Skip to content

Commit e23f3b9

Browse files
Court72Court72
authored
Merge pull request #134407 from vhorne/fw-hybrid
updates for portal changes
2 parents 406fbda + 954e5d2 commit e23f3b9

File tree

1 file changed

+90
-80
lines changed

1 file changed

+90
-80
lines changed

‎articles/firewall/tutorial-hybrid-portal.md

Lines changed: 90 additions & 80 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ services: firewall
55
author: vhorne
66
ms.service: firewall
77
ms.topic: tutorial
8-
ms.date: 03/24/2020
8+
ms.date: 10/19/2020
99
ms.author: victorh
1010
customer intent: As an administrator, I want to control network access from an on-premises network to an Azure virtual network.
1111
---
@@ -70,11 +70,11 @@ First, create the resource group to contain the resources for this tutorial:
7070

7171
1. Sign in to the Azure portal at [https://portal.azure.com](https://portal.azure.com).
7272
2. On the Azure portal home page, select **Resource groups** > **Add**.
73-
3. For **Resource group name**, type **FW-Hybrid-Test**.
74-
4. For **Subscription**, select your subscription.
75-
5. For **Region**, select **East US**. All resources that you create later must be in the same location.
76-
6. Select **Review + Create**.
77-
7. Select **Create**.
73+
3. For **Subscription**, select your subscription.
74+
1. For **Resource group name**, type **FW-Hybrid-Test**.
75+
2. For **Region**, select **(US) East US**. All resources that you create later must be in the same location.
76+
3. Select **Review + Create**.
77+
4. Select **Create**.
7878

7979
Now, create the VNet:
8080

@@ -83,65 +83,73 @@ Now, create the VNet:
8383
8484
1. From the Azure portal home page, select **Create a resource**.
8585
2. Under **Networking**, select **Virtual network**.
86-
4. For **Name**, type **VNet-hub**.
87-
5. For **Address space**, type **10.5.0.0/16**.
88-
6. For **Subscription**, select your subscription.
8986
7. For **Resource group**, select **FW-Hybrid-Test**.
90-
8. For **Location**, select **East US**.
91-
9. Under **Subnet**, for **Name** type **AzureFirewallSubnet**. The firewall will be in this subnet, and the subnet name **must** be AzureFirewallSubnet.
92-
10. For **Address range**, type **10.5.0.0/26**.
93-
11. Accept the other default settings, and then select **Create**.
87+
1. For **Name**, type **VNet-hub**.
88+
2. Select **Next: IP Addresses**.
89+
3. For **IPv4 Address space**, type **10.5.0.0/16**.
90+
6. Under **Subnet name**, select **default**.
91+
7. for **Name** type **AzureFirewallSubnet**. The firewall will be in this subnet, and the subnet name **must** be AzureFirewallSubnet.
92+
8. For **Address range**, type **10.5.0.0/26**.
93+
9. Select **Save**.
94+
10. Select **Review + create**.
95+
11. Select **Create**.
9496

9597
## Create the spoke virtual network
9698

9799
1. From the Azure portal home page, select **Create a resource**.
98-
2. Under **Networking**, select **Virtual network**.
99-
4. For **Name**, type **VNet-Spoke**.
100-
5. For **Address space**, type **10.6.0.0/16**.
101-
6. For **Subscription**, select your subscription.
100+
2. In **Networking**, select **Virtual network**.
102101
7. For **Resource group**, select **FW-Hybrid-Test**.
103-
8. For **Location**, select the same location that you used previously.
104-
9. Under **Subnet**, for **Name** type **SN-Workload**.
105-
10. For **Address range**, type **10.6.0.0/24**.
106-
11. Accept the other default settings, and then select **Create**.
102+
1. For **Name**, type **VNet-Spoke**.
103+
2. For **Region**, select **(US) East US**.
104+
3. Select **Next: IP Addresses**.
105+
4. For **IPv4 address space**, type **10.6.0.0/16**.
106+
6. Under **Subnet name**, select **default**.
107+
7. for **Name** type **SN-Workload**.
108+
8. For **Address range**, type **10.6.0.0/24**.
109+
9. Select **Save**.
110+
10. Select **Review + create**.
111+
11. Select **Create**.
107112

108113
## Create the on-premises virtual network
109114

110115
1. From the Azure portal home page, select **Create a resource**.
111-
2. Under **Networking**, select **Virtual network**.
112-
4. For **Name**, type **VNet-OnPrem**.
113-
5. For **Address space**, type **192.168.0.0/16**.
114-
6. For **Subscription**, select your subscription.
116+
2. In **Networking**, select **Virtual network**.
115117
7. For **Resource group**, select **FW-Hybrid-Test**.
116-
8. For **Location**, select the same location that you used previously.
117-
9. Under **Subnet**, for **Name** type **SN-Corp**.
118-
10. For **Address range**, type **192.168.1.0/24**.
119-
11. Accept the other default settings, and then select **Create**.
118+
1. For **Name**, type **VNet-OnPrem**.
119+
2. For **Region**, select **(US) East US**.
120+
3. Select **Next : IP Addresses**
121+
4. For **IPv4 address space**, type **192.168.0.0/16**.
122+
5. Under **Subnet name**, select **default**.
123+
7. for **Name** type **SN-Corp**.
124+
8. For **Address range**, type **192.168.1.0/24**.
125+
9. Select **Save**.
126+
10. Select **Review + create**.
127+
11. Select **Create**.
120128

121129
Now create a second subnet for the gateway.
122130

123131
1. On the **VNet-Onprem** page, select **Subnets**.
124132
2. Select **+Subnet**.
125133
3. For **Name**, type **GatewaySubnet**.
126-
4. For **Address range (CIDR block)** type **192.168.2.0/24**.
134+
4. For **Subnet address range** type **192.168.2.0/24**.
127135
5. Select **OK**.
128136

129137
## Configure and deploy the firewall
130138

131139
Now deploy the firewall into the firewall hub virtual network.
132140

133141
1. From the Azure portal home page, select **Create a resource**.
134-
2. In the left column, select **Networking**, and then select **Firewall**.
142+
2. In the left column, select **Networking**, and search for and then select **Firewall**.
135143
4. On the **Create a Firewall** page, use the following table to configure the firewall:
136144

137145
|Setting |Value |
138146
|---------|---------|
139147
|Subscription |\<your subscription\>|
140148
|Resource group |**FW-Hybrid-Test** |
141149
|Name |**AzFW01**|
142-
|Location |Select the same location that you used previously|
150+
|Region |**East US**|
143151
|Choose a virtual network |**Use existing**:<br> **VNet-hub**|
144-
|Public IP address |Create new: <br>**Name** - **fw-pip**. |
152+
|Public IP address |Add new: <br>**fw-pip**. |
145153

146154
5. Select **Review + create**.
147155
6. Review the summary, and then select **Create** to create the firewall.
@@ -164,8 +172,9 @@ First, add a network rule to allow web traffic.
164172
7. For **Protocol**, select **TCP**.
165173
8. For **Source type**, select **IP address**.
166174
9. For **Source**, type **192.168.1.0/24**.
167-
10. For **Destination address**, type **10.6.0.0/16**
168-
11. For **Destination Ports**, type **80**.
175+
10. For **Destination type**, select **IP address**.
176+
11. For **Destination address**, type **10.6.0.0/16**
177+
12. For **Destination Ports**, type **80**.
169178

170179
Now add a rule to allow RDP traffic.
171180

@@ -175,9 +184,10 @@ On the second rule row, type the following information:
175184
2. For **Protocol**, select **TCP**.
176185
3. For **Source type**, select **IP address**.
177186
4. For **Source**, type **192.168.1.0/24**.
178-
5. For **Destination address**, type **10.6.0.0/16**
179-
6. For **Destination Ports**, type **3389**.
180-
7. Select **Add**.
187+
5. For **Destination type**, select **IP address**.
188+
6. For **Destination address**, type **10.6.0.0/16**
189+
7. For **Destination Ports**, type **3389**.
190+
8. Select **Add**.
181191

182192
## Create and connect the VPN gateways
183193

@@ -188,7 +198,7 @@ The hub and on-premises virtual networks are connected via VPN gateways.
188198
Now create the VPN gateway for the hub virtual network. Network-to-network configurations require a RouteBased VpnType. Creating a VPN gateway can often take 45 minutes or more, depending on the selected VPN gateway SKU.
189199

190200
1. From the Azure portal home page, select **Create a resource**.
191-
2. In the search text box, type **virtual network gateway** and press **Enter**.
201+
2. In the search text box, type **virtual network gateway**.
192202
3. Select **Virtual network gateway**, and select **Create**.
193203
4. For **Name**, type **GW-hub**.
194204
5. For **Region**, select the same region that you used previously.
@@ -237,7 +247,7 @@ Create the on-premises to hub virtual network connection. This step is similar t
237247
1. Open the **FW-Hybrid-Test** resource group and select the **GW-Onprem** gateway.
238248
2. Select **Connections** in the left column.
239249
3. Select **Add**.
240-
4. The the connection name, type **Onprem-to-Hub**.
250+
4. For the connection name, type **Onprem-to-Hub**.
241251
5. Select **VNet-to-VNet** for **Connection type**.
242252
6. For the **Second virtual network gateway**, select **GW-hub**.
243253
7. For **Shared key (PSK)**, type **AzureA1b2C3**.
@@ -284,56 +294,56 @@ Next, create a couple routes:
284294
2. In the search text box, type **route table** and press **Enter**.
285295
3. Select **Route table**.
286296
4. Select **Create**.
287-
5. For the name, type **UDR-Hub-Spoke**.
288297
6. Select the **FW-Hybrid-Test** for the resource group.
289-
8. For **Location**, select the same location that you used previously.
290-
9. Select **Create**.
291-
10. After the route table is created, select it to open the route table page.
292-
11. Select **Routes** in the left column.
293-
12. Select **Add**.
294-
13. For the route name, type **ToSpoke**.
295-
14. For the address prefix, type **10.6.0.0/16**.
296-
15. For next hop type, select **Virtual appliance**.
297-
16. For next hop address, type the firewall's private IP address that you noted earlier.
298-
17. Select **OK**.
298+
8. For **Region**, select the same location that you used previously.
299+
1. For the name, type **UDR-Hub-Spoke**.
300+
9. Select **Review + Create**.
301+
10. Select **Create**.
302+
11. After the route table is created, select it to open the route table page.
303+
12. Select **Routes** in the left column.
304+
13. Select **Add**.
305+
14. For the route name, type **ToSpoke**.
306+
15. For the address prefix, type **10.6.0.0/16**.
307+
16. For next hop type, select **Virtual appliance**.
308+
17. For next hop address, type the firewall's private IP address that you noted earlier.
309+
18. Select **OK**.
299310

300311
Now associate the route to the subnet.
301312

302313
1. On the **UDR-Hub-Spoke - Routes** page, select **Subnets**.
303314
2. Select **Associate**.
304-
3. Select **Choose a virtual network**.
305-
4. Select **VNet-hub**.
306-
5. Select **GatewaySubnet**.
307-
6. Select **OK**.
315+
3. Under **Virtual network**, select **VNet-hub**.
316+
1. Under **Subnet**, select **GatewaySubnet**.
317+
2. Select **OK**.
308318

309319
Now create the default route from the spoke subnet.
310320

311321
1. From the Azure portal home page, select **Create a resource**.
312322
2. In the search text box, type **route table** and press **Enter**.
313323
3. Select **Route table**.
314324
5. Select **Create**.
315-
6. For the name, type **UDR-DG**.
316325
7. Select the **FW-Hybrid-Test** for the resource group.
317-
8. For **Location**, select the same location that you used previously.
318-
4. For **Virtual network gateway route propagation**, select **Disabled**.
319-
1. Select **Create**.
320-
2. After the route table is created, select it to open the route table page.
321-
3. Select **Routes** in the left column.
322-
4. Select **Add**.
323-
5. For the route name, type **ToHub**.
324-
6. For the address prefix, type **0.0.0.0/0**.
325-
7. For next hop type, select **Virtual appliance**.
326-
8. For next hop address, type the firewall's private IP address that you noted earlier.
327-
9. Select **OK**.
326+
8. For **Region**, select the same location that you used previously.
327+
1. For the name, type **UDR-DG**.
328+
4. For **Propagate gateway route**, select **No**.
329+
5. Select **Review + Create**.
330+
6. Select **Create**.
331+
7. After the route table is created, select it to open the route table page.
332+
8. Select **Routes** in the left column.
333+
9. Select **Add**.
334+
10. For the route name, type **ToHub**.
335+
11. For the address prefix, type **0.0.0.0/0**.
336+
12. For next hop type, select **Virtual appliance**.
337+
13. For next hop address, type the firewall's private IP address that you noted earlier.
338+
14. Select **OK**.
328339

329340
Now associate the route to the subnet.
330341

331342
1. On the **UDR-DG - Routes** page, select **Subnets**.
332343
2. Select **Associate**.
333-
3. Select **Choose a virtual network**.
334-
4. Select **VNet-spoke**.
335-
5. Select **SN-Workload**.
336-
6. Select **OK**.
344+
3. Under **Virtual network**, select **VNet-spoke**.
345+
1. Under **Subnet**, select **SN-Workload**.
346+
2. Select **OK**.
337347

338348
## Create virtual machines
339349

@@ -349,15 +359,15 @@ Create a virtual machine in the spoke virtual network, running IIS, with no publ
349359
- **Resource group** - Select **FW-Hybrid-Test**.
350360
- **Virtual machine name**: *VM-Spoke-01*.
351361
- **Region** - Same region that you're used previously.
352-
- **User name**: *azureuser*.
353-
- **Password**: *Azure123456!*
362+
- **User name**: \<type a user name\>.
363+
- **Password**: \<type a password\>
364+
4. For **Public inbound ports**, select **Allow selected ports**, and then select **HTTP (80)**, and **RDP (3389)**
354365
4. Select **Next:Disks**.
355366
5. Accept the defaults and select **Next: Networking**.
356367
6. Select **VNet-Spoke** for the virtual network and the subnet is **SN-Workload**.
357-
7. For **Public IP**, select **None**.
358-
8. For **Public inbound ports**, select **Allow selected ports**, and then select **HTTP (80)**, and **RDP (3389)**
368+
7. For **Public IP**, select **None**.
359369
9. Select **Next:Management**.
360-
10. For **Boot diagnostics**, Select **Off**.
370+
10. For **Boot diagnostics**, Select **Disable**.
361371
11. Select **Review+Create**, review the settings on the summary page, and then select **Create**.
362372

363373
### Install IIS
@@ -387,14 +397,14 @@ This is a virtual machine that you use to connect using Remote Desktop to the pu
387397
- **Resource group** - Select existing, and then select **FW-Hybrid-Test**.
388398
- **Virtual machine name** - *VM-Onprem*.
389399
- **Region** - Same region that you're used previously.
390-
- **User name**: *azureuser*.
391-
- **Password**: *Azure123456!*.
400+
- **User name**: \<type a user name\>.
401+
- **Password**: \<type a user password\>.
402+
7. For **Public inbound ports**, select **Allow selected ports**, and then select **RDP (3389)**
392403
4. Select **Next:Disks**.
393404
5. Accept the defaults and select **Next:Networking**.
394405
6. Select **VNet-Onprem** for virtual network and the subnet is **SN-Corp**.
395-
7. For **Public inbound ports**, select **Allow selected ports**, and then select **RDP (3389)**
396406
8. Select **Next:Management**.
397-
9. For **Boot diagnostics**, Select **Off**.
407+
10. For **Boot diagnostics**, Select **Disable**.
398408
10. Select **Review+Create**, review the settings on the summary page, and then select **Create**.
399409

400410
## Test the firewall

0 commit comments

Comments
 (0)