You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/batch/pool-endpoint-configuration.md
+60-35Lines changed: 60 additions & 35 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,28 +2,39 @@
2
2
title: Configure node endpoints in Azure Batch pool
3
3
description: How to configure or disable access to SSH or RDP ports on compute nodes in an Azure Batch pool.
4
4
ms.topic: how-to
5
-
ms.date: 06/13/2024
5
+
ms.date: 11/08/2024
6
6
---
7
7
8
8
# Configure or disable remote access to compute nodes in an Azure Batch pool
9
9
10
-
By default, Batch allows a [node user](/rest/api/batchservice/computenode/adduser) with network connectivity to connect externally to a compute node in a Batch pool. For example, a user can connect by Remote Desktop (RDP) on port 3389 to a compute node in a Windows pool. Similarly, by default, a user can connect by Secure Shell (SSH) on port 22 to a compute node in a Linux pool.
10
+
If configured, you can allow a [node user](/rest/api/batchservice/computenode/adduser) with network connectivity to connect
11
+
externally to a compute node in a Batch pool. For example, a user can connect by Remote Desktop (RDP) on port 3389 to a
12
+
compute node in a Windows pool. Similarly, by default, a user can connect by Secure Shell (SSH) on port 22 to a compute
13
+
node in a Linux pool.
11
14
12
-
In your environment, you might need to restrict or disable these default external access settings. You can modify these settings by using the Batch APIs to set the [PoolEndpointConfiguration](/rest/api/batchservice/pool/add#poolendpointconfiguration) property.
15
+
> [!TIP]
16
+
> As of API version `2024-07-01`, Batch no longer automatically maps common remote access ports for SSH and RDP.
17
+
> If you wish to allow remote access to your Batch compute nodes with pools created with API version `2024-07-01` or later,
18
+
> then you must manually configure the pool endpoint configuration to enable such access.
13
19
14
-
## About the pool endpoint configuration
15
-
The endpoint configuration consists of one or more [network address translation (NAT) pools](/rest/api/batchservice/pool/add#inboundnatpool) of frontend ports. (Do not confuse a NAT pool with the Batch pool of compute nodes.) You set up each NAT pool to override the default connection settings on the pool's compute nodes.
20
+
In your environment, you might need to enable, restrict, or disable external access settings or any other ports you wish
21
+
on the Batch pool. You can modify these settings by using the Batch APIs to set the
The endpoint configuration consists of one or more [network address translation (NAT) pools](/rest/api/batchservice/pool/add#inboundnatpool)
26
+
of frontend ports. Don't confuse a NAT pool with the Batch pool of compute nodes. You set up each NAT pool to override
27
+
the default connection settings on the pool's compute nodes.
16
28
17
29
Each NAT pool configuration includes one or more [network security group (NSG) rules](/rest/api/batchservice/pool/add#networksecuritygrouprule). Each NSG rule allows or denies certain network traffic to the endpoint. You can choose to allow or deny all traffic, traffic identified by a [service tag](../virtual-network/network-security-groups-overview.md#service-tags) (such as "Internet"), or traffic from specific IP addresses or subnets.
18
30
19
31
### Considerations
20
32
* The pool endpoint configuration is part of the pool's [network configuration](/rest/api/batchservice/pool/add#networkconfiguration). The network configuration can optionally include settings to join the pool to an [Azure virtual network](batch-virtual-network.md). If you set up the pool in a virtual network, you can create NSG rules that use address settings in the virtual network.
21
33
* You can configure multiple NSG rules when you configure a NAT pool. The rules are checked in the order of priority. Once a rule applies, no more rules are tested for matching.
22
34
35
+
## Example: Allow RDP traffic from a specific IP address
23
36
24
-
## Example: Deny all RDP traffic
25
-
26
-
The following C# snippet shows how to configure the RDP endpoint on compute nodes in a Windows pool to deny all network traffic. The endpoint uses a frontend pool of ports in the range *60000 - 60099*.
37
+
The following C# snippet shows how to configure the RDP endpoint on compute nodes in a Windows pool to allow RDP access only from IP address *198.168.100.7*. The second NSG rule denies traffic that doesn't match the IP address.
27
38
28
39
```csharp
29
40
usingMicrosoft.Azure.Batch;
@@ -32,24 +43,25 @@ using Microsoft.Azure.Batch.Common;
32
43
namespaceAzureBatch
33
44
{
34
45
public void SetPortsPool()
35
-
{
46
+
{
36
47
pool.NetworkConfiguration = new NetworkConfiguration
new InboundNatPool("RDP", InboundEndpointProtocol.Tcp, 3389, 60000, 60099, new NetworkSecurityGroupRule[]
51
+
new InboundNatPool("RDP", InboundEndpointProtocol.Tcp, 3389, 7500, 8000, new NetworkSecurityGroupRule[]
41
52
{
42
-
new NetworkSecurityGroupRule(162, NetworkSecurityGroupRuleAccess.Deny, "*"),
53
+
new NetworkSecurityGroupRule(179, NetworkSecurityGroupRuleAccess.Allow, "198.168.100.7"),
54
+
new NetworkSecurityGroupRule(180, NetworkSecurityGroupRuleAccess.Deny, "*")
43
55
})
44
-
})
56
+
})
45
57
};
46
58
}
47
59
}
48
60
```
49
61
50
-
## Example: Deny all SSH traffic from the internet
62
+
## Example: Allow SSH traffic from a specific subnet
51
63
52
-
The following Python snippet shows how to configure the SSH endpoint on compute nodes in a Linux pool to deny all internet traffic. The endpoint uses a frontend pool of ports in the range *4000 - 4100*.
64
+
The following Python snippet shows how to configure the SSH endpoint on compute nodes in a Linux pool to allow access only from the subnet *192.168.1.0/24*. The second NSG rule denies traffic that doesn't match the subnet.
## Example: Allow RDP traffic from a specific IP address
81
97
82
-
The following C# snippet shows how to configure the RDP endpoint on compute nodes in a Windows pool to allow RDP access only from IP address *198.51.100.7*. The second NSG rule denies traffic that does not match the IP address.
98
+
99
+
## Example: Deny all RDP traffic
100
+
101
+
The following C# snippet shows how to configure the RDP endpoint on compute nodes in a Windows pool to deny all network traffic. The endpoint uses a frontend pool of ports in the range *60000 - 60099*.
102
+
103
+
> [!NOTE]
104
+
> As of Batch API version `2024-07-01`, port 3389 typically associated with RDP is no longer mapped by default.
105
+
> Creating an explicit deny rule is no longer required if access is not needed from the Internet for Batch pools
106
+
> created with this API version or later. You may still need to specify explicit deny rules to restrict access
107
+
> from other sources.
83
108
84
109
```csharp
85
110
usingMicrosoft.Azure.Batch;
@@ -91,22 +116,27 @@ namespace AzureBatch
91
116
{
92
117
pool.NetworkConfiguration = new NetworkConfiguration
new InboundNatPool("RDP", InboundEndpointProtocol.Tcp, 3389, 7500, 8000, new NetworkSecurityGroupRule[]
97
-
{
98
-
new NetworkSecurityGroupRule(179, NetworkSecurityGroupRuleAccess.Allow, "198.51.100.7"),
99
-
new NetworkSecurityGroupRule(180, NetworkSecurityGroupRuleAccess.Deny, "*")
121
+
new InboundNatPool("RDP", InboundEndpointProtocol.Tcp, 3389, 60000, 60099, new NetworkSecurityGroupRule[]
122
+
{
123
+
new NetworkSecurityGroupRule(162, NetworkSecurityGroupRuleAccess.Deny, "*"),
100
124
})
101
-
})
125
+
})
102
126
};
103
127
}
104
128
}
105
129
```
106
130
107
-
## Example: Allow SSH traffic from a specific subnet
131
+
## Example: Deny all SSH traffic from the internet
132
+
133
+
The following Python snippet shows how to configure the SSH endpoint on compute nodes in a Linux pool to deny all internet traffic. The endpoint uses a frontend pool of ports in the range *4000 - 4100*.
108
134
109
-
The following Python snippet shows how to configure the SSH endpoint on compute nodes in a Linux pool to allow access only from the subnet *192.168.1.0/24*. The second NSG rule denies traffic that does not match the subnet.
135
+
> [!NOTE]
136
+
> As of Batch API version `2024-07-01`, port 22 typically associated with SSH is no longer mapped by default.
137
+
> Creating an explicit deny rule is no longer required if access is not needed from the Internet for Batch pools
138
+
> created with this API version or later. You may still need to specify explicit deny rules to restrict access
- Learn about the [Batch service workflow and primary resources](batch-service-workflow-features.md) such as pools, nodes, jobs, and tasks.
145
-
- For more information about NSG rules in Azure, see [Filter network traffic with network security groups](../virtual-network/network-security-groups-overview.md).
170
+
- For more information about NSG rules in Azure, see [Filter network traffic with network security groups](../virtual-network/network-security-groups-overview.md).
0 commit comments