Skip to content

Commit ca2e43c

Browse files
ttorblettorble
authored
Merge pull request #292005 from sushantjrao/break-glass-setup
Updating ExpressRoute Gateway Authorization Key in Azure Operator Nexus
2 parents 2b2b74b + ba5f72f commit ca2e43c

File tree

2 files changed

+173
-0
lines changed

2 files changed

+173
-0
lines changed

‎articles/operator-nexus/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,8 @@
161161
href: howto-credential-rotation.md
162162
- name: Credential Manager Key Vault
163163
href: how-to-credential-manager-key-vault.md
164+
- name: Updating ExpressRoute Gateway Authorization Key in Azure Operator Nexus
165+
href: howto-update-expressroute-authorization-key.md
164166
- name: Network Fabric
165167
expanded: false
166168
items:

‎articles/operator-nexus/howto-update-expressroute-authorization-key.md

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
---
2+
title: Updating ExpressRoute Gateway Authorization Key in Azure Operator Nexus
3+
description: Learn the process of updating ExpressRoute Gateway Authorization Key in Azure Operator Nexus
4+
author: sushantjrao
5+
ms.author: sushrao
6+
ms.service: azure-operator-nexus
7+
ms.topic: how-to
8+
ms.date: 12/16/2024
9+
ms.custom: template-how-to, devx-track-azurecli
10+
---
11+
12+
# Updating ExpressRoute Gateway Authorization Key in Azure Operator Nexus
13+
14+
This guide provides step-by-step instructions for updating authorization keys for ExpressRoute circuits in Azure Operator Nexus. The process ensures continued secure connectivity between your on-premises network and Azure resources.
15+
16+
## Prerequisites
17+
18+
Before proceeding with the key update, ensure the following prerequisites are met:
19+
20+
- **Identify the Network Fabric Controller (NFC):** Locate the Network Fabric Controller (NFC) for which you want to update the ExpressRoute authorization keys.
21+
22+
- **Verify ExpressRoute Connections:** Ensure there are 4 operational ExpressRoute connections (2 for infrastructure ER GW and 2 for tenant ER GW) to 4 ExpressRoute circuits.
23+
24+
- **Generate New Authorization Keys:** Obtain new authorization keys for all circuits you intend to update.
25+
26+
## Procedure
27+
28+
### Step 1: Log in to Azure
29+
30+
1. Open your terminal or command prompt.
31+
32+
2. Run the following command to log in to your Azure account:
33+
34+
```Azure CLI
35+
az login
36+
```
37+
38+
3. Set the active subscription for your Azure CLI session:
39+
40+
```Azure CLI
41+
az account set -s <Subscription ID>
42+
```
43+
44+
Replace `<Subscription ID>` with your Azure subscription ID.
45+
46+
### Step 2: Retrieve existing authorization keys
47+
48+
- Retrieve the current authorization keys using the following command:
49+
50+
```Azure CLI
51+
az network express-route auth list \
52+
--resource-group <resource-group> \
53+
--circuit-name <circuit-name>
54+
```
55+
56+
Replace `<resource-group>` and `<circuit-name>` with your specific resource group and circuit name.
57+
58+
#### Existing authorization keys
59+
60+
| Type of Connectivity | ExpressRoute Circuit Name | Authorization Key |
61+
|----------------------|---------------------------|-------------------|
62+
| Infrastructure | er-circuit-A | er-authz-key-a1 |
63+
| Infrastructure | er-circuit-B | er-authz-key-b1 |
64+
| Workload | er-circuit-C | er-authz-key-c1 |
65+
| Workload | er-circuit-D | er-authz-key-d1 |
66+
67+
> [!NOTE]
68+
> There are 4 ExpressRoute circuits, each with an existing connection.<br>
69+
> This step must be repeated for each circuit to generate a new authorization key for each circuit.<br>
70+
> The authorization keys provided here are sample values and should not be used as real keys.
71+
72+
### Step 3: Generate new authorization keys
73+
74+
- Use the command below to generate new authorization keys for the ExpressRoute circuits:
75+
76+
```Azure CLI
77+
az network express-route auth create \
78+
--resource-group <resource-group> \
79+
--circuit-name <circuit-name> \
80+
--name <authorization-name>
81+
```
82+
83+
Replace `<resource-group>` and `<circuit-name>` with your specific resource group and circuit name.
84+
85+
#### New Authorization Keys
86+
87+
| Type of Connectivity | ExpressRoute Circuit Name | Authorization Key |
88+
|----------------------|---------------------------|-------------------|
89+
| Infrastructure | er-circuit-A | er-authz-key-a20 |
90+
| Infrastructure | er-circuit-B | er-authz-key-b20 |
91+
| Workload | er-circuit-C | er-authz-key-c20 |
92+
| Workload | er-circuit-D | er-authz-key-d20 |
93+
94+
> [!NOTE]
95+
> There are 4 ExpressRoute circuits, each with an existing connection.<br>
96+
> This step must be repeated for each circuit to generate a new authorization key for each circuit.<br>
97+
> The authorization keys provided here are sample values and should not be used as real keys.
98+
99+
### Step 4: Update Authorization Keys
100+
101+
There are 4 ExpressRoute circuits, each with an existing connection. Follow these steps to update the keys one at a time for infrastructure and workload connections.
102+
103+
> [!NOTE]
104+
> Authorization key rotation will cause temporary network connectivity loss. Plan the updates carefully to minimize disruptions.
105+
106+
### Step 4.1: Update the First Infrastructure Authorization Key
107+
108+
- Run the following command to update the first infrastructure authorization key:
109+
110+
```Azure CLI
111+
az networkfabric controller update \
112+
--resource-group 'nfc resource group' \
113+
--resource-name 'nfc_name' \
114+
--infra-er-connections '[{expressRouteCircuitId:"er-circuit-A",expressRouteAuthorizationKey:"er-authz-key-a20"},{expressRouteCircuitId:"er-circuit-B",expressRouteAuthorizationKey:"er-authz-key-b1"}]' \
115+
--debug
116+
```
117+
118+
Post-check: Verify that the new connection for **er-circuit-A** is operational.
119+
120+
### Step 4.2: Update the Second Infrastructure Authorization Key
121+
122+
- Run the following command to update the second infrastructure authorization key:
123+
124+
```Azure CLI
125+
az networkfabric controller update \
126+
--resource-group 'nfc resource group' \
127+
--resource-name 'nfc_name' \
128+
--infra-er-connections '[{expressRouteCircuitId:"er-circuit-A,expressRouteAuthorizationKey:"er-authz-key-a20"},{expressRouteCircuitId:"er-circuit-B",expressRouteAuthorizationKey:"er-authz-key-b20"}]' \
129+
--debug
130+
```
131+
132+
Post-check: Verify that the new connection for **er-circuit-B** is operational.
133+
134+
### Step 4.3: Update the First Workload Authorization Key
135+
136+
- Run the following command to update the first workload authorization key:
137+
138+
```Azure CLI
139+
az networkfabric controller update \
140+
--resource-group 'nfc resource group' \
141+
--resource-name 'nfc_name' \
142+
--workload-er-connections '[{expressRouteCircuitId:"er-circuit-C",expressRouteAuthorizationKey:"er-authz-key-c20"},{expressRouteCircuitId:"er-circuit-D",expressRouteAuthorizationKey:"er-authz-key-d1"}]' \
143+
--debug
144+
```
145+
Post-check: Verify that the new connection for **er-circuit-C** is operational.
146+
147+
### Step 4.4: Update the Second Workload Authorization Key
148+
149+
- Run the following command to update the second workload authorization key:
150+
151+
```Azure CLI
152+
az networkfabric controller update \
153+
--resource-group 'nfc resource group' \
154+
--resource-name 'nfc_name' \
155+
--workload-er-connections '[{expressRouteCircuitId:"er-circuit-C",expressRouteAuthorizationKey:"er-authz-key-c20"},{expressRouteCircuitId:"er-circuit-D",expressRouteAuthorizationKey:"er-authz-key-d20"}]' \
156+
--debug
157+
```
158+
159+
Post-check: Verify that the new connection for er-circuit-D is operational.
160+
161+
## Monitoring ExpressRoute Gateway Metrics
162+
163+
Use metrics from the ExpressRoute gateway to monitor the health of connections during the update process.
164+
165+
### Key Metric: Count of Routes Learned from Peer
166+
167+
During the update, you may observe a temporary dip in the count of routes learned. The count of routes learned should recover once the update is complete.
168+
169+
Each connection has 2 peers. By filtering metrics for BGP (Border Gateway Protocol) peers, you can confirm the specific connections impacted during the update
170+
171+
For more details on monitoring, refer to the [Monitoring data reference for Azure ExpressRoute](../expressroute/monitor-expressroute.md).

0 commit comments

Comments
 (0)