Skip to content

Commit d13acaa

Browse files
sushantjraosushantjrao
committed
Updating ExpressRoute Gateway Authorization Key in Azure Operator Nexus
1 parent ed92057 commit d13acaa

File tree

2 files changed

+166
-0
lines changed

2 files changed

+166
-0
lines changed

‎articles/operator-nexus/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,8 @@
161161
href: howto-credential-rotation.md
162162
- name: Credential Manager Key Vault
163163
href: how-to-credential-manager-key-vault.md
164+
- name: Updating ExpressRoute Gateway Authorization Key in Azure Operator Nexus
165+
href: howto-update-expressroute-authorization-key.md
164166
- name: Network Fabric
165167
expanded: false
166168
items:

‎articles/operator-nexus/howto-update-expressroute-authorization-key.md

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
---
2+
title: Updating ExpressRoute Gateway Authorization Key in Azure Operator Nexus
3+
description: Learn the process of updating ExpressRoute Gateway Authorization Key in Azure Operator Nexus
4+
author: sushantjrao
5+
ms.author: sushrao
6+
ms.service: azure-operator-nexus
7+
ms.topic: how-to
8+
ms.date: 12/16/2024
9+
ms.custom: template-how-to, devx-track-azurecli
10+
---
11+
12+
# Updating ExpressRoute Gateway Authorization Key in Azure Operator Nexus
13+
14+
This guide provides step-by-step instructions for updating authorization keys for ExpressRoute circuits in Azure Operator Nexus. The process ensures continued secure connectivity between your on-premises network and Azure resources.
15+
16+
## Prerequisites
17+
18+
Before proceeding with the key update, ensure the following prerequisites are met:
19+
20+
- **Identify the Network Fabric Controller (NFC):** Locate the NFC for which you want to update the ExpressRoute authorization keys.
21+
22+
- **Verify ExpressRoute Connections:** Ensure there are 4 operational ExpressRoute connections (2 for infrastructure ER GW and 2 for tenant ER GW) to 4 ExpressRoute circuits.
23+
24+
- **Generate New Authorization Keys:** Obtain new authorization keys for all circuits you intend to update.
25+
26+
## Procedure
27+
28+
### Step 1: Log in to Azure
29+
30+
1. Open your terminal or command prompt.
31+
32+
2. Run the following command to log in to your Azure account:
33+
34+
```Azure CLI
35+
az login
36+
```
37+
38+
3. Set the active subscription for your Azure CLI session:
39+
40+
```Azure CLI
41+
az account set -s '<Subscription ID>'
42+
```
43+
44+
Replace <Subscription ID> with your Azure subscription ID.
45+
46+
### Step 2: Retrieve existing authorization keys
47+
48+
Retrieve the current authorization keys using the following command:
49+
50+
```Azure CLI
51+
az network express-route auth list \
52+
--resource-group <resource-group> \
53+
--circuit-name <circuit-name>
54+
```
55+
56+
Replace <resource-group> and <circuit-name> with your specific resource group and circuit name.
57+
58+
#### Existing authorization keys
59+
60+
| Type of Connectivity | ExpressRoute Circuit Name | Authorization Key |
61+
|----------------------|---------------------------|-------------------|
62+
| Infrastructure | er-circuit-A | er-authz-key-a1 |
63+
| Infrastructure | er-circuit-B | er-authz-key-b1 |
64+
| Workload | er-circuit-C | er-authz-key-c1 |
65+
| Workload | er-circuit-D | er-authz-key-d1 |
66+
67+
> [!NOTE]
68+
> There are 4 ExpressRoute circuits, each with an existing connection.<br>
69+
> Repeat the above step for each circuit that requires a new authorization key.<br>
70+
> The authorization keys provided here are sample values and should not be used as real keys.
71+
72+
## Step 3: Generate new authorization keys
73+
74+
Generate new authorization keys for the ExpressRoute circuits using the command below:
75+
76+
```Azure CLI
77+
az network express-route auth create \
78+
--resource-group <resource-group> \
79+
--circuit-name <circuit-name> \
80+
--name <authorization-name>
81+
```
82+
83+
#### New Authorization Keys
84+
85+
| Type of Connectivity | ExpressRoute Circuit Name | Authorization Key |
86+
|----------------------|---------------------------|-------------------|
87+
| Infrastructure | er-circuit-A | er-authz-key-a20 |
88+
| Infrastructure | er-circuit-B | er-authz-key-b20 |
89+
| Workload | er-circuit-C | er-authz-key-c20 |
90+
| Workload | er-circuit-D | er-authz-key-d20 |
91+
92+
> [!NOTE]
93+
> There are 4 ExpressRoute circuits, each with an existing connection. Repeat the above step for each circuit that requires a new authorization key. The authorization keys provided here are sample values and should not be used as real keys.
94+
95+
### Step 4: Update Authorization Keys
96+
97+
There are 4 ExpressRoute circuits, each with an existing connection. Follow these steps to update the keys one at a time for infrastructure and workload connections.
98+
99+
### Step 4.1: Update the First Infrastructure Authorization Key
100+
101+
Run the following command to update the first infrastructure authorization key:
102+
103+
```Azure CLI
104+
az networkfabric controller update \
105+
--resource-group 'nfc resource group' \
106+
--resource-name 'nfc_name' \
107+
--infra-er-connections '[{expressRouteCircuitId:"er-circuit-A",expressRouteAuthorizationKey:"er-authz-key-a20"}, {expressRouteCircuitId:"er-circuit-B",expressRouteAuthorizationKey:"er-authz-key-b1"}]' \
108+
--debug
109+
```
110+
Post-check: Verify that the new connection for **er-circuit-A** is operational.
111+
112+
### Step 4.2: Update the Second Infrastructure Authorization Key
113+
114+
Run the following command to update the second infrastructure authorization key:
115+
116+
```
117+
az networkfabric controller update \
118+
--resource-group 'nfc resource group' \
119+
--resource-name 'nfc_name' \
120+
--infra-er-connections '[{expressRouteCircuitId:"er-circuit-A,expressRouteAuthorizationKey:"er-authz-key-a20"}, {expressRouteCircuitId:"er-circuit-B",expressRouteAuthorizationKey:"er-authz-key-b20"}]' \
121+
--debug
122+
```
123+
124+
Post-check: Verify that the new connection for **er-circuit-B** is operational.
125+
126+
### Step 4.3: Update the First Workload Authorization Key
127+
128+
Run the following command to update the first workload authorization key:
129+
130+
```Azure CLI
131+
az networkfabric controller update \
132+
--resource-group 'nfc resource group' \
133+
--resource-name 'nfc_name' \
134+
--workload-er-connections '[{expressRouteCircuitId:"er-circuit-C",expressRouteAuthorizationKey:"er-authz-key-c20"}, {expressRouteCircuitId:"er-circuit-D",expressRouteAuthorizationKey:"er-authz-key-d1"}]' \
135+
--debug
136+
```
137+
Post-check: Verify that the new connection for **er-circuit-C** is operational.
138+
139+
### Step 4.4: Update the Second Workload Authorization Key
140+
141+
Run the following command to update the second workload authorization key:
142+
143+
```
144+
az networkfabric controller update \
145+
--resource-group 'nfc resource group' \
146+
--resource-name 'nfc_name' \
147+
--workload-er-connections '[{expressRouteCircuitId:"er-circuit-C",expressRouteAuthorizationKey:"er-authz-key-c20"},
148+
{expressRouteCircuitId:"er-circuit-D",expressRouteAuthorizationKey:"er-authz-key-d20"}]' \
149+
--debug
150+
```
151+
152+
Post-check: Verify that the new connection for er-circuit-D is operational.
153+
154+
## Monitoring ExpressRoute Gateway Metrics
155+
156+
Use metrics from the ExpressRoute gateway to monitor the health of connections during the update process.
157+
158+
### Key Metric: Count of Routes Learned from Peer
159+
160+
During the update, you may observe a temporary dip in the count of routes learned. This should recover once the update is complete.
161+
162+
Each connection has 2 peers. By filtering metrics for BGP peers, you can confirm the specific connections impacted during the update.
163+
164+
For additional details on monitoring, refer to the [Monitoring data reference for Azure ExpressRoute](/azure/expressroute/monitor-expressroute.md).

0 commit comments

Comments
 (0)