Skip to content

Commit d31ca7c

Browse files
asudbringasudbring
committed
added powershell and cli tabs
1 parent 56903b0 commit d31ca7c

File tree

2 files changed

+262
-62
lines changed

2 files changed

+262
-62
lines changed

‎articles/virtual-network/how-to-create-encryption-portal.md

Lines changed: 0 additions & 62 deletions
This file was deleted.

‎articles/virtual-network/how-to-create-encryption.md

Lines changed: 262 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,262 @@
1+
---
2+
title: Create a virtual network with encryption - Azure portal
3+
titleSuffix: Azure Virtual Network
4+
description: Learn how to create an encrypted virtual network using the Azure portal. A virtual network lets Azure resources communicate with each other and with the internet.
5+
author: asudbring
6+
ms.service: azure-virtual-network
7+
ms.topic: how-to
8+
ms.date: 08/15/2024
9+
ms.author: allensu
10+
11+
---
12+
13+
# Create a virtual network with encryption using the Azure portal
14+
15+
Azure Virtual Network encryption is a feature of Azure Virtual Network. Virtual network encryption allows you to seamlessly encrypt and decrypt internal network traffic over the wire, with minimal effect to performance and scale. Azure Virtual Network encryption protects data traversing your virtual network virtual machine to virtual machine and virtual machine to on-premises.
16+
17+
## Prerequisites
18+
19+
### [Portal](#tab/portal)
20+
21+
- An Azure account with an active subscription. [Create one for free](https://azure.microsoft.com/free/?ref=microsoft.com&utm_source=microsoft.com&utm_medium=docs&utm_campaign=visualstudio).
22+
23+
### [PowerShell](#tab/powershell)
24+
25+
- An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
26+
27+
- Azure PowerShell installed locally or Azure Cloud Shell.
28+
29+
- Sign in to Azure PowerShell and ensure you've selected the subscription with which you want to use this feature. For more information, see [Sign in with Azure PowerShell](/powershell/azure/authenticate-azureps).
30+
31+
- Ensure your `Az.Network` module is 4.3.0 or later. To verify the installed module, use the command Get-InstalledModule -Name `Az.Network`. If the module requires an update, use the command Update-Module -Name `Az.Network` if necessary.
32+
33+
If you choose to install and use PowerShell locally, this article requires the Azure PowerShell module version 5.4.1 or later. Run `Get-Module -ListAvailable Az` to find the installed version. If you need to upgrade, see [Install Azure PowerShell module](/powershell/azure/install-Az-ps). If you're running PowerShell locally, you also need to run `Connect-AzAccount` to create a connection with Azure.
34+
35+
### [CLI](#tab/cli)
36+
37+
- An Azure account with an active subscription. [Create one for free](https://azure.microsoft.com/free/?ref=microsoft.com&utm_source=microsoft.com&utm_medium=docs&utm_campaign=visualstudio).
38+
39+
[!INCLUDE [azure-cli-prepare-your-environment-no-header.md](~/reusable-content/azure-cli/azure-cli-prepare-your-environment-no-header.md)]
40+
41+
- The how-to article requires version 2.31.0 or later of the Azure CLI. If using Azure Cloud Shell, the latest version is already installed.
42+
43+
---
44+
45+
## Create a virtual network
46+
47+
### [Portal](#tab/portal)
48+
49+
[!INCLUDE [virtual-network-create.md](~/reusable-content/ce-skilling/azure/includes/virtual-network-create.md)]
50+
51+
### [PowerShell](#tab/powershell)
52+
53+
Create a resource group with [New-AzResourceGroup](/powershell/module/az.resources/new-azresourcegroup) named **test-rg** in the **eastus2** location.
54+
55+
```azurepowershell-interactive
56+
$rg =@{
57+
Name = 'test-rg'
58+
Location = 'eastus2'
59+
}
60+
New-AzResourceGroup @rg
61+
```
62+
63+
Use [New-AzVirtualNetwork](/powershell/module/az.network/new-azvirtualnetwork) and [New-AzVirtualNetworkSubnetConfig](/powershell/module/az.network/new-azvirtualnetworksubnetconfig) to create a virtual network.
64+
65+
```azurepowershell-interactive
66+
## Create backend subnet config ##
67+
$subnet = @{
68+
Name = 'subnet-1'
69+
AddressPrefix = '10.0.0.0/24'
70+
}
71+
$subnetConfig = New-AzVirtualNetworkSubnetConfig @subnet
72+
73+
## Create the virtual network ##
74+
$net = @{
75+
Name = 'vnet-1'
76+
ResourceGroupName = 'test-rg'
77+
Location = 'eastus2'
78+
AddressPrefix = '10.0.0.0/16'
79+
Subnet = $subnetConfig
80+
EnableEncryption = 'true'
81+
EncryptionEnforcementPolicy = 'AllowUnencrypted'
82+
}
83+
New-AzVirtualNetwork @net
84+
```
85+
86+
### [CLI](#tab/cli)
87+
88+
Create a resource group with [az group create](/cli/azure/group#az-group-create) named **test-rg** in the **eastus2** location.
89+
90+
```azurecli-interactive
91+
az group create \
92+
--name test-rg \
93+
--location eastus2
94+
```
95+
96+
Use [az network vnet create](/cli/azure/network/vnet#az-network-vnet-create) to create a virtual network.
97+
98+
```azurecli-interactive
99+
az network vnet create \
100+
--resource-group test-rg \
101+
--location eastus2 \
102+
--name vnet-1 \
103+
--enable-encryption true \
104+
--encryption-enforcement-policy allowUnencrypted \
105+
--address-prefixes 10.0.0.0/16 \
106+
--subnet-name subnet-1 \
107+
--subnet-prefixes 10.0.0.0/24
108+
```
109+
110+
---
111+
112+
> [!IMPORTANT]
113+
> Azure Virtual Network encryption requires supported virtual machine SKUs in the virtual network for traffic to be encrypted. The setting **dropUnencrypted** will drop traffic between unsupported virtual machine SKUs if they are deployed in the virtual network. For more information, see [Azure Virtual Network encryption requirements](virtual-network-encryption-overview.md#requirements).
114+
115+
## Enable encryption on a virtual network
116+
117+
### [Portal](#tab/portal)
118+
119+
Use the following steps to enable encryption for a virtual network.
120+
121+
1. In the search box at the top of the portal, begin typing **Virtual networks**. When **Virtual networks** appears in the search results, select it.
122+
123+
1. Select **vnet-1**.
124+
125+
1. In the **Overview** of **vnet-1**, select the **Properties** tab.
126+
127+
1. Select **Disabled** next to **Encryption**:
128+
129+
:::image type="content" source="./media/how-to-create-encryption-portal/virtual-network-properties.png" alt-text="Screenshot of properties of the virtual network.":::
130+
131+
1. Select the box next to **Virtual network encryption**.
132+
133+
1. Select **Save**.
134+
135+
### [PowerShell](#tab/powershell)
136+
137+
You can also enable encryption on an existing virtual network using [Set-AzVirtualNetwork](/powershell/module/az.network/set-azvirtualnetwork). **This step isn't necessary if you created the virtual network with encryption enabled in the previous steps.**
138+
139+
```azurepowershell-interactive
140+
## Place the virtual network configuration into a variable. ##
141+
$net = @{
142+
Name = 'vnet-1'
143+
ResourceGroupName = 'test-rg'
144+
}
145+
$vnet = Get-AzVirtualNetwork @net
146+
147+
## Enable encryption on the virtual network ##
148+
$vnet.Encryption = @{
149+
Enabled = 'true'
150+
Enforcement = 'allowUnencrypted'
151+
}
152+
$vnet | Set-AzVirtualNetwork
153+
```
154+
155+
### [CLI](#tab/cli)
156+
157+
You can also enable encryption on an existing virtual network using [az network vnet update](/cli/azure/network/vnet#az-network-vnet-update). **This step isn't necessary if you created the virtual network with encryption enabled in the previous steps.**
158+
159+
```azurecli-interactive
160+
az network vnet update \
161+
--resource-group test-rg \
162+
--name vnet-1 \
163+
--enable-encryption true \
164+
--encryption-enforcement-policy allowUnencrypted
165+
```
166+
167+
---
168+
169+
## Verify encryption enabled
170+
171+
### [Portal](#tab/portal)
172+
173+
1. In the search box at the top of the portal, begin typing **Virtual networks**. When **Virtual networks** appears in the search results, select it.
174+
175+
1. Select **vnet-1**.
176+
177+
1. In the **Overview** of **vnet-1**, select the **Properties** tab.
178+
179+
1. Verify that **Encryption** is set to **Enabled**.
180+
181+
:::image type="content" source="./media/how-to-create-encryption-portal/virtual-network-properties-encryption-enabled.png" alt-text="Screenshot of properties of the virtual network with encryption enabled.":::
182+
183+
### [PowerShell](#tab/powershell)
184+
185+
Use [Get-AzVirtualNetwork](/powershell/module/az.network/get-azvirtualnetwork) to view the encryption parameter for the virtual network you created previously.
186+
187+
```azurepowershell-interactive
188+
## Place the virtual network configuration into a variable. ##
189+
$net = @{
190+
Name = 'vnet-1'
191+
ResourceGroupName = 'test-rg'
192+
}
193+
$vnet = Get-AzVirtualNetwork @net
194+
```
195+
196+
To view the parameter for encryption, enter the following information.
197+
198+
```azurepowershell-interactive
199+
$vnet.Encryption
200+
```
201+
202+
```output
203+
Enabled Enforcement
204+
------- -----------
205+
True allowUnencrypted
206+
```
207+
208+
### [CLI](#tab/cli)
209+
210+
Use [az network vnet show](/cli/azure/network/vnet#az-network-vnet-show) to view the encryption parameter for the virtual network you created previously.
211+
212+
```azurecli-interactive
213+
az network vnet show \
214+
--resource-group test-rg \
215+
--name vnet-1 \
216+
--query encryption \
217+
--output tsv
218+
```
219+
220+
```output
221+
user@Azure:~$ az network vnet show \
222+
--resource-group test-rg \
223+
--name vnet-1 \
224+
--query encryption \
225+
--output tsv
226+
True AllowUnencrypted
227+
```
228+
229+
---
230+
231+
### [Portal](#tab/portal)
232+
233+
[!INCLUDE [portal-clean-up.md](~/reusable-content/ce-skilling/azure/includes/portal-clean-up.md)]
234+
235+
### [PowerShell](#tab/powershell)
236+
237+
When no longer needed, you can use [Remove-AzResourceGroup](/powershell/module/az.resources/remove-azresourcegroup) to remove the resource group and all of the resources it contains:
238+
239+
```azurepowershell-interactive
240+
$cleanup = @{
241+
Name = "test-rg"
242+
}
243+
Remove-AzResourceGroup @cleanup -Force
244+
```
245+
246+
### [CLI](#tab/cli)
247+
248+
When you're done with the virtual network, use [az group delete](/cli/azure/group#az-group-delete) to remove the resource group and all its resources.
249+
250+
```azurecli-interactive
251+
az group delete \
252+
--name test-rg \
253+
--yes
254+
```
255+
256+
---
257+
258+
## Next steps
259+
260+
- For more information about Azure Virtual Networks, see [What is Azure Virtual Network?](/azure/virtual-network/virtual-networks-overview)
261+
262+
- For more information about Azure Virtual Network encryption, see [What is Azure Virtual Network encryption?](virtual-network-encryption-overview.md)

0 commit comments

Comments
 (0)