Skip to content

Commit e8c10bd

Browse files
megvanhuygenmegvanhuygen
authored
Merge pull request #107752 from wmgries/afs-service-tags
Enhance service tag section for AFS
2 parents 4cfc156 + 436ef7f commit e8c10bd

File tree

1 file changed

+114
-47
lines changed

1 file changed

+114
-47
lines changed

‎articles/storage/files/storage-sync-files-firewall-and-proxy.md

Lines changed: 114 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -141,53 +141,120 @@ For business continuity and disaster recovery (BCDR) reasons you may have specif
141141
> - https:\//tm-kailani.one.microsoft.com (discovery URL of the primary region)
142142
143143
### Allow list for Azure File Sync IP addresses
144-
If your on-premises firewall requires adding specific IP addresses to an allow list to connect to Azure File Sync, you can add the following IP address ranges based on the regions that you are connecting to.
145-
146-
| Region | IP address ranges |
147-
|--------|-------------------|
148-
| Central US | 52.176.149.179/32, 20.37.157.80/29 |
149-
| East US 2 | 40.123.47.110/32, 20.41.5.144/29 |
150-
| East US | 104.41.148.238/32, 20.42.4.248/29 |
151-
| North Central US | 65.52.62.167/32, 40.80.188.24/29 |
152-
| South Central US | 104.210.219.252/32, 13.73.248.112/29 |
153-
| West US 2 | 52.183.27.204/32, 20.42.131.224/29 |
154-
| West Central US | 52.161.25.233/32, 52.150.139.104/29 |
155-
| West US | 40.112.150.67/32, 40.82.253.192/29 |
156-
| Canada Central | 52.228.42.41/32, 52.228.81.248/29 |
157-
| Canada East | 52.235.36.119/32, 40.89.17.232/29 |
158-
| Brazil South | 191.237.253.115/32, 191.235.225.216/29 |
159-
| North Europe | 40.113.94.67/32, 20.38.85.152/29 |
160-
| West Europe | 104.40.191.8/32, 20.50.1.0/29 |
161-
| France Central | 52.143.166.54/32, 20.43.42.8/29 |
162-
| France South | 52.136.131.99/32, 51.105.88.248/29 |
163-
| UK South | 51.140.67.72/32, 51.104.25.224/29 |
164-
| UK West | 51.140.202.34/32, 51.137.161.240/29 |
165-
| Switzerland North | 51.107.48.224/29 |
166-
| Switzerland West | 51.107.144.216/29 |
167-
| Norway West | 51.120.224.216/29 |
168-
| Norway East | 51.120.40.224/29 |
169-
| East Asia | 23.102.225.54/32, 20.189.108.56/29 |
170-
| Southeast Asia | 13.76.81.46/32, 20.43.131.40/29 |
171-
| Australia Central | 20.37.224.216/29 |
172-
| Australia Central 2 | 20.36.120.216/29 |
173-
| Australia East | 13.75.153.240/32, 20.37.195.96/29 |
174-
| Australia Southeast | 13.70.176.196/32, 20.42.227.128/29 |
175-
| South India | 104.211.231.18/32, 20.41.193.160/29 |
176-
| West India | 52.136.48.216/29 |
177-
| Japan East | 104.41.161.113/32, 20.43.66.0/29 |
178-
| Japan West | 23.100.106.151/32, 40.80.57.192/29 |
179-
| Korea Central | 52.231.67.75/32, 20.41.65.184/29 |
180-
| Korea South | 52.231.159.38/32, 40.80.169.176/29 |
181-
| US DoD East | 20.140.72.152/29 |
182-
| US Gov Arizona | 20.140.64.152/29 |
183-
| US Gov Arizona | 52.244.75.224/32, 52.244.79.140/32 |
184-
| US Gov Iowa | 52.244.79.140/32, 52.244.75.224/32 |
185-
| US Gov Texas | 52.238.166.107/32, 52.238.79.29/32 |
186-
| US Gov Virginia | 13.72.17.152/32, 52.227.153.92/32 |
187-
| South Africa North | 102.133.175.72/32 |
188-
| South Africa West | 102.133.75.173/32, 102.133.56.128/29, 20.140.48.216/29 |
189-
| UAE Central | 20.45.71.151/32, 20.37.64.216/29, 20.140.48.216/29 |
190-
| UAE North | 40.123.216.130/32, 20.38.136.224/29, 20.140.56.136/29 |
144+
Azure File Sync supports the use of [service tags](../../virtual-network/service-tags-overview.md), which represent a group of IP address prefixes for a given Azure service. You can use service tags to create firewall rules that enable communication with the Azure File Sync service. The service tag for Azure File Sync is `StorageSyncService`.
145+
146+
If you are using Azure File Sync within Azure, you can use name of service tag directly in your network security group to allow traffic. To learn more about how to do this, see [Network security groups](../../virtual-network/security-overview.md).
147+
148+
If you are using Azure File Sync on-premises, you can use the service tag API to get specific IP address ranges for your firewall's allow list. There are two methods for getting this information:
149+
150+
- The current list of IP address ranges for all Azure services supporting service tags are published weekly on the Microsoft Download Center in the form of a JSON document. Each Azure cloud has its own JSON document with the IP address ranges relevant for that cloud:
151+
- [Azure Public](https://www.microsoft.com/download/details.aspx?id=56519)
152+
- [Azure US Government](https://www.microsoft.com/download/details.aspx?id=57063)
153+
- [Azure China](https://www.microsoft.com/download/details.aspx?id=57062)
154+
- [Azure Germany](https://www.microsoft.com/download/details.aspx?id=57064)
155+
- The service tag discovery API (preview) allows programmatic retrieval of the current list of service tags. In preview, the service tag discovery API may return information that's less current than information returned from the JSON documents published on the Microsoft Download Center. You can use the API surface based on your automation preference:
156+
- [REST API](https://docs.microsoft.com/rest/api/virtualnetwork/servicetags/list)
157+
- [Azure PowerShell](https://docs.microsoft.com/powershell/module/az.network/Get-AzNetworkServiceTag)
158+
- [Azure CLI](https://docs.microsoft.com/cli/azure/network#az-network-list-service-tags)
159+
160+
Because the service tag discovery API is not updated as frequently as the JSON documents published to the Microsoft Download Center, we recommend using the JSON document to update your on-premises firewall's allow list. This can be done as follows:
161+
162+
```PowerShell
163+
# The specific region to get the IP address ranges for. Replace westus2 with the desired region code
164+
# from Get-AzLocation.
165+
$region = "westus2"
166+
167+
# The service tag for Azure File Sync. Do not change unless you're adapting this
168+
# script for another service.
169+
$serviceTag = "StorageSyncService"
170+
171+
# Download date is the string matching the JSON document on the Download Center.
172+
$possibleDownloadDates = 0..7 | `
173+
ForEach-Object { [System.DateTime]::Now.AddDays($_ * -1).ToString("yyyyMMdd") }
174+
175+
# Verify the provided region
176+
$validRegions = Get-AzLocation | `
177+
Where-Object { $_.Providers -contains "Microsoft.StorageSync" } | `
178+
Select-Object -ExpandProperty Location
179+
180+
if ($validRegions -notcontains $region) {
181+
Write-Error `
182+
-Message "The specified region $region is not available. Either Azure File Sync is not deployed there or the region does not exist." `
183+
-ErrorAction Stop
184+
}
185+
186+
# Get the Azure cloud. This should automatically based on the context of
187+
# your Az PowerShell login, however if you manually need to populate, you can find
188+
# the correct values using Get-AzEnvironment.
189+
$azureCloud = Get-AzContext | `
190+
Select-Object -ExpandProperty Environment | `
191+
Select-Object -ExpandProperty Name
192+
193+
# Build the download URI
194+
$downloadUris = @()
195+
switch($azureCloud) {
196+
"AzureCloud" {
197+
$downloadUris = $possibleDownloadDates | ForEach-Object {
198+
"https://download.microsoft.com/download/7/1/D/71D86715-5596-4529-9B13-DA13A5DE5B63/ServiceTags_Public_$_.json"
199+
}
200+
}
201+
202+
"AzureUSGovernment" {
203+
$downloadUris = $possibleDownloadDates | ForEach-Object {
204+
"https://download.microsoft.com/download/6/4/D/64DB03BF-895B-4173-A8B1-BA4AD5D4DF22/ServiceTags_AzureGovernment_$_.json"
205+
}
206+
}
207+
208+
"AzureChinaCloud" {
209+
$downloadUris = $possibleDownloadDates | ForEach-Object {
210+
"https://download.microsoft.com/download/9/D/0/9D03B7E2-4B80-4BF3-9B91-DA8C7D3EE9F9/ServiceTags_China_$_.json"
211+
}
212+
}
213+
214+
"AzureGermanCloud" {
215+
$downloadUris = $possibleDownloadDates | ForEach-Object {
216+
"https://download.microsoft.com/download/0/7/6/076274AB-4B0B-4246-A422-4BAF1E03F974/ServiceTags_AzureGermany_$_.json"
217+
}
218+
}
219+
220+
default {
221+
Write-Error -Message "Unrecognized Azure Cloud: $_" -ErrorAction Stop
222+
}
223+
}
224+
225+
# Find most recent file
226+
$found = $false
227+
foreach($downloadUri in $downloadUris) {
228+
try { $response = Invoke-WebRequest -Uri $downloadUri -UseBasicParsing } catch { }
229+
if ($response.StatusCode -eq 200) {
230+
$found = $true
231+
break
232+
}
233+
}
234+
235+
if ($found) {
236+
# Get the raw JSON
237+
$content = [System.Text.Encoding]::UTF8.GetString($response.Content)
238+
239+
# Parse the JSON
240+
$serviceTags = ConvertFrom-Json -InputObject $content -Depth 100
241+
242+
# Get the specific $ipAddressRanges
243+
$ipAddressRanges = $serviceTags | `
244+
Select-Object -ExpandProperty values | `
245+
Where-Object { $_.id -eq "$serviceTag.$region" } | `
246+
Select-Object -ExpandProperty properties | `
247+
Select-Object -ExpandProperty addressPrefixes
248+
} else {
249+
# If the file cannot be found, that means there hasn't been an update in
250+
# more than a week. Please verify the download URIs are still accurate
251+
# by checking https://docs.microsoft.com/azure/virtual-network/service-tags-overview
252+
Write-Verbose -Message "JSON service tag file not found."
253+
return
254+
}
255+
```
256+
257+
You can then use the IP address ranges in `$ipAddressRanges` to update your firewall. Check your firewall/network appliance's website for information on how to update your firewall.
191258

192259
## Test network connectivity to service endpoints
193260
Once a server is registered with the Azure File Sync service, the Test-StorageSyncNetworkConnectivity cmdlet and ServerRegistration.exe can be used to test communications with all endpoints (URLs) specific to this server. This cmdlet can help troubleshoot when incomplete communication prevents the server from fully working with Azure File Sync and it can be used to fine tune proxy and firewall configurations.

0 commit comments

Comments
 (0)