Skip to content

Commit c3c42bc

Browse files
ttorblettorble
authored
Merge pull request #272504 from sushantjrao/patch-15
Create howto-create-access-control-list-for-nni.md
2 parents 505d618 + 760512a commit c3c42bc

File tree

1 file changed

+154
-0
lines changed

1 file changed

+154
-0
lines changed

‎articles/operator-nexus/howto-create-access-control-list-for-network-to-network-interconnects.md

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
---
2+
title: "Azure Operator Nexus: Create Access Control Lists (ACLs) for network-to-network interconnects and layer 3 isolation domain external networks "
3+
description: Create ACLs for network-to-network interconnects and layer 3 isolation domain external networks.
4+
author: sushantjrao
5+
ms.author: sushrao
6+
ms.service: azure-operator-nexus
7+
ms.topic: how-to
8+
ms.date: 04/18/2024
9+
ms.custom: template-how-to
10+
---
11+
12+
# Creating Access Control List (ACL) management for NNI and layer 3 isolation domain external networks
13+
14+
Access Control Lists (ACLs) are a set of rules that regulate inbound and outbound packet flow within a network. Azure's Nexus Network Fabric service offers an API-based mechanism to configure ACLs for network-to-network interconnects and layer 3 isolation domain external networks. This guide outlines the steps to create ACLs.
15+
16+
## Creating Access Control Lists (ACLs)
17+
18+
To create an ACL and define its properties, you can utilize the `az networkfabric acl create` command. Below are the steps involved:
19+
20+
[!INCLUDE [azure-cli-prepare-your-environment.md](~/reusable-content/azure-cli/azure-cli-prepare-your-environment.md)]
21+
22+
1. **Set subscription (if necessary):**
23+
24+
If you have multiple subscriptions and need to set one as the default, you can do so with:
25+
26+
```bash
27+
az account set --subscription <subscription-id>
28+
```
29+
30+
2. **Create ACL:**
31+
32+
```bash
33+
az networkfabric acl create --resource-group "<resource-group>" --location "<location>" --resource-name "<acl-name>" --annotation "<annotation>" --configuration-type "<configuration-type>" --default-action "<default-action>" --match-configurations "[{matchConfigurationName:<match-config-name>,sequenceNumber:<sequence-number>,ipAddressType:<IPv4/IPv6>,matchConditions:[{ipCondition:{type:<SourceIP/DestinationIP>,prefixType:<Prefix/Exact>,ipPrefixValues:['<ip-prefix1>', '<ip-prefix2>', ...]}}],actions:[{type:<Action>}]}]"
34+
```
35+
36+
| Parameter | Description |
37+
|----------------------|----------------------------------------------------------------------|
38+
| Resource Group | Specify the resource group of your network fabric. |
39+
| Location | Define the location where the ACL will be created. |
40+
| Resource Name | Provide a name for the ACL. |
41+
| Annotation | Optionally, add a description or annotation for the ACL. |
42+
| Configuration Type | Specify whether the configuration is inline or by using a file. |
43+
| Default Action | Define the default action to be taken if no match is found. |
44+
| Match Configurations| Define the conditions and actions for traffic matching. |
45+
| Actions | Specify the action to be taken based on match conditions. |
46+
47+
48+
## Parameters usage guidance
49+
50+
The table below provides guidance on the usage of parameters when creating ACLs:
51+
52+
| Parameter | Description | Example or Range |
53+
|------------------------|------------------------------------------------------------|---------------------------------|
54+
| defaultAction | Defines default action to be taken | "defaultAction": "Permit" |
55+
| resource-group | Resource group of network fabric | nfresourcegroup |
56+
| resource-name | Name of ACL | example-ingressACL |
57+
| vlanGroups | List of VLAN groups | |
58+
| vlans | List of VLANs that need to be matched | |
59+
| match-configurations | Name of match configuration | example_acl |
60+
| matchConditions | Conditions required to be matched | |
61+
| ttlValues | TTL [Time To Live] | 0-255 |
62+
| dscpMarking | DSCP Markings that need to be matched | 0-63 |
63+
| portCondition | Port condition that needs to be matched | |
64+
| portType | Port type that needs to be matched | Example: SourcePort |
65+
| protocolTypes | Protocols that need to be matched | [tcp, udp, range[1-2, 1, 2]] |
66+
| vlanMatchCondition | VLAN match condition that needs to be matched | |
67+
| layer4Protocol | Layer 4 Protocol | should be either TCP or UDP |
68+
| ipCondition | IP condition that needs to be matched | |
69+
| actions | Action to be taken based on match condition | Example: permit |
70+
| configuration-type | Configuration type (inline or file) | Example: inline |
71+
72+
> [!NOTE]
73+
> - Inline ports and inline VLANs are statically defined using azcli.<br>
74+
> - PortGroupNames and VlanGroupNames are dynamically defined.<br>
75+
> - Combining inline ports with portGroupNames is not allowed, similarly for inline VLANs and VLANGroupNames.<br>
76+
> - IPGroupNames and IpPrefixValues cannot be combined.<br>
77+
> - Egress ACLs do not support certain options like IP options, IP length, fragment, ether-type, DSCP marking, and TTL values.<br>
78+
> - Ingress ACLs do not support the following options: etherType.<br>
79+
80+
### Example payload for ACL creation
81+
82+
```Azure CLI
83+
az networkfabric acl create --resource-group "example-rg" --location "eastus2euap" --resource-name "example-Ipv4ingressACL" --annotation "annotation" --configuration-type "Inline" --default-action "Deny" --match-configurations "[{matchConfigurationName:example-match,sequenceNumber:1110,ipAddressType:IPv4,matchConditions:[{ipCondition:{type:SourceIP,prefixType:Prefix,ipPrefixValues:['10.18.0.124/30','10.18.0.128/30','10.18.30.16/30','10.18.30.20/30']}},{ipCondition:{type:DestinationIP,prefixType:Prefix,ipPrefixValues:['10.18.0.124/30','10.18.0.128/30','10.18.30.16/30','10.18.30.20/30']}}],actions:[{type:Count}]}]"
84+
```
85+
86+
### Example output
87+
88+
```json
89+
{
90+
"administrativeState": "Disabled",
91+
"annotation": "annotation",
92+
"configurationState": "Succeeded",
93+
"configurationType": "Inline",
94+
"defaultAction": "Deny",
95+
"id": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/Fab3LabNF-4-0/providers/Microsoft.ManagedNetworkFabric/accessControlLists/L3domain091123-Ipv4egressACL",
96+
"location": "eastus2euap",
97+
"matchConfigurations": [
98+
{
99+
"actions": [
100+
{
101+
"type": "Count"
102+
}
103+
],
104+
"ipAddressType": "IPv4",
105+
"matchConditions": [
106+
{
107+
"ipCondition": {
108+
"ipPrefixValues": [
109+
"10.18.0.124/30",
110+
"10.18.0.128/30",
111+
"10.18.30.16/30",
112+
"10.18.30.20/30"
113+
],
114+
"prefixType": "Prefix",
115+
"type": "SourceIP"
116+
}
117+
},
118+
{
119+
"ipCondition": {
120+
"ipPrefixValues": [
121+
"10.18.0.124/30",
122+
"10.18.0.128/30",
123+
"10.18.30.16/30",
124+
"10.18.30.20/30"
125+
],
126+
"prefixType": "Prefix",
127+
"type": "DestinationIP"
128+
}
129+
}
130+
],
131+
"matchConfigurationName": "example-Ipv4ingressACL ",
132+
"sequenceNumber": 1110
133+
}
134+
],
135+
"name": "example-Ipv4ingressACL",
136+
"provisioningState": "Succeeded",
137+
"resourceGroup": "Fab3LabNF-4-0",
138+
"systemData": {
139+
"createdAt": "2023-09-11T10:20:20.2617941Z",
140+
"createdBy": "[email protected]",
141+
"createdByType": "User",
142+
"lastModifiedAt": "2023-09-11T10:20:20.2617941Z",
143+
"lastModifiedBy": "[email protected]",
144+
"lastModifiedByType": "User"
145+
},
146+
"type": "microsoft.managednetworkfabric/accesscontrollists"
147+
}
148+
```
149+
150+
> [!NOTE]
151+
> After creating the ACL, make sure to note down the ACL reference ID for further reference.
152+
153+
## Next steps
154+
[Applying Access Control Lists (ACLs) to NNI in Azure Fabric](how-to-apply-access-control-list-to-network-to-network-interconnects.md)

0 commit comments

Comments
 (0)