Skip to content

Commit d528c27

Browse files
Court72Court72
authored
Merge pull request #196702 from carlrab/azurecli-docs-code-blocks
use code blocks from new file
2 parents c27a5a8 + 2724741 commit d528c27

File tree

2 files changed

+93
-223
lines changed

2 files changed

+93
-223
lines changed

‎articles/container-instances/container-instances-egress-ip-address.md

Lines changed: 46 additions & 145 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Configure static outbound IP
33
description: Configure Azure firewall and user-defined routes for Azure Container Instances workloads that use the firewall's public IP address for ingress and egress
44
ms.topic: article
5-
ms.date: 07/16/2020
5+
ms.date: 05/03/2022
66
---
77

88
# Configure a single public IP address for outbound and inbound traffic to a container group
@@ -11,127 +11,80 @@ Setting up a [container group](container-instances-container-groups.md) with an
1111

1212
This article provides steps to configure a container group in a [virtual network](container-instances-virtual-network-concepts.md) integrated with [Azure Firewall](../firewall/overview.md). By setting up a user-defined route to the container group and firewall rules, you can route and identify traffic to and from the container group. Container group ingress and egress use the public IP address of the firewall. A single egress IP address can be used by multiple container groups deployed in the virtual network's subnet delegated to Azure Container Instances.
1313

14-
In this article you use the Azure CLI to create the resources for this scenario:
14+
In this article, you use the Azure CLI to create the resources for this scenario:
1515

16-
* Container groups deployed on a delegated subnet [in the virtual network](container-instances-vnet.md)
16+
* Container groups deployed on a delegated subnet [in the virtual network](container-instances-vnet.md)
1717
* An Azure firewall deployed in the network with a static public IP address
1818
* A user-defined route on the container groups' subnet
1919
* A NAT rule for firewall ingress and an application rule for egress
2020

2121
You then validate ingress and egress from example container groups through the firewall.
2222

23-
## Deploy ACI in a virtual network
23+
[!INCLUDE [quickstarts-free-trial-note](../../includes/quickstarts-free-trial-note.md)]
2424

25-
In a typical case, you might already have an Azure virtual network in which to deploy a container group. For demonstration purposes, the following commands create a virtual network and subnet when the container group is created. The subnet is delegated to Azure Container Instances.
25+
[!INCLUDE [azure-cli-prepare-your-environment.md](../../includes/azure-cli-prepare-your-environment.md)]
2626

27-
The container group runs a small web app from the `aci-helloworld` image. As shown in other articles in the documentation, this image packages a small web app written in Node.js that serves a static HTML page.
27+
[!INCLUDE [cli-launch-cloud-shell-sign-in.md](../../includes/cli-launch-cloud-shell-sign-in.md)]
2828

29-
If you need one, first create an Azure resource group with the [az group create][az-group-create] command. For example:
29+
> [!NOTE]
30+
> To download the complete script, go to [full script](https://github.com/Azure-Samples/azure-cli-samples/blob/master/container-instances/egress-ip-address.sh).
3031
31-
```azurecli
32-
az group create --name myResourceGroup --location eastus
33-
```
32+
## Get started
3433

35-
To simplify the following command examples, use an environment variable for the resource group's name:
34+
This tutorial makes use of a randomized variable. If you are using an existing resource group, modify the value of this variable appropriately.
3635

37-
```console
38-
export RESOURCE_GROUP_NAME=myResourceGroup
39-
```
36+
:::code language="azurecli" source="~/azure_cli_scripts/container-instances/egress-ip-address.sh" id="variable":::
37+
38+
**Azure resource group**: If you don't have an Azure resource group already, create a resource group with the [az group create][az-group-create] command. Modify the location value as appropriate.
39+
40+
:::code language="azurecli" source="~/azure_cli_scripts/container-instances/egress-ip-address.sh" id="creategroup":::
41+
42+
## Deploy ACI in a virtual network
43+
44+
In a typical case, you might already have an Azure virtual network in which to deploy a container group. For demonstration purposes, the following commands create a virtual network and subnet when the container group is created. The subnet is delegated to Azure Container Instances.
45+
46+
The container group runs a small web app from the `aci-helloworld` image. As shown in other articles in the documentation, this image packages a small web app written in Node.js that serves a static HTML page.
4047

4148
Create the container group with the [az container create][az-container-create] command:
4249

43-
```azurecli
44-
az container create \
45-
--name appcontainer \
46-
--resource-group $RESOURCE_GROUP_NAME \
47-
--image mcr.microsoft.com/azuredocs/aci-helloworld \
48-
--vnet aci-vnet \
49-
--vnet-address-prefix 10.0.0.0/16 \
50-
--subnet aci-subnet \
51-
--subnet-address-prefix 10.0.0.0/24
52-
```
50+
:::code language="azurecli" source="~/azure_cli_scripts/container-instances/egress-ip-address.sh" id="container":::
5351

5452
> [!TIP]
5553
> Adjust the value of `--subnet address-prefix` for the IP address space you need in your subnet. The smallest supported subnet is /29, which provides eight IP addresses. Some IP addresses are reserved for use by Azure.
5654
5755
For use in a later step, get the private IP address of the container group by running the [az container show][az-container-show] command:
5856

59-
```azurecli
60-
ACI_PRIVATE_IP="$(az container show --name appcontainer \
61-
--resource-group $RESOURCE_GROUP_NAME \
62-
--query ipAddress.ip --output tsv)"
63-
```
57+
:::code language="azurecli" source="~/azure_cli_scripts/container-instances/egress-ip-address.sh" id="privateip":::
6458

6559
## Deploy Azure Firewall in network
6660

6761
In the following sections, use the Azure CLI to deploy an Azure firewall in the virtual network. For background, see [Tutorial: Deploy and configure Azure Firewall using the Azure portal](../firewall/deploy-cli.md).
6862

6963
First, use the [az network vnet subnet create][az-network-vnet-subnet-create] to add a subnet named AzureFirewallSubnet for the firewall. AzureFirewallSubnet is the *required* name of this subnet.
7064

71-
```azurecli
72-
az network vnet subnet create \
73-
--name AzureFirewallSubnet \
74-
--resource-group $RESOURCE_GROUP_NAME \
75-
--vnet-name aci-vnet \
76-
--address-prefix 10.0.1.0/26
77-
```
65+
:::code language="azurecli" source="~/azure_cli_scripts/container-instances/egress-ip-address.sh" id="subnet":::
7866

7967
Use the following [Azure CLI commands](../firewall/deploy-cli.md) to create a firewall in the subnet.
8068

8169
If not already installed, add the firewall extension to the Azure CLI using the [az extension add][az-extension-add] command:
8270

83-
```azurecli
84-
az extension add --name azure-firewall
85-
```
71+
:::code language="azurecli" source="~/azure_cli_scripts/container-instances/egress-ip-address.sh" id="firewallext":::
8672

8773
Create the firewall resources:
8874

89-
```azurecli
90-
az network firewall create \
91-
--name myFirewall \
92-
--resource-group $RESOURCE_GROUP_NAME \
93-
--location eastus
94-
95-
az network public-ip create \
96-
--name fw-pip \
97-
--resource-group $RESOURCE_GROUP_NAME \
98-
--location eastus \
99-
--allocation-method static \
100-
--sku standard
101-
102-
az network firewall ip-config create \
103-
--firewall-name myFirewall \
104-
--name FW-config \
105-
--public-ip-address fw-pip \
106-
--resource-group $RESOURCE_GROUP_NAME \
107-
--vnet-name aci-vnet
108-
```
75+
:::code language="azurecli" source="~/azure_cli_scripts/container-instances/egress-ip-address.sh" id="firewallext":::
10976

11077
Update the firewall configuration using the [az network firewall update][az-network-firewall-update] command:
11178

112-
```azurecli
113-
az network firewall update \
114-
--name myFirewall \
115-
--resource-group $RESOURCE_GROUP_NAME
116-
```
79+
:::code language="azurecli" source="~/azure_cli_scripts/container-instances/egress-ip-address.sh" id="firewallupdate":::
11780

11881
Get the firewall's private IP address using the [az network firewall ip-config list][az-network-firewall-ip-config-list] command. This private IP address is used in a later command.
11982

83+
:::code language="azurecli" source="~/azure_cli_scripts/container-instances/egress-ip-address.sh" id="storeprivateip":::
12084

121-
```azurecli
122-
FW_PRIVATE_IP="$(az network firewall ip-config list \
123-
--resource-group $RESOURCE_GROUP_NAME \
124-
--firewall-name myFirewall \
125-
--query "[].privateIpAddress" --output tsv)"
126-
```
12785
Get the firewall's public IP address using the [az network public-ip show][az-network-public-ip-show] command. This public IP address is used in a later command.
12886

129-
```azurecli
130-
FW_PUBLIC_IP="$(az network public-ip show \
131-
--name fw-pip \
132-
--resource-group $RESOURCE_GROUP_NAME \
133-
--query ipAddress --output tsv)"
134-
```
87+
:::code language="azurecli" source="~/azure_cli_scripts/container-instances/egress-ip-address.sh" id="storepublicip":::
13588

13689
## Define user-defined route on ACI subnet
13790

@@ -141,97 +94,49 @@ Define a use-defined route on the ACI subnet, to divert traffic to the Azure fir
14194

14295
First, run the following [az network route-table create][az-network-route-table-create] command to create the route table. Create the route table in the same region as the virtual network.
14396

144-
```azurecli
145-
az network route-table create \
146-
--name Firewall-rt-table \
147-
--resource-group $RESOURCE_GROUP_NAME \
148-
--location eastus \
149-
--disable-bgp-route-propagation true
150-
```
97+
:::code language="azurecli" source="~/azure_cli_scripts/container-instances/egress-ip-address.sh" id="routetable":::
15198

15299
### Create route
153100

154101
Run [az network-route-table route create][az-network-route-table-route-create] to create a route in the route table. To route traffic to the firewall, set the next hop type to `VirtualAppliance`, and pass the firewall's private IP address as the next hop address.
155102

156-
```azurecli
157-
az network route-table route create \
158-
--resource-group $RESOURCE_GROUP_NAME \
159-
--name DG-Route \
160-
--route-table-name Firewall-rt-table \
161-
--address-prefix 0.0.0.0/0 \
162-
--next-hop-type VirtualAppliance \
163-
--next-hop-ip-address $FW_PRIVATE_IP
164-
```
103+
:::code language="azurecli" source="~/azure_cli_scripts/container-instances/egress-ip-address.sh" id="createroute":::
165104

166105
### Associate route table to ACI subnet
167106

168107
Run the [az network vnet subnet update][az-network-vnet-subnet-update] command to associate the route table with the subnet delegated to Azure Container Instances.
169108

170-
```azurecli
171-
az network vnet subnet update \
172-
--name aci-subnet \
173-
--resource-group $RESOURCE_GROUP_NAME \
174-
--vnet-name aci-vnet \
175-
--address-prefixes 10.0.0.0/24 \
176-
--route-table Firewall-rt-table
177-
```
109+
:::code language="azurecli" source="~/azure_cli_scripts/container-instances/egress-ip-address.sh" id="associateroute":::
178110

179111
## Configure rules on firewall
180112

181-
By default, Azure Firewall denies (blocks) inbound and outbound traffic.
113+
By default, Azure Firewall denies (blocks) inbound and outbound traffic.
182114

183115
### Configure NAT rule on firewall to ACI subnet
184116

185117
Create a [NAT rule](../firewall/rule-processing.md) on the firewall to translate and filter inbound internet traffic to the application container you started previously in the network. For details, see [Filter inbound Internet traffic with Azure Firewall DNAT](../firewall/tutorial-firewall-dnat.md)
186118

187119
Create a NAT rule and collection by using the [az network firewall nat-rule create][az-network-firewall-nat-rule-create] command:
188120

189-
```azurecli
190-
az network firewall nat-rule create \
191-
--firewall-name myFirewall \
192-
--collection-name myNATCollection \
193-
--action dnat \
194-
--name myRule \
195-
--protocols TCP \
196-
--source-addresses '*' \
197-
--destination-addresses $FW_PUBLIC_IP \
198-
--destination-ports 80 \
199-
--resource-group $RESOURCE_GROUP_NAME \
200-
--translated-address $ACI_PRIVATE_IP \
201-
--translated-port 80 \
202-
--priority 200
203-
```
121+
:::code language="azurecli" source="~/azure_cli_scripts/container-instances/egress-ip-address.sh" id="natrule":::
204122

205123
Add NAT rules as needed to filter traffic to other IP addresses in the subnet. For example, other container groups in the subnet could expose IP addresses for inbound traffic, or other internal IP addresses could be assigned to the container group after a restart.
206124

207125
### Create outbound application rule on the firewall
208126

209127
Run the following [az network firewall application-rule create][az-network-firewall-application-rule-create] command to create an outbound rule on the firewall. This sample rule allows access from the subnet delegated to Azure Container Instances to the FQDN `checkip.dyndns.org`. HTTP access to the site is used in a later step to confirm the egress IP address from Azure Container Instances.
210128

211-
```azurecli
212-
az network firewall application-rule create \
213-
--collection-name myAppCollection \
214-
--firewall-name myFirewall \
215-
--name Allow-CheckIP \
216-
--protocols Http=80 Https=443 \
217-
--resource-group $RESOURCE_GROUP_NAME \
218-
--target-fqdns checkip.dyndns.org \
219-
--source-addresses 10.0.0.0/24 \
220-
--priority 200 \
221-
--action Allow
222-
```
129+
:::code language="azurecli" source="~/azure_cli_scripts/container-instances/egress-ip-address.sh" id="outboundrule":::
223130

224131
## Test container group access through the firewall
225132

226133
The following sections verify that the subnet delegated to Azure Container Instances is properly configured behind the Azure firewall. The previous steps routed both incoming traffic to the subnet and outgoing traffic from the subnet through the firewall.
227134

228135
### Test ingress to a container group
229136

230-
Test inbound access to the *appcontainer* running in the virtual network by browsing to the firewall's public IP address. Previously, you stored the public IP address in variable $FW_PUBLIC_IP:
137+
Test inbound access to the `appcontainer` running in the virtual network by browsing to the firewall's public IP address. Previously, you stored the public IP address in variable $FW_PUBLIC_IP:
231138

232-
```bash
233-
echo $FW_PUBLIC_IP
234-
```
139+
:::code language="azurecli" source="~/azure_cli_scripts/container-instances/egress-ip-address.sh" id="echo":::
235140

236141
Output is similar to:
237142

@@ -245,19 +150,9 @@ If the NAT rule on the firewall is configured properly, you see the following wh
245150

246151
### Test egress from a container group
247152

248-
249153
Deploy the following sample container into the virtual network. When it runs, it sends a single HTTP request to `http://checkip.dyndns.org`, which displays the IP address of the sender (the egress IP address). If the application rule on the firewall is configured properly, the firewall's public IP address is returned.
250154

251-
```azurecli
252-
az container create \
253-
--resource-group $RESOURCE_GROUP_NAME \
254-
--name testegress \
255-
--image mcr.microsoft.com/azuredocs/aci-tutorial-sidecar \
256-
--command-line "curl -s http://checkip.dyndns.org" \
257-
--restart-policy OnFailure \
258-
--vnet aci-vnet \
259-
--subnet aci-subnet
260-
```
155+
:::code language="azurecli" source="~/azure_cli_scripts/container-instances/egress-ip-address.sh" id="egress":::
261156

262157
View the container logs to confirm the IP address is the same as the public IP address of the firewall.
263158

@@ -273,14 +168,20 @@ Output is similar to:
273168
<html><head><title>Current IP Check</title></head><body>Current IP Address: 52.142.18.133</body></html>
274169
```
275170

171+
## Clean up resources
172+
173+
When no longer needed, you can use [az group delete](/cli/azure/group) to remove the resource group and all related resources as follows. The `--no-wait` parameter returns control to the prompt without waiting for the operation to complete. The `--yes` parameter confirms that you wish to delete the resources without an additional prompt to do so.
174+
175+
```azurecli-interactive
176+
az group delete --name $resourceGroup --yes --no-wait
177+
```
178+
276179
## Next steps
277180

278181
In this article, you set up container groups in a virtual network behind an Azure firewall. You configured a user-defined route and NAT and application rules on the firewall. By using this configuration, you set up a single, static IP address for ingress and egress from Azure Container Instances.
279182

280183
For more information about managing traffic and protecting Azure resources, see the [Azure Firewall](../firewall/index.yml) documentation.
281184

282-
283-
284185
[az-group-create]: /cli/azure/group#az_group_create
285186
[az-container-create]: /cli/azure/container#az_container_create
286187
[az-network-vnet-subnet-create]: /cli/azure/network/vnet/subnet#az_network_vnet_subnet_create

0 commit comments

Comments
 (0)