Skip to content

Commit c5040c7

Browse files
PMEds28PMEds28
authored
Merge pull request #208970 from guywi-ms/ama-networking-article
Consolidate AMA network configuration settings in one article
2 parents 6a9e31a + 8fc6e13 commit c5040c7

File tree

3 files changed

+93
-97
lines changed

3 files changed

+93
-97
lines changed

‎articles/azure-monitor/agents/agents-overview.md

Lines changed: 0 additions & 87 deletions
Original file line numberDiff line numberDiff line change
@@ -85,93 +85,6 @@ Azure Monitor Agent is available in all public regions and Azure Government clou
8585

8686
There's no cost for the Azure Monitor Agent, but you might incur charges for the data ingested. For information on Log Analytics data collection and retention and for customer metrics, see [Azure Monitor pricing](https://azure.microsoft.com/pricing/details/monitor/).
8787

88-
## Networking
89-
90-
The Azure Monitor Agent supports Azure service tags. Both *AzureMonitor* and *AzureResourceManager* tags are required. It supports connecting via *direct proxies, Log Analytics gateway, and private links* as described in the following sections.
91-
92-
### Firewall requirements
93-
94-
| Cloud |Endpoint |Purpose |Port |Direction |Bypass HTTPS inspection|
95-
|------|------|------|---------|--------|--------|
96-
| Azure Commercial |global.handler.control.monitor.azure.com |Access control service|Port 443 |Outbound|Yes |
97-
| Azure Commercial |`<virtual-machine-region-name>`.handler.control.monitor.azure.com |Fetch data collection rules for specific machine |Port 443 |Outbound|Yes |
98-
| Azure Commercial |`<log-analytics-workspace-id>`.ods.opinsights.azure.com |Ingest logs data |Port 443 |Outbound|Yes |
99-
| Azure Commercial | management.azure.com | Only needed if sending time series data (metrics) to Azure Monitor [Custom metrics](../essentials/metrics-custom-overview.md) database | Port 443 | Outbound | Yes |
100-
| Azure Government | Replace '.com' above with '.us' | Same as above | Same as above | Same as above| Same as above |
101-
| Azure China | Replace '.com' above with '.cn' | Same as above | Same as above | Same as above| Same as above |
102-
103-
If you use private links on the agent, you must also add the [DCE endpoints](../essentials/data-collection-endpoint-overview.md#components-of-a-data-collection-endpoint).
104-
105-
### Proxy configuration
106-
107-
If the machine connects through a proxy server to communicate over the internet, review the following requirements to understand the network configuration required.
108-
109-
The Azure Monitor Agent extensions for Windows and Linux can communicate either through a proxy server or a [Log Analytics gateway](./gateway.md) to Azure Monitor by using the HTTPS protocol. Use it for Azure virtual machines, Azure virtual machine scale sets, and Azure Arc for servers. Use the extensions settings for configuration as described in the following steps. Both anonymous and basic authentication by using a username and password are supported.
110-
111-
> [!IMPORTANT]
112-
> Proxy configuration is not supported for [Azure Monitor Metrics (Public preview)](../essentials/metrics-custom-overview.md) as a destination. If you're sending metrics to this destination, it will use the public internet without any proxy.
113-
114-
1. Use this flowchart to determine the values of the *`Settings` and `ProtectedSettings` parameters first.
115-
116-
![Diagram that shows a flowchart to determine the values of settings and protectedSettings parameters when you enable the extension.](media/azure-monitor-agent-overview/proxy-flowchart.png)
117-
118-
1. After determining the `Settings` and `ProtectedSettings` parameter values, *provide these other parameters* when you deploy Azure Monitor Agent, using PowerShell commands, as shown in the following examples:
119-
120-
# [Windows VM](#tab/PowerShellWindows)
121-
122-
```powershell
123-
$settingsString = @{"proxy" = @{mode = "application"; address = "http://[address]:[port]"; auth = true}}
124-
$protectedSettingsString = @{"proxy" = @{username = "[username]"; password = "[password]"}}
125-
126-
Set-AzVMExtension -ExtensionName AzureMonitorWindowsAgent -ExtensionType AzureMonitorWindowsAgent -Publisher Microsoft.Azure.Monitor -ResourceGroupName <resource-group-name> -VMName <virtual-machine-name> -Location <location> -TypeHandlerVersion 1.0 -SettingString $settingsString -ProtectedSettingString $protectedSettingsString
127-
```
128-
129-
# [Linux VM](#tab/PowerShellLinux)
130-
131-
```powershell
132-
$settingsString = @{"proxy" = @{mode = "application"; address = "http://[address]:[port]"; auth = true}}
133-
$protectedSettingsString = @{"proxy" = @{username = "[username]"; password = "[password]"}}
134-
135-
Set-AzVMExtension -ExtensionName AzureMonitorLinuxAgent -ExtensionType AzureMonitorLinuxAgent -Publisher Microsoft.Azure.Monitor -ResourceGroupName <resource-group-name> -VMName <virtual-machine-name> -Location <location> -TypeHandlerVersion 1.5 -SettingString $settingsString -ProtectedSettingString $protectedSettingsString
136-
```
137-
138-
# [Windows Arc-enabled server](#tab/PowerShellWindowsArc)
139-
140-
```powershell
141-
$settingsString = @{"proxy" = @{mode = "application"; address = "http://[address]:[port]"; auth = true}}
142-
$protectedSettingsString = @{"proxy" = @{username = "[username]"; password = "[password]"}}
143-
144-
New-AzConnectedMachineExtension -Name AzureMonitorWindowsAgent -ExtensionType AzureMonitorWindowsAgent -Publisher Microsoft.Azure.Monitor -ResourceGroupName <resource-group-name> -MachineName <arc-server-name> -Location <arc-server-location> -Setting $settingsString -ProtectedSetting $protectedSettingsString
145-
```
146-
147-
# [Linux Arc-enabled server](#tab/PowerShellLinuxArc)
148-
149-
```powershell
150-
$settingsString = @{"proxy" = @{mode = "application"; address = "http://[address]:[port]"; auth = true}}
151-
$protectedSettingsString = @{"proxy" = @{username = "[username]"; password = "[password]"}}
152-
153-
New-AzConnectedMachineExtension -Name AzureMonitorLinuxAgent -ExtensionType AzureMonitorLinuxAgent -Publisher Microsoft.Azure.Monitor -ResourceGroupName <resource-group-name> -MachineName <arc-server-name> -Location <arc-server-location> -Setting $settingsString -ProtectedSetting $protectedSettingsString
154-
```
155-
156-
---
157-
158-
### Log Analytics gateway configuration
159-
160-
1. Follow the preceding instructions to configure proxy settings on the agent and provide the IP address and port number that corresponds to the gateway server. If you've deployed multiple gateway servers behind a load balancer, the agent proxy configuration is the virtual IP address of the load balancer instead.
161-
1. Add the **configuration endpoint URL** to fetch data collection rules to the allowlist for the gateway
162-
`Add-OMSGatewayAllowedHost -Host global.handler.control.monitor.azure.com`
163-
`Add-OMSGatewayAllowedHost -Host <gateway-server-region-name>.handler.control.monitor.azure.com`.
164-
(If you're using private links on the agent, you must also add the [data collection endpoints](../essentials/data-collection-endpoint-overview.md#components-of-a-data-collection-endpoint).)
165-
1. Add the **data ingestion endpoint URL** to the allowlist for the gateway
166-
`Add-OMSGatewayAllowedHost -Host <log-analytics-workspace-id>.ods.opinsights.azure.com`.
167-
1. Restart the **OMS Gateway** service to apply the changes
168-
`Stop-Service -Name <gateway-name>`
169-
`Start-Service -Name <gateway-name>`.
170-
171-
### Private link configuration
172-
173-
To configure the agent to use private links for network communications with Azure Monitor, follow instructions to [enable network isolation](./azure-monitor-agent-data-collection-endpoint.md#enable-network-isolation-for-the-azure-monitor-agent) by using [data collection endpoints](azure-monitor-agent-data-collection-endpoint.md).
174-
17588
## Compare to legacy agents
17689

17790
The tables below provide a comparison of Azure Monitor Agent with the legacy the Azure Monitor telemetry agents for Windows and Linux.

‎articles/azure-monitor/agents/azure-monitor-agent-data-collection-endpoint.md

Lines changed: 92 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
2-
title: Enable network isolation for the Azure Monitor agent
3-
description: Use data collection endpoints to uniquely configure ingestion settings for your machines.
2+
title: Define Azure Monitor Agent network settings
3+
description: Define network settings and enable network isolation for Azure Monitor Agent.
44
ms.topic: conceptual
55
author: shseth
66
ms.author: shseth
@@ -9,19 +9,105 @@ ms.custom: references_region
99
ms.reviewer: shseth
1010

1111
---
12+
# Define Azure Monitor Agent network settings
1213

13-
# Enable network isolation for the Azure Monitor agent
14+
Azure Monitor Agent supports connecting using direct proxies, Log Analytics gateway, and private links. This article explains how to define network settings and enable network isolation for Azure Monitor Agent.
15+
16+
## Virtual network service tags
17+
18+
The Azure Monitor Agent supports [Azure virtual network service tags](../../virtual-network/service-tags-overview.md). Both *AzureMonitor* and *AzureResourceManager* tags are required.
19+
20+
## Firewall requirements
21+
22+
| Cloud |Endpoint |Purpose |Port |Direction |Bypass HTTPS inspection|
23+
|------|------|------|---------|--------|--------|
24+
| Azure Commercial |global.handler.control.monitor.azure.com |Access control service|Port 443 |Outbound|Yes |
25+
| Azure Commercial |`<virtual-machine-region-name>`.handler.control.monitor.azure.com |Fetch data collection rules for specific machine |Port 443 |Outbound|Yes |
26+
| Azure Commercial |`<log-analytics-workspace-id>`.ods.opinsights.azure.com |Ingest logs data |Port 443 |Outbound|Yes |
27+
| Azure Commercial | management.azure.com | Only needed if sending time series data (metrics) to Azure Monitor [Custom metrics](../essentials/metrics-custom-overview.md) database | Port 443 | Outbound | Yes |
28+
| Azure Government | Replace '.com' above with '.us' | Same as above | Same as above | Same as above| Same as above |
29+
| Azure China | Replace '.com' above with '.cn' | Same as above | Same as above | Same as above| Same as above |
30+
31+
If you use private links on the agent, you must also add the [DCE endpoints](../essentials/data-collection-endpoint-overview.md#components-of-a-data-collection-endpoint).
32+
33+
## Proxy configuration
34+
35+
If the machine connects through a proxy server to communicate over the internet, review the following requirements to understand the network configuration required.
36+
37+
The Azure Monitor Agent extensions for Windows and Linux can communicate either through a proxy server or a [Log Analytics gateway](./gateway.md) to Azure Monitor by using the HTTPS protocol. Use it for Azure virtual machines, Azure virtual machine scale sets, and Azure Arc for servers. Use the extensions settings for configuration as described in the following steps. Both anonymous and basic authentication by using a username and password are supported.
38+
39+
> [!IMPORTANT]
40+
> Proxy configuration is not supported for [Azure Monitor Metrics (Public preview)](../essentials/metrics-custom-overview.md) as a destination. If you're sending metrics to this destination, it will use the public internet without any proxy.
41+
42+
1. Use this flowchart to determine the values of the *`Settings` and `ProtectedSettings` parameters first.
43+
44+
![Diagram that shows a flowchart to determine the values of settings and protectedSettings parameters when you enable the extension.](media/azure-monitor-agent-overview/proxy-flowchart.png)
45+
46+
1. After determining the `Settings` and `ProtectedSettings` parameter values, *provide these other parameters* when you deploy Azure Monitor Agent, using PowerShell commands, as shown in the following examples:
47+
48+
# [Windows VM](#tab/PowerShellWindows)
49+
50+
```powershell
51+
$settingsString = @{"proxy" = @{mode = "application"; address = "http://[address]:[port]"; auth = true}}
52+
$protectedSettingsString = @{"proxy" = @{username = "[username]"; password = "[password]"}}
53+
54+
Set-AzVMExtension -ExtensionName AzureMonitorWindowsAgent -ExtensionType AzureMonitorWindowsAgent -Publisher Microsoft.Azure.Monitor -ResourceGroupName <resource-group-name> -VMName <virtual-machine-name> -Location <location> -TypeHandlerVersion 1.0 -SettingString $settingsString -ProtectedSettingString $protectedSettingsString
55+
```
56+
57+
# [Linux VM](#tab/PowerShellLinux)
58+
59+
```powershell
60+
$settingsString = @{"proxy" = @{mode = "application"; address = "http://[address]:[port]"; auth = true}}
61+
$protectedSettingsString = @{"proxy" = @{username = "[username]"; password = "[password]"}}
62+
63+
Set-AzVMExtension -ExtensionName AzureMonitorLinuxAgent -ExtensionType AzureMonitorLinuxAgent -Publisher Microsoft.Azure.Monitor -ResourceGroupName <resource-group-name> -VMName <virtual-machine-name> -Location <location> -TypeHandlerVersion 1.5 -SettingString $settingsString -ProtectedSettingString $protectedSettingsString
64+
```
65+
66+
# [Windows Arc-enabled server](#tab/PowerShellWindowsArc)
67+
68+
```powershell
69+
$settingsString = @{"proxy" = @{mode = "application"; address = "http://[address]:[port]"; auth = true}}
70+
$protectedSettingsString = @{"proxy" = @{username = "[username]"; password = "[password]"}}
71+
72+
New-AzConnectedMachineExtension -Name AzureMonitorWindowsAgent -ExtensionType AzureMonitorWindowsAgent -Publisher Microsoft.Azure.Monitor -ResourceGroupName <resource-group-name> -MachineName <arc-server-name> -Location <arc-server-location> -Setting $settingsString -ProtectedSetting $protectedSettingsString
73+
```
74+
75+
# [Linux Arc-enabled server](#tab/PowerShellLinuxArc)
76+
77+
```powershell
78+
$settingsString = @{"proxy" = @{mode = "application"; address = "http://[address]:[port]"; auth = true}}
79+
$protectedSettingsString = @{"proxy" = @{username = "[username]"; password = "[password]"}}
80+
81+
New-AzConnectedMachineExtension -Name AzureMonitorLinuxAgent -ExtensionType AzureMonitorLinuxAgent -Publisher Microsoft.Azure.Monitor -ResourceGroupName <resource-group-name> -MachineName <arc-server-name> -Location <arc-server-location> -Setting $settingsString -ProtectedSetting $protectedSettingsString
82+
```
83+
84+
---
85+
86+
## Log Analytics gateway configuration
87+
88+
1. Follow the preceding instructions to configure proxy settings on the agent and provide the IP address and port number that corresponds to the gateway server. If you've deployed multiple gateway servers behind a load balancer, the agent proxy configuration is the virtual IP address of the load balancer instead.
89+
1. Add the **configuration endpoint URL** to fetch data collection rules to the allowlist for the gateway
90+
`Add-OMSGatewayAllowedHost -Host global.handler.control.monitor.azure.com`
91+
`Add-OMSGatewayAllowedHost -Host <gateway-server-region-name>.handler.control.monitor.azure.com`.
92+
(If you're using private links on the agent, you must also add the [data collection endpoints](../essentials/data-collection-endpoint-overview.md#components-of-a-data-collection-endpoint).)
93+
1. Add the **data ingestion endpoint URL** to the allowlist for the gateway
94+
`Add-OMSGatewayAllowedHost -Host <log-analytics-workspace-id>.ods.opinsights.azure.com`.
95+
1. Restart the **OMS Gateway** service to apply the changes
96+
`Stop-Service -Name <gateway-name>`
97+
`Start-Service -Name <gateway-name>`.
98+
99+
## Enable network isolation for the Azure Monitor agent
14100
By default, Azure Monitor agent will connect to a public endpoint to connect to your Azure Monitor environment. You can enable network isolation for your agents by creating [data collection endpoints](../essentials/data-collection-endpoint-overview.md) and adding them to your [Azure Monitor Private Link Scopes (AMPLS)](../logs/private-link-configure.md#connect-azure-monitor-resources).
15101

16102

17-
## Create data collection endpoint
103+
### Create data collection endpoint
18104
To use network isolation, you must create a data collection endpoint for each of your regions for agents to connect instead of the public endpoint. See [Create a data collection endpoint](../essentials/data-collection-endpoint-overview.md#create-data-collection-endpoint) for details on create a DCE. An agent can only connect to a DCE in the same region. If you have agents in multiple regions, then you must create a DCE in each one.
19105

20106

21-
## Create private link
107+
### Create private link
22108
With [Azure Private Link](../../private-link/private-link-overview.md), you can securely link Azure platform as a service (PaaS) resources to your virtual network by using private endpoints. An Azure Monitor Private Link connects a private endpoint to a set of Azure Monitor resources, defining the boundaries of your monitoring network. That set is called an Azure Monitor Private Link Scope (AMPLS). See [Configure your Private Link](../logs/private-link-configure.md) for details on creating and configuring your AMPLS.
23109

24-
## Add DCE to AMPLS
110+
### Add DCE to AMPLS
25111
Add the data collection endpoints to a new or existing [Azure Monitor Private Link Scopes (AMPLS)](../logs/private-link-configure.md#connect-azure-monitor-resources) resource. This adds the DCE endpoints to your private DNS zone (see [how to validate](../logs/private-link-configure.md#review-and-validate-your-private-link-setup)) and allows communication via private links. You can do this from either the AMPLS resource or from within an existing DCE resource's 'Network Isolation' tab.
26112

27113
> [!NOTE]
@@ -33,15 +119,12 @@ For your data collection endpoint(s), ensure **Accept access from public network
33119
:::image type="content" source="media/azure-monitor-agent-dce/data-collection-endpoint-network-isolation.png" lightbox="media/azure-monitor-agent-dce/data-collection-endpoint-network-isolation.png" alt-text="Screenshot for configuring data collection endpoint network isolation.":::
34120

35121

36-
37122
Associate the data collection endpoints to the target resources by editing the data collection rule in Azure portal. From the **Resources** tab, select **Enable Data Collection Endpoints** and select a DCE for each virtual machine. See [Configure data collection for the Azure Monitor agent](../agents/data-collection-rule-azure-monitor-agent.md).
38123

39124

40125
:::image type="content" source="media/azure-monitor-agent-dce/data-collection-rule-virtual-machines-with-endpoint.png" lightbox="media/azure-monitor-agent-dce/data-collection-rule-virtual-machines-with-endpoint.png" alt-text="Screenshot for configuring data collection endpoint for an agent.":::
41126

42127

43-
44-
45128
## Next steps
46129
- [Associate endpoint to machines](../agents/data-collection-rule-azure-monitor-agent.md#create-data-collection-rule-and-association)
47130
- [Add endpoint to AMPLS resource](../logs/private-link-configure.md#connect-azure-monitor-resources)

‎articles/azure-monitor/toc.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -482,7 +482,7 @@ items:
482482
- name: Collect text and IIS Logs
483483
displayName: data collection rule,Azure Monitor agent
484484
href: agents/data-collection-text-log.md
485-
- name: Enable network isolation
485+
- name: Define network settings
486486
href: agents/azure-monitor-agent-data-collection-endpoint.md
487487
- name: Migrate from Log Analytics Agent
488488
items:

0 commit comments

Comments
 (0)