Skip to content

Commit d2b7394

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #228673 from Blackmist/outbound-internet
updates per feedback from support & PM team
2 parents dac4b94 + 2ce09bf commit d2b7394

File tree

3 files changed

+31
-29
lines changed

3 files changed

+31
-29
lines changed

‎articles/machine-learning/how-to-access-azureml-behind-firewall.md

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -82,10 +82,12 @@ __Outbound traffic__
8282
| `AzureMonitor` | 443 | Used to log monitoring and metrics to Azure Monitor. Only needed if you haven't [secured Azure Monitor](how-to-secure-workspace-vnet.md#secure-azure-monitor-and-application-insights) for the workspace. </br>* This outbound is also used to log information for support incidents. |
8383

8484
> [!IMPORTANT]
85-
> If a compute instance or compute cluster is configured for no public IP, they can't access the public internet by default. However, they do need to communicate with the resources listed above. To enable outbound communication, you have two possible options:
86-
>
87-
> * __User-defined route and firewall__: Create a user-defined route in the subnet that contains the compute. The __Next hop__ for the route should reference the private IP address of the firewall, with an address prefix of 0.0.0.0/0.
88-
> * __Azure Virtual Network NAT with a public IP__: For more information on using Virtual Network Nat, see the [Virtual Network NAT](../virtual-network/nat-gateway/nat-overview.md) documentation.
85+
> If a compute instance or compute cluster is configured for no public IP, by default it can't access the internet. If it *can* still send outbound traffic to the internet, it is because of Azure [default outbound access](/azure/virtual-network/ip-services/default-outbound-access#when-is-default-outbound-access-provided) and you have an NSG that allows outbound to the internet. We **don't recocmmend** using the default outbound access. If you need outbound access to the internet, we recommend using one of the following options instead of the default outbound access:
86+
>
87+
> * __Azure Virtual Network NAT with a public IP__: For more information on using Virtual Network Nat, see the [Virtual Network NAT](../virtual-network/nat-gateway/nat-overview.md) documentation.
88+
> * __User-defined route and firewall__: Create a user-defined route in the subnet that contains the compute. The __Next hop__ for the route should reference the private IP address of the firewall, with an address prefix of 0.0.0.0/0.
89+
>
90+
> For more information, see the [Default outbound access in Azure](/azure/virtual-network/ip-services/default-outbound-access) article.
8991
9092
### Recommended configuration for training and deploying models
9193

‎articles/machine-learning/how-to-secure-training-vnet.md

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,8 @@ The following table contains the differences between these configurations:
3131

3232
| Configuration | With public IP | Without public IP |
3333
| ----- | ----- | ----- |
34-
| Inbound traffic | AzureMachineLearning | None |
35-
| Outbound traffic | By default, can access the public internet with no restrictions.<br>You can restrict what it accesses using a Network Security Group or firewall. | By default, it cannot access the public internet since there is no public IP resource.<br>You need a Virtual Network NAT gateway or Firewall to route outbound traffic to required resources on the internet. |
34+
| Inbound traffic | `AzureMachineLearning` service tag. | None |
35+
| Outbound traffic | By default, can access the public internet with no restrictions.<br>You can restrict what it accesses using a Network Security Group or firewall. | By default, can access the public network using the [default outbound access](/azure/virtual-network/ip-services/default-outbound-access) provided by Azure.<br>We recommend using a Virtual Network NAT gateway or Firewall instead if you need to route outbound traffic to required resources on the internet. |
3636
| Azure networking resources | Public IP address, load balancer, network interface | None |
3737

3838
You can also use Azure Databricks or HDInsight to train models in a virtual network.
@@ -113,25 +113,25 @@ The following configurations are in addition to those listed in the [Prerequisit
113113
| Service tag | Protocol | Port | Notes |
114114
| ----- |:-----:|:-----:| ----- |
115115
| `AzureMachineLearning` | TCP<br>UDP | 443/8787/18881<br>5831 | Communication with the Azure Machine Learning service.|
116-
| `BatchNodeManagement.<region>` | ANY | 443| Replace `<region>` with the Azure region that contains your Azure Machine learning workspace. Communication with Azure Batch. Compute instance and compute cluster are implemented using the Azure Batch service.|
117-
| `Storage.<region>` | TCP | 443 | Replace `<region>` with the Azure region that contains your Azure Machine learning workspace. This service tag is used to communicate with the Azure Storage account used by Azure Batch. |
116+
| `BatchNodeManagement.<region>` | ANY | 443| Replace `<region>` with the Azure region that contains your Azure Machine Learning workspace. Communication with Azure Batch. Compute instance and compute cluster are implemented using the Azure Batch service.|
117+
| `Storage.<region>` | TCP | 443 | Replace `<region>` with the Azure region that contains your Azure Machine Learning workspace. This service tag is used to communicate with the Azure Storage account used by Azure Batch. |
118118

119119
> [!IMPORTANT]
120120
> The outbound access to `Storage.<region>` could potentially be used to exfiltrate data from your workspace. By using a Service Endpoint Policy, you can mitigate this vulnerability. For more information, see the [Azure Machine Learning data exfiltration prevention](how-to-prevent-data-loss-exfiltration.md) article.
121121
122122
| FQDN | Protocol | Port | Notes |
123123
| ---- |:----:|:----:| ---- |
124-
| `<region>.tundra.azureml.ms` | UDP | 5831 | Replace `<region>` with the Azure region that contains your Azure Machine learning workspace. |
124+
| `<region>.tundra.azureml.ms` | UDP | 5831 | Replace `<region>` with the Azure region that contains your Azure Machine Learning workspace. |
125125
| `graph.windows.net` | TCP | 443 | Communication with the Microsoft Graph API.|
126126
| `*.instances.azureml.ms` | TCP | 443/8787/18881 | Communication with Azure Machine Learning. |
127-
| `<region>.batch.azure.com` | ANY | 443 | Replace `<region>` with the Azure region that contains your Azure Machine learning workspace. Communication with Azure Batch. |
128-
| `<region>.service.batch.com` | ANY | 443 | Replace `<region>` with the Azure region that contains your Azure Machine learning workspace. Communication with Azure Batch. |
127+
| `<region>.batch.azure.com` | ANY | 443 | Replace `<region>` with the Azure region that contains your Azure Machine Learning workspace. Communication with Azure Batch. |
128+
| `<region>.service.batch.com` | ANY | 443 | Replace `<region>` with the Azure region that contains your Azure Machine Learning workspace. Communication with Azure Batch. |
129129
| `*.blob.core.windows.net` | TCP | 443 | Communication with Azure Blob storage. |
130130
| `*.queue.core.windows.net` | TCP | 443 | Communication with Azure Queue storage. |
131131
| `*.table.core.windows.net` | TCP | 443 | Communication with Azure Table storage. |
132132

133133

134-
+ Create either a firewall and outbound rules or a NAT gateway and network service groups to allow outbound traffic. Since the compute has no public IP address, it can't communicate with resources on the public internet without this configuration. For example, it wouldn't be able to communicate with Azure Active Directory or Azure Resource Manager. Installing Python packages from public sources would also require this configuration.
134+
+ By default, a compute instance/cluster configured for no public IP doesn't have outbound access to the internet. If you *can* access the internet from it, it is because of Azure [default outbound access](/azure/virtual-network/ip-services/default-outbound-access) and you have an NSG that allows outbound to the internet. However, we **don't recommend** using the default outbound access. If you need outbound access to the internet, we recommend using either a firewall and outbound rules or a NAT gateway and network service groups to allow outbound traffic instead.
135135

136136
For more information on the outbound traffic that is used by Azure Machine Learning, see the following articles:
137137
- [Configure inbound and outbound network traffic](how-to-access-azureml-behind-firewall.md).
@@ -223,19 +223,19 @@ The following configurations are in addition to those listed in the [Prerequisit
223223
| Service tag | Protocol | Port | Notes |
224224
| ----- |:-----:|:-----:| ----- |
225225
| `AzureMachineLearning` | TCP<br>UDP | 443/8787/18881<br>5831 | Communication with the Azure Machine Learning service.|
226-
| `BatchNodeManagement.<region>` | ANY | 443| Replace `<region>` with the Azure region that contains your Azure Machine learning workspace. Communication with Azure Batch. Compute instance and compute cluster are implemented using the Azure Batch service.|
227-
| `Storage.<region>` | TCP | 443 | Replace `<region>` with the Azure region that contains your Azure Machine learning workspace. This service tag is used to communicate with the Azure Storage account used by Azure Batch. |
226+
| `BatchNodeManagement.<region>` | ANY | 443| Replace `<region>` with the Azure region that contains your Azure Machine Learning workspace. Communication with Azure Batch. Compute instance and compute cluster are implemented using the Azure Batch service.|
227+
| `Storage.<region>` | TCP | 443 | Replace `<region>` with the Azure region that contains your Azure Machine Learning workspace. This service tag is used to communicate with the Azure Storage account used by Azure Batch. |
228228

229229
> [!IMPORTANT]
230230
> The outbound access to `Storage.<region>` could potentially be used to exfiltrate data from your workspace. By using a Service Endpoint Policy, you can mitigate this vulnerability. For more information, see the [Azure Machine Learning data exfiltration prevention](how-to-prevent-data-loss-exfiltration.md) article.
231231
232232
| FQDN | Protocol | Port | Notes |
233233
| ---- |:----:|:----:| ---- |
234-
| `<region>.tundra.azureml.ms` | UDP | 5831 | Replace `<region>` with the Azure region that contains your Azure Machine learning workspace. |
234+
| `<region>.tundra.azureml.ms` | UDP | 5831 | Replace `<region>` with the Azure region that contains your Azure Machine Learning workspace. |
235235
| `graph.windows.net` | TCP | 443 | Communication with the Microsoft Graph API.|
236236
| `*.instances.azureml.ms` | TCP | 443/8787/18881 | Communication with Azure Machine Learning. |
237-
| `<region>.batch.azure.com` | ANY | 443 | Replace `<region>` with the Azure region that contains your Azure Machine learning workspace. Communication with Azure Batch. |
238-
| `<region>.service.batch.com` | ANY | 443 | Replace `<region>` with the Azure region that contains your Azure Machine learning workspace. Communication with Azure Batch. |
237+
| `<region>.batch.azure.com` | ANY | 443 | Replace `<region>` with the Azure region that contains your Azure Machine Learning workspace. Communication with Azure Batch. |
238+
| `<region>.service.batch.com` | ANY | 443 | Replace `<region>` with the Azure region that contains your Azure Machine Learning workspace. Communication with Azure Batch. |
239239
| `*.blob.core.windows.net` | TCP | 443 | Communication with Azure Blob storage. |
240240
| `*.queue.core.windows.net` | TCP | 443 | Communication with Azure Queue storage. |
241241
| `*.table.core.windows.net` | TCP | 443 | Communication with Azure Table storage. |

‎articles/machine-learning/v1/how-to-secure-training-vnet.md

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,8 @@ The following table contains the differences between these configurations:
3232

3333
| Configuration | With public IP | Without public IP |
3434
| ----- | ----- | ----- |
35-
| Inbound traffic | AzureMachineLearning | None |
36-
| Outbound traffic | By default, can access the public internet with no restrictions.<br>You can restrict what it accesses using a Network Security Group or firewall. | By default, it cannot access the public internet since there is no public IP resource.<br>You need a Virtual Network NAT gateway or Firewall to route outbound traffic to required resources on the internet. |
35+
| Inbound traffic | `AzureMachineLearning` service tag. | None |
36+
| Outbound traffic | By default, can access the public internet with no restrictions.<br>You can restrict what it accesses using a Network Security Group or firewall. | By default, it can't access the internet. If it can still send outbound traffic to internet, it is because of Azure [default outbound access](/azure/virtual-network/ip-services/default-outbound-access) and you have an NSG that allows outbound to the internet. We **don't recommend** using the default outbound access.<br>If you need outbound access to the internet, we recommend using a Virtual Network NAT gateway or Firewall instead if you need to route outbound traffic to required resources on the internet. |
3737
| Azure networking resources | Public IP address, load balancer, network interface | None |
3838

3939
You can also use Azure Databricks or HDInsight to train models in a virtual network.
@@ -123,19 +123,19 @@ The following configurations are in addition to those listed in the [Prerequisit
123123
| Service tag | Protocol | Port | Notes |
124124
| ----- |:-----:|:-----:| ----- |
125125
| `AzureMachineLearning` | TCP<br>UDP | 443/8787/18881<br>5831 | Communication with the Azure Machine Learning service.|
126-
| `BatchNodeManagement.<region>` | ANY | 443| Replace `<region>` with the Azure region that contains your Azure Machine learning workspace. Communication with Azure Batch. Compute instance and compute cluster are implemented using the Azure Batch service.|
127-
| `Storage.<region>` | TCP | 443 | Replace `<region>` with the Azure region that contains your Azure Machine learning workspace. This service tag is used to communicate with the Azure Storage account used by Azure Batch. |
126+
| `BatchNodeManagement.<region>` | ANY | 443| Replace `<region>` with the Azure region that contains your Azure Machine Learning workspace. Communication with Azure Batch. Compute instance and compute cluster are implemented using the Azure Batch service.|
127+
| `Storage.<region>` | TCP | 443 | Replace `<region>` with the Azure region that contains your Azure Machine Learning workspace. This service tag is used to communicate with the Azure Storage account used by Azure Batch. |
128128

129129
> [!IMPORTANT]
130130
> The outbound access to `Storage.<region>` could potentially be used to exfiltrate data from your workspace. By using a Service Endpoint Policy, you can mitigate this vulnerability. For more information, see the [Azure Machine Learning data exfiltration prevention](../how-to-prevent-data-loss-exfiltration.md) article.
131131
132132
| FQDN | Protocol | Port | Notes |
133133
| ---- |:----:|:----:| ---- |
134-
| `<region>.tundra.azureml.ms` | UDP | 5831 | Replace `<region>` with the Azure region that contains your Azure Machine learning workspace. |
134+
| `<region>.tundra.azureml.ms` | UDP | 5831 | Replace `<region>` with the Azure region that contains your Azure Machine Learning workspace. |
135135
| `graph.windows.net` | TCP | 443 | Communication with the Microsoft Graph API.|
136136
| `*.instances.azureml.ms` | TCP | 443/8787/18881 | Communication with Azure Machine Learning. |
137-
| `<region>.batch.azure.com` | ANY | 443 | Replace `<region>` with the Azure region that contains your Azure Machine learning workspace. Communication with Azure Batch. |
138-
| `<region>.service.batch.com` | ANY | 443 | Replace `<region>` with the Azure region that contains your Azure Machine learning workspace. Communication with Azure Batch. |
137+
| `<region>.batch.azure.com` | ANY | 443 | Replace `<region>` with the Azure region that contains your Azure Machine Learning workspace. Communication with Azure Batch. |
138+
| `<region>.service.batch.com` | ANY | 443 | Replace `<region>` with the Azure region that contains your Azure Machine Learning workspace. Communication with Azure Batch. |
139139
| `*.blob.core.windows.net` | TCP | 443 | Communication with Azure Blob storage. |
140140
| `*.queue.core.windows.net` | TCP | 443 | Communication with Azure Queue storage. |
141141
| `*.table.core.windows.net` | TCP | 443 | Communication with Azure Table storage. |
@@ -195,19 +195,19 @@ The following configurations are in addition to those listed in the [Prerequisit
195195
| Service tag | Protocol | Port | Notes |
196196
| ----- |:-----:|:-----:| ----- |
197197
| `AzureMachineLearning` | TCP<br>UDP | 443/8787/18881<br>5831 | Communication with the Azure Machine Learning service.|
198-
| `BatchNodeManagement.<region>` | ANY | 443| Replace `<region>` with the Azure region that contains your Azure Machine learning workspace. Communication with Azure Batch. Compute instance and compute cluster are implemented using the Azure Batch service.|
199-
| `Storage.<region>` | TCP | 443 | Replace `<region>` with the Azure region that contains your Azure Machine learning workspace. This service tag is used to communicate with the Azure Storage account used by Azure Batch. |
198+
| `BatchNodeManagement.<region>` | ANY | 443| Replace `<region>` with the Azure region that contains your Azure Machine Learning workspace. Communication with Azure Batch. Compute instance and compute cluster are implemented using the Azure Batch service.|
199+
| `Storage.<region>` | TCP | 443 | Replace `<region>` with the Azure region that contains your Azure Machine Learning workspace. This service tag is used to communicate with the Azure Storage account used by Azure Batch. |
200200

201201
> [!IMPORTANT]
202202
> The outbound access to `Storage.<region>` could potentially be used to exfiltrate data from your workspace. By using a Service Endpoint Policy, you can mitigate this vulnerability. For more information, see the [Azure Machine Learning data exfiltration prevention](../how-to-prevent-data-loss-exfiltration.md) article.
203203
204204
| FQDN | Protocol | Port | Notes |
205205
| ---- |:----:|:----:| ---- |
206-
| `<region>.tundra.azureml.ms` | UDP | 5831 | Replace `<region>` with the Azure region that contains your Azure Machine learning workspace. |
206+
| `<region>.tundra.azureml.ms` | UDP | 5831 | Replace `<region>` with the Azure region that contains your Azure Machine Learning workspace. |
207207
| `graph.windows.net` | TCP | 443 | Communication with the Microsoft Graph API.|
208208
| `*.instances.azureml.ms` | TCP | 443/8787/18881 | Communication with Azure Machine Learning. |
209-
| `<region>.batch.azure.com` | ANY | 443 | Replace `<region>` with the Azure region that contains your Azure Machine learning workspace. Communication with Azure Batch. |
210-
| `<region>.service.batch.com` | ANY | 443 | Replace `<region>` with the Azure region that contains your Azure Machine learning workspace. Communication with Azure Batch. |
209+
| `<region>.batch.azure.com` | ANY | 443 | Replace `<region>` with the Azure region that contains your Azure Machine Learning workspace. Communication with Azure Batch. |
210+
| `<region>.service.batch.com` | ANY | 443 | Replace `<region>` with the Azure region that contains your Azure Machine Learning workspace. Communication with Azure Batch. |
211211
| `*.blob.core.windows.net` | TCP | 443 | Communication with Azure Blob storage. |
212212
| `*.queue.core.windows.net` | TCP | 443 | Communication with Azure Queue storage. |
213213
| `*.table.core.windows.net` | TCP | 443 | Communication with Azure Table storage. |

0 commit comments

Comments
 (0)