Skip to content

Commit e5e8a82

Browse files
jborsecnikjborsecnik
authored
Merge pull request #189131 from spelluru/sbusdefaultaction0218
defaultAction & publicNetworkAccess
2 parents 1f36c10 + a9709e2 commit e5e8a82

File tree

2 files changed

+101
-63
lines changed

2 files changed

+101
-63
lines changed

‎articles/service-bus-messaging/service-bus-ip-filtering.md

Lines changed: 68 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Configure IP firewall rules for Azure Service Bus
33
description: How to use Firewall Rules to allow connections from specific IP addresses to Azure Service Bus.
44
ms.topic: article
5-
ms.date: 01/04/2022
5+
ms.date: 02/18/2022
66
---
77

88
# Allow access to Azure Service Bus namespace from specific IP addresses or ranges
@@ -11,7 +11,7 @@ By default, Service Bus namespaces are accessible from internet as long as the r
1111
This feature is helpful in scenarios in which Azure Service Bus should be only accessible from certain well-known sites. Firewall rules enable you to configure rules to accept traffic originating from specific IPv4 addresses. For example, if you use Service Bus with [Azure Express Route][express-route], you can create a **firewall rule** to allow traffic from only your on-premises infrastructure IP addresses or addresses of a corporate NAT gateway.
1212

1313
## IP firewall rules
14-
The IP firewall rules are applied at the Service Bus namespace level. Therefore, the rules apply to all connections from clients using any supported protocol. Any connection attempt from an IP address that does not match an allowed IP rule on the Service Bus namespace is rejected as unauthorized. The response does not mention the IP rule. IP filter rules are applied in order, and the first rule that matches the IP address determines the accept or reject action.
14+
The IP firewall rules are applied at the Service Bus namespace level. Therefore, the rules apply to all connections from clients using any supported protocol. Any connection attempt from an IP address that doesn't match an allowed IP rule on the Service Bus namespace is rejected as unauthorized. The response doesn't mention the IP rule. IP filter rules are applied in order, and the first rule that matches the IP address determines the accept or reject action.
1515

1616
## Important points
1717
- Firewalls and Virtual Networks are supported only in the **premium** tier of Service Bus. If upgrading to the **premier** tier isn't an option, we recommend that you keep the Shared Access Signature (SAS) token secure and share with only authorized users. For information about SAS authentication, see [Authentication and authorization](service-bus-authentication-and-authorization.md#shared-access-signature).
@@ -40,7 +40,7 @@ This section shows you how to use the Azure portal to create IP firewall rules f
4040
> If you choose **Selected networks**, add at least one IP firewall rule or a virtual network that will have access to the namespace. Choose **Disabled** if you want to restrict all traffic to this namespace over [private endpoints](private-link-service.md) only.
4141
4242
:::image type="content" source="./media/service-bus-ip-filtering/selected-networks.png" alt-text="Networking page with the selected networks option selected." lightbox="./media/service-bus-ip-filtering/selected-networks.png":::
43-
- **All networks** (default). This option enables public access from all networks using an access key. If you select the **All networks** option, the event hub accepts connections from any IP address (using the access key). This setting is equivalent to a rule that accepts the 0.0.0.0/0 IP address range.
43+
- **All networks** (default). This option enables public access from all networks using an access key. If you select the **All networks** option, Service Bus accepts connections from any IP address (using the access key). This setting is equivalent to a rule that accepts the 0.0.0.0/0 IP address range.
4444

4545
:::image type="content" source="./media/service-bus-ip-filtering/firewall-all-networks-selected.png" alt-text="Screenshot of the Azure portal Networking page. The option to allow access from All networks is selected on the Firewalls and virtual networks tab.":::
4646
1. To allow access from only specified IP address, select the **Selected networks** option if it isn't already selected. In the **Firewall** section, follow these steps:
@@ -64,76 +64,90 @@ This section has a sample Azure Resource Manager template that adds a virtual ne
6464

6565
**ipMask** is a single IPv4 address or a block of IP addresses in CIDR notation. For example, in CIDR notation 70.37.104.0/24 represents the 256 IPv4 addresses from 70.37.104.0 to 70.37.104.255, with 24 indicating the number of significant prefix bits for the range.
6666

67-
When adding virtual network or firewalls rules, set the value of `defaultAction` to `Deny`.
67+
> [!NOTE]
68+
> The default value of the `defaultAction` is `Allow`. When adding virtual network or firewalls rules, make sure you set the `defaultAction` to `Deny`.
6869
6970

7071
```json
7172
{
72-
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
73+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
7374
"contentVersion": "1.0.0.0",
7475
"parameters": {
75-
"servicebusNamespaceName": {
76-
"type": "string",
77-
"metadata": {
78-
"description": "Name of the Service Bus namespace"
76+
"serviceBusNamespaceName": {
77+
"defaultValue": "contososbusns",
78+
"type": "String"
7979
}
80-
},
81-
"location": {
82-
"type": "string",
83-
"metadata": {
84-
"description": "Location for Namespace"
85-
}
86-
}
87-
},
88-
"variables": {
89-
"namespaceNetworkRuleSetName": "[concat(parameters('servicebusNamespaceName'), concat('/', 'default'))]",
9080
},
81+
"variables": {},
9182
"resources": [
92-
{
93-
"apiVersion": "2018-01-01-preview",
94-
"name": "[parameters('servicebusNamespaceName')]",
95-
"type": "Microsoft.ServiceBus/namespaces",
96-
"location": "[parameters('location')]",
97-
"sku": {
98-
"name": "Premium",
99-
"tier": "Premium"
100-
},
101-
"properties": { }
102-
},
103-
{
104-
"apiVersion": "2018-01-01-preview",
105-
"name": "[variables('namespaceNetworkRuleSetName')]",
106-
"type": "Microsoft.ServiceBus/namespaces/networkrulesets",
107-
"dependsOn": [
108-
"[concat('Microsoft.ServiceBus/namespaces/', parameters('servicebusNamespaceName'))]"
109-
],
110-
"properties": {
111-
"virtualNetworkRules": [<YOUR EXISTING VIRTUAL NETWORK RULES>],
112-
"ipRules":
113-
[
114-
{
115-
"ipMask":"10.1.1.1",
116-
"action":"Allow"
83+
{
84+
"type": "Microsoft.ServiceBus/namespaces",
85+
"apiVersion": "2021-06-01-preview",
86+
"name": "[parameters('serviceBusNamespaceName')]",
87+
"location": "East US",
88+
"sku": {
89+
"name": "Premium",
90+
"tier": "Premium",
91+
"capacity": 1
11792
},
118-
{
119-
"ipMask":"11.0.0.0/24",
120-
"action":"Allow"
93+
"properties": {
94+
"disableLocalAuth": false,
95+
"zoneRedundant": true
96+
}
97+
},
98+
{
99+
"type": "Microsoft.ServiceBus/namespaces/networkRuleSets",
100+
"apiVersion": "2021-06-01-preview",
101+
"name": "[concat(parameters('serviceBusNamespaceName'), '/default')]",
102+
"location": "East US",
103+
"dependsOn": [
104+
"[resourceId('Microsoft.ServiceBus/namespaces', parameters('serviceBusNamespaceName'))]"
105+
],
106+
"properties": {
107+
"publicNetworkAccess": "Enabled",
108+
"defaultAction": "Allow",
109+
"virtualNetworkRules": [],
110+
"ipRules": [
111+
{
112+
"ipMask":"10.1.1.1",
113+
"action":"Allow"
114+
},
115+
{
116+
"ipMask":"11.0.0.0/24",
117+
"action":"Allow"
118+
}
119+
]
121120
}
122-
],
123-
"trustedServiceAccessEnabled": false,
124-
"defaultAction": "Deny"
125121
}
126-
}
127-
],
128-
"outputs": { }
129-
}
122+
]
123+
}
130124
```
131125

132126
To deploy the template, follow the instructions for [Azure Resource Manager][lnk-deploy].
133127

134128
> [!IMPORTANT]
135129
> If there are no IP and virtual network rules, all the traffic flows into the namespace even if you set the `defaultAction` to `deny`. The namespace can be accessed over the public internet (using the access key). Specify at least one IP rule or virtual network rule for the namespace to allow traffic only from the specified IP addresses or subnet of a virtual network.
136130
131+
## default action and public network access
132+
133+
### REST API
134+
135+
The default value of the `defaultAction` property was `Deny` for API version **2021-01-01-preview and earlier**. However, the deny rule isn't enforced unless you set IP filters or virtual network (VNet) rules. That is, if you didn't have any IP filters or VNet rules, it's treated as `Allow`.
136+
137+
From API version **2021-06-01-preview onwards**, the default value of the `defaultAction` property is `Allow`, to accurately reflect the service-side enforcement. If the default action is set to `Deny`, IP filters and VNet rules are enforced. If the default action is set to `Allow`, IP filters and VNet rules aren't enforced. The service remembers the rules when you turn them off and then back on again.
138+
139+
The API version **2021-06-01-preview onwards** also introduces a new property named `publicNetworkAccess`. If it's set to `Disabled`, operations are restricted to private links only. If it's set to `Enabled`, operations are allowed over the public internet.
140+
141+
For more information about these properties, see [Create or Update Network Rule Set](/rest/api/servicebus/preview/namespaces-network-rule-set/create-or-update-network-rule-set) and [Create or Update Private Endpoint Connections](/rest/api/servicebus/preview/private-endpoint-connections/create-or-update).
142+
143+
> [!NOTE]
144+
> None of the above settings bypass validation of claims via SAS or Azure AD authentication. The authentication check always runs after the service validates the network checks that are configured by `defaultAction`, `publicNetworkAccess`, `privateEndpointConnections` settings.
145+
146+
### Azure portal
147+
148+
Azure portal always uses the latest API version to get and set properties. If you had previously configured your namespace using **2021-01-01-preview and earlier** with `defaultAction` set to `Deny`, and specified zero IP filters and VNet rules, the portal would have previously checked **Selected Networks** on the **Networking** page of your namespace. Now, it checks the **All networks** option.
149+
150+
:::image type="content" source="./media/service-bus-ip-filtering/firewall-all-networks-selected.png" alt-text="Screenshot of the Azure portal Networking page. The option to allow access from All networks is selected on the Firewalls and virtual networks tab.":::
137151

138152
## Next steps
139153

0 commit comments

Comments
 (0)