploy Azure Spring Apps in a virtual network](how-to-deploy-in-azure-virtual-network.md).
25+
- An API version of *2022-09-01 preview* or greater.
26+
- [Azure CLI version 1.1.7 or later](/cli/azure/install-azure-cli).
27+
28+
## Limitations
29+
30+
- You can only define `OutboundType` when you create a new Azure Spring Apps service instance, and you can't updated it afterwards. `OutboundType` works only with a VNet instance.
31+
- Setting `outboundType` to `UserDefinedRouting` requires a user-defined route with valid outbound connectivity for your instance.
32+
- Setting `outboundType` to `UserDefinedRouting` implies that the ingress source IP routed to the load-balancer may not match the instance's outgoing egress destination address.
33+
34+
## Overview of outbound types in Azure Spring Apps
35+
36+
You can customize an Azure Spring Apps instance with a unique `outboundType` of type `loadBalancer` or `userDefinedRouting`.
37+
38+
### Outbound type loadBalancer
39+
40+
The default `outboundType` value is `loadBalancer`. If `outboundType` is set to `loadBalancer`, Azure Spring Apps automatically configures egress paths and expects egress from the load balancers created by the Azure Spring Apps resource provider. Two load balancers are recreated: one for the service runtime and another for the user app. A public IP address is provisioned for each load balancer. The load balancer is used for egress traffic for the generated public IP.
41+
42+
### Outbound type userDefinedRouting
43+
44+
> [!NOTE]
45+
> Using an outbound type is an advanced networking scenario and requires proper network configuration.
46+
47+
If `outboundType` is set to `userDefinedRouting`, Azure Spring Apps won't automatically configure egress paths. You must set up egress paths yourself. You could still find two load balancers in your resource group. They're only used for internal traffic and won't expose any public IP. You must prepare two route tables associated with two subnets: one to service the runtime and another for the user app.
48+
49+
> [!IMPORTANT]
50+
> An `outboundType` of `userDefinedRouting` requires a route for `0.0.0.0/0` and the next hop destination of a network virtual appliance in the route table. For more information, see [Customer responsibilities for running Azure Spring Apps in VNET](vnet-customer-responsibilities.md).
51+
52+
## See also
53+
54+
- [Control egress traffic for an Azure Spring Apps instance](how-to-create-user-defined-route-instance.md)

‎articles/spring-apps/how-to-create-user-defined-route-instance.md

Lines changed: 298 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,298 @@
1+
---
2+
title: Control egress traffic for an Azure Spring Apps instance
3+
description: Learn how to control egress traffic for an Azure Spring Apps instance
4+
author: karlerickson
5+
ms.author: yinglzh
6+
ms.service: spring-apps
7+
ms.topic: article
8+
ms.date: 09/25/2021
9+
ms.custom: devx-track-java, devx-track-azurecli
10+
---
11+
12+
# Control egress traffic for an Azure Spring Apps instance
13+
14+
**This article applies to:** ✔️ Java ✔️ C#
15+
16+
**This article applies to:** ✔️ Basic/Standard tier ✔️ Enterprise tier
17+
18+
This article describes how to secure outbound traffic from your applications hosted in Azure Spring Apps. The article provides an example of a user-defined route (UDR) instance. UDR is an advanced feature that lets you fully control egress traffic. You can use UDR in scenarios such as disallowing an Azure Spring Apps auto-generated public IP.
19+
20+
## Prerequisites
21+
22+
- All prerequisites for deploying Azure Spring Apps in a virtual network. For more information, see [Deploy Azure Spring Apps in a virtual network](how-to-deploy-in-azure-virtual-network.md).
23+
- API version of `2022-09-01 preview` or greater
24+
- [Azure CLI version 1.1.7 or later](/cli/azure/install-azure-cli).
25+
- You should be familiar with information in the following articles:
26+
- [Deploy Azure Spring Apps in a virtual network](how-to-deploy-in-azure-virtual-network.md)
27+
- [Customer responsibilities for running Azure Spring Apps in VNET](vnet-customer-responsibilities.md)
28+
- [Customize Azure Spring Cloud egress with a User-Defined Route](concept-outbound-type.md)
29+
30+
## Create a VNet instance using a user-defined route
31+
32+
The following illustration shows an example of an Azure Spring Apps VNet instance using a user-defined route.
33+
34+
:::image type="content" source="media/how-to-create-user-defined-route-instance/user-defined-route-example-architecture.png" lightbox="media/how-to-create-user-defined-route-instance/user-defined-route-example-architecture.png" alt-text="Architecture diagram showing user-defined routing.":::
35+
36+
### Set configuration using environment variables
37+
38+
The following example shows how to define a set of environment variables to be used in resource creation.
39+
40+
```bash
41+
PREFIX="asa-egress"
42+
RG="${PREFIX}-rg"
43+
LOC="eastus"
44+
ASANAME="${PREFIX}"
45+
VNET_NAME="${PREFIX}-vnet"
46+
ASA_APP_SUBNET_NAME="asa-app-subnet"
47+
ASA_SERVICE_RUNTIME_SUBNET_NAME="asa-service-runtime-subnet"
48+
# DO NOT CHANGE FWSUBNET_NAME - This is currently a requirement for Azure Firewall.
49+
FWSUBNET_NAME="AzureFirewallSubnet"
50+
FWNAME="${PREFIX}-fw"
51+
FWPUBLICIP_NAME="${PREFIX}-fwpublicip"
52+
FWIPCONFIG_NAME="${PREFIX}-fwconfig"
53+
APP_ROUTE_TABLE_NAME="${PREFIX}-app-rt"
54+
SERVICE_RUNTIME_ROUTE_TABLE_NAME="${PREFIX}-service-runtime-rt"
55+
FWROUTE_NAME="${PREFIX}-fwrn"
56+
ASA_NAME="${PREFIX}-instance"
57+
```
58+
59+
### Create a virtual network with multiple subnets
60+
61+
This section shows you how to provision a virtual network with three separate subnets: one for the user apps, one for service runtime, and one for the firewall.
62+
63+
First create a resource group, as shown in the following example.
64+
65+
```azurecli
66+
# Create resource group.
67+
68+
az group create --name $RG --location $LOC
69+
```
70+
71+
Then create a virtual network with three subnets to host the ASA instance and the Azure Firewall, as shown in the following example.
72+
73+
```azurecli
74+
# Dedicated virtual network with ASA app subnet.
75+
76+
az network vnet create \
77+
--resource-group $RG \
78+
--name $VNET_NAME \
79+
--location $LOC \
80+
--address-prefixes 10.42.0.0/16 \
81+
--subnet-name $ASA_APP_SUBNET_NAME \
82+
--subnet-prefix 10.42.1.0/24
83+
84+
# Dedicated subnet for ASA service runtime subnet.
85+
86+
az network vnet subnet create \
87+
--resource-group $RG \
88+
--vnet-name $VNET_NAME \
89+
--name $ASA_SERVICE_RUNTIME_SUBNET_NAME\
90+
--address-prefix 10.42.2.0/24
91+
92+
# Dedicated subnet for Azure Firewall. (Firewall name cannot be changed.)
93+
94+
az network vnet subnet create \
95+
--resource-group $RG \
96+
--vnet-name $VNET_NAME \
97+
--name $FWSUBNET_NAME \
98+
--address-prefix 10.42.3.0/24
99+
```
100+
101+
### Create and set up an Azure Firewall with a user-defined route
102+
103+
Use the following command to create and set up an Azure Firewall with a user-defined route and configure Azure Firewall outbound rules. The firewall lets you configure granular egress traffic rules from an Azure Spring Apps instance.
104+
105+
> [!IMPORTANT]
106+
> If your cluster or application creates a large number of outbound connections directed to the same or small subset of destinations, you might require more firewall frontend IPs to avoid reaching the maximum ports per front-end IP. For more information on how to create an Azure firewall with multiple IPs, see [Quickstart: Create an Azure Firewall with multiple public IP addresses - ARM template](../firewall/quick-create-multiple-ip-template.md). Create a standard SKU public IP resource that will be used as the Azure Firewall front-end address.
107+
108+
```azurecli
109+
az network public-ip create \
110+
--resource-group $RG \
111+
--name $FWPUBLICIP_NAME -l $LOC \
112+
--sku "Standard"
113+
```
114+
115+
The following example shows how to install the Azure Firewall preview CLI extension and deploy Azure Firewall.
116+
117+
```azurecli
118+
# Install Azure Firewall preview CLI extension.
119+
120+
az extension add --name azure-firewall
121+
122+
# Deploy Azure Firewall.
123+
124+
az network firewall create \
125+
--resource-group $RG \
126+
--firewall-name $FWNAME -l $LOC \
127+
--enable-dns-proxy true
128+
```
129+
130+
The following example shows how to assign the IP address you created to the firewall front end.
131+
132+
> [!NOTE]
133+
> Setting up the public IP address to the Azure Firewall may take a few minutes. To leverage FQDN on network rules, enable DNS proxy. When enabled, the firewall will listen on port 53 and forward DNS requests to the specified DNS server. The firewall can then translate the FQDN automatically.
134+
135+
```azurecli
136+
# Configure firewall IP config.
137+
138+
az network firewall ip-config create \
139+
--resource-group $RG \
140+
--firewall-name $FWNAME \
141+
--name $FWIPCONFIG_NAME \
142+
--public-ip-address $FWPUBLICIP_NAME \
143+
--vnet-name $VNET_NAME
144+
```
145+
146+
When the operation has completed, save the firewall front-end IP address for configuration later, as shown in the following example.
147+
148+
```azurecli
149+
# Capture firewall IP address for later use.
150+
151+
FWPUBLIC_IP=$(az network public-ip show \
152+
--resource-group $RG \
153+
--name $FWPUBLICIP_NAME \
154+
--query "ipAddress" \
155+
--output tsv)
156+
FWPRIVATE_IP=$(az network firewall show \
157+
--resource-group $RG \
158+
--name $FWNAME \
159+
--query "ipConfigurations[0].privateIpAddress" \
160+
--output tsv | tr -d '[:space:]')
161+
```
162+
163+
### Create a user-defined route with a hop to Azure Firewall
164+
165+
Azure automatically routes traffic between Azure subnets, virtual networks, and on-premises networks. If you want to change Azure's default routing, create a route table.
166+
167+
The following example shows how to create a route table to be associated with a specified subnet. The route table defines the next hop, as in the Azure Firewall you created. Each subnet can have one route table associated with it, or could have no associated route table.
168+
169+
```azurecli
170+
# Create UDR and add a route for Azure Firewall.
171+
172+
az network route-table create \
173+
--resource-group $RG -l $LOC \
174+
--name $APP_ROUTE_TABLE_NAME
175+
az network route-table route create \
176+
--resource-group $RG \
177+
--name $FWROUTE_NAME \
178+
--route-table-name $APP_ROUTE_TABLE_NAME \
179+
--address-prefix 0.0.0.0/0 \
180+
--next-hop-type VirtualAppliance \
181+
--next-hop-ip-address $FWPRIVATE_IP
182+
az network route-table create \
183+
--resource-group $RG -l $LOC \
184+
--name $SERVICE_RUNTIME_ROUTE_TABLE_NAME
185+
az network route-table route create \
186+
--resource-group $RG \
187+
--name $FWROUTE_NAME \
188+
--route-table-name $SERVICE_RUNTIME_ROUTE_TABLE_NAME \
189+
--address-prefix 0.0.0.0/0 \
190+
--next-hop-type VirtualAppliance \
191+
--next-hop-ip-address $FWPRIVATE_IP
192+
```
193+
194+
### Adding firewall rules
195+
196+
The following example shows hot to add rules to your firewall. For more information, see [Customer responsibilities for running Azure Spring Apps in VNET](vnet-customer-responsibilities.md).
197+
198+
```azurecli
199+
# Add firewall network rules.
200+
201+
az network firewall network-rule create \
202+
--resource-group $RG \
203+
--firewall-name $FWNAME \
204+
--collection-name 'asafwnr' -n 'apiudp' \
205+
--protocols 'UDP' \
206+
--source-addresses '*' \
207+
--destination-addresses "AzureCloud" \
208+
--destination-ports 1194 \
209+
--action allow \
210+
--priority 100
211+
az network firewall network-rule create \
212+
--resource-group $RG \
213+
--firewall-name $FWNAME \
214+
--collection-name 'asafwnr' -n 'springcloudtcp' \
215+
--protocols 'TCP' \
216+
--source-addresses '*' \
217+
--destination-addresses "AzureCloud" \
218+
--destination-ports 443 445
219+
az network firewall network-rule create \
220+
--resource-group $RG \
221+
--firewall-name $FWNAME \
222+
--collection-name 'asafwnr' \
223+
--name 'time' \
224+
--protocols 'UDP' \
225+
--source-addresses '*' \
226+
--destination-fqdns 'ntp.ubuntu.com' \
227+
--destination-ports 123
228+
229+
# Add firewall application rules.
230+
231+
az network firewall application-rule create \
232+
--resource-group $RG \
233+
--firewall-name $FWNAME \
234+
--collection-name 'aksfwar'\
235+
--name 'fqdn' \
236+
--source-addresses '*' \
237+
--protocols 'http=80' 'https=443' \
238+
--fqdn-tags "AzureKubernetesService" \
239+
--action allow --priority 100
240+
```
241+
242+
### Associate route tables with subnets
243+
244+
To associate the cluster with the firewall, the dedicated subnet for the cluster's subnet must reference the route table you created. App and service runtime subnets must be associated with corresponding route tables. The following example shows how to associate a route table with a subnet.
245+
246+
```azurecli
247+
# Associate route table with next hop to Firewall to the Azure Spring Apps subnet.
248+
249+
az network vnet subnet update \
250+
--resource-group $RG \
251+
--vnet-name $VNET_NAME \
252+
--name $ASA_APP_SUBNET_NAME \
253+
--route-table $APP_ROUTE_TABLE_NAME
254+
255+
az network vnet subnet update
256+
--resource-group $RG \
257+
--vnet-name $VNET_NAME \
258+
--name $ASA_SERVICE_RUNTIME_SUBNET_NAME \
259+
--route-table $SERVICE_RUNTIME_ROUTE_TABLE_NAME
260+
```
261+
262+
### Add a role for an Azure Spring Apps RP
263+
264+
The following example shows how to add a role for an Azure Spring Apps RP.
265+
266+
```azurecli
267+
VIRTUAL_NETWORK_RESOURCE_ID=$(az network vnet show \
268+
--name $VNET_NAME \
269+
--resource-group $RG \
270+
--query "id" \
271+
--output tsv)
272+
273+
az role assignment create \
274+
--role "Owner" \
275+
--scope ${VIRTUAL_NETWORK_RESOURCE_ID} \
276+
--assignee e8de9221-a19c-4c81-b814-fd37c6caf9d2
277+
```
278+
279+
### Create a UDR Azure Spring Apps instance
280+
281+
The following example shows how to create a UDR Azure Spring Apps instance.
282+
283+
```azurecli
284+
az spring create \
285+
--name $ASA_NAME \
286+
--resource-group $RG \
287+
--vnet $VNET_NAME \
288+
--app-subnet $ASA_APP_SUBNET_NAME \
289+
--service-runtime-subnet $ASA_SERVICE_RUNTIME_SUBNET_NAME \
290+
--outbound-type userDefinedRouting
291+
```
292+
293+
You can now access the public IP of the firewall from the internet. The firewall will route traffic into Azure Spring Apps subnets according to your routing rules.
294+
295+
## Next steps
296+
297+
- [Troubleshooting Azure Spring Apps in virtual networks](troubleshooting-vnet.md)
298+
- [Customer responsibilities for running Azure Spring Apps in VNET](vnet-customer-responsibilities.md)

‎articles/spring-apps/media/how-to-create-user-defined-route-instance/user-defined-route-example-architecture.png

112 KB
Loading

‎articles/spring-apps/toc.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,8 @@ items:
9696
href: concept-metrics.md
9797
- name: Spring Boot Actuator
9898
href: concept-manage-monitor-app-spring-boot-actuator.md
99+
- name: Customize Azure Spring Cloud egress with a user-defined route
100+
href: concept-outbound-type.md
99101
- name: Security
100102
items:
101103
- name: Security controls
@@ -226,6 +228,8 @@ items:
226228
href: how-to-access-app-from-internet-virtual-network.md
227229
- name: Configure Palo Alto
228230
href: how-to-configure-palo-alto.md
231+
- name: Control egress traffic for an Azure Spring Apps instance
232+
href: how-to-create-user-defined-route-instance.md
229233
- name: Customize the ingress configuration in Azure Spring Apps
230234
href: how-to-configure-ingress.md
231235
- name: Customer responsibilities running Azure Spring Apps in VNET

0 commit comments

Comments
 (0)