You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/route-server/troubleshoot-route-server.md
+8Lines changed: 8 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -95,6 +95,14 @@ Azure Route Server drops routes with an ASN of 0 in the AS-Path. To ensure these
95
95
96
96
When you advertise the same routes from your on-premises network to Azure over multiple ExpressRoute connections, normally ECMP is enabled by default for the traffic destined for these routes from Azure back to your on-premises network. Currently, when you deploy the Route Server, multiple-path information is lost in the BGP exchange between ExpressRoute and the Route Server, and consequently traffic from Azure will traverse only on one of the ExpressRoute connections.
97
97
98
+
## Operational Issues
99
+
100
+
### Why am I seeing an error about invalid scope and authorization to perform Route Server operations?
101
+
102
+
If you see an error in the below format, then please make sure you have the following permissions configured: [Route Server Roles and Permissions](roles-permissions.md#permissions)
103
+
104
+
Error message format: "The client with object id {} does not have authorization to perform action {} over scope {} or the scope is invalid. If access was recently granted, please refresh your credentials."
105
+
98
106
## Next step
99
107
100
108
To learn how to create and configure Azure Route Server, see:
description: Learn about roles and permissions for a Virtual WAN Hub.
5
5
author: siddomala
6
6
ms.service: azure-virtual-wan
7
-
ms.topic: concept-article
7
+
ms.topic: conceptual
8
8
ms.date: 12/13/2024
9
9
ms.author: cherylmc
10
10
@@ -16,7 +16,8 @@ Because of this, it's essential to verify permissions on all involved resources
16
16
17
17
## Azure built-in roles
18
18
19
-
You can choose to assign [Azure built-in roles](../role-based-access-control/built-in-roles.md) to a user, group, service principal, or managed identity such as [Network contributor](../role-based-access-control/built-in-roles.md#network-contributor), which support all the required permissions for creating the gateway.
19
+
You can choose to assign [Azure built-in roles](../role-based-access-control/built-in-roles.md) to a user, group, service principal, or managed identity such as [Network contributor](../role-based-access-control/built-in-roles.md#network-contributor), which support all the required permissions for creating resources related to Virtual WAN.
20
+
20
21
For more information, see [Steps to assign an Azure role](../role-based-access-control/role-assignments-steps.md).
21
22
22
23
## Custom roles
@@ -25,16 +26,107 @@ If the [Azure built-in roles](../role-based-access-control/built-in-roles.md) do
25
26
Just like built-in roles, you can assign custom roles to users, groups, and service principals at management group, subscription, and resource group scopes.
26
27
For more information, see [Steps to create a custom role](../role-based-access-control/custom-roles.md#steps-to-create-a-custom-role) .
27
28
28
-
To ensure proper functionality, check your custom role permissions to confirm user service principals, and managed identities operating the VPN gateway have the necessary permissions.
29
+
To ensure proper functionality, check your custom role permissions to confirm user service principals, and managed identities interacting with Virtual WAN have the necessary permissions.
29
30
To add any missing permissions listed here, see [Update a custom role](../role-based-access-control/custom-roles-portal.md#update-a-custom-role).
30
31
31
-
## Permissions
32
+
The following custom roles are a few example roles you can create in your tenant if you don't want to leverage more generic built-in roles such as Network Contributor or Contributor.
33
+
34
+
### Virtual WAN Administrator
35
+
36
+
The Virtual WAN Administrator role has the ability to perform all operations related to the Virtual Hub, including managing connections to Virtual WAN and configuring routing.
37
+
38
+
```
39
+
{
40
+
"Name": "Virtual WAN Administrator",
41
+
"IsCustom": true,
42
+
"Description": "Can perform all operations related to the Virtual WAN, including managing connections to Virtual WAN and configuring routing in each hub.",
Creating or updating Virtual WAN resources requires you to have the proper permission(s) to create that Virtual WAN resource type. In some scenarios, having permissions to create or update that resource type is sufficient. However, in many scenarios, updating a Virtual WAN resource that has a **reference** to another Azure resource requires you to have permissions over both the created resource **and** any referenced resources.
94
+
95
+
### Example 1
96
+
97
+
When a connection is created between a Virtual WAN hub and a spoke Virtual Network, Virtual WAN's control plane creates a Virtual Network peering between the Virtual WAN hub and your spoke Virtual Network. You can also specify the Virtual WAN route tables to which the Virtual Network connection is associating to or propagating to.
98
+
99
+
Therefore, to create a Virtual Network connection to the Virtual WAN hub, you must have the following permissions:
100
+
101
+
* Create a Hub Virtual Network connection (Microsoft.Network/virtualHubs/hubVirtualNetworkConnections/write)
102
+
* Create a Virtual Network peering with the spoke Virtual Network (Microsoft.Network/virtualNetworks/peer/action)
103
+
* Read the route table(s) that the Virtual Network connections are referencing (Microsoft.Network/virtualhubs/hubRouteTables/read)
32
104
33
-
When creating or updating the resources below, add the appropriate permissions from the following list:
105
+
If you want to associate an inbound or out-bound route map is associated with the Virtual Network connection, you need an additional permission:
106
+
107
+
* Read the route map(s) that is applied to the Virtual Network connection (Microsoft.Network/virtualHubs/routeMaps/read).
108
+
109
+
### Example 2
110
+
111
+
To create or modify routing intent, a routing intent resource is created with a reference to the next hop resources specified in the routing intent's routing policy. This means that to create or modify routing intent, you need permissions over any referenced Azure Firewall or Network Virtual Appliance resource(s).
112
+
113
+
If the next hop for a hub's private routing intent policy is a Network Virtual Appliance and the next hop for a hub's internet policy is an Azure Firewall, creating or updating a routing intent resource requires the following permissions.
* Reference (read) the Network Virtual Appliance resource (Microsoft.Network/networkVirtualAppliances/read)
117
+
* Reference (read) the Azure Firewall resource (Microsoft.Network/azureFirewalls)
118
+
119
+
In this example, you do **not** need permissions to read Microsoft.Network/securityPartnerProviders resources because the routing intent configured does not reference a third-party security provider resource.
120
+
121
+
## Additional permissions required due to referenced resources
122
+
123
+
The following section describes the set of possible permissions that are needed to create or modify Virtual WAN resources.
124
+
125
+
Depending on your Virtual WAN configuration, the user or service principal that is managing your Virtual WAN deployments may need all, a subset or none of the below permissions.
34
126
35
127
### Virtual hub resources
36
128
37
-
|Resource | Required Azure permissions |
129
+
|Resource | Required Azure permissions due to resource references |
NVAs (Network Virtual Appliances) in Virtual WAN are typically deployed through Azure managed applications or directly via NVA orchestration software. For more information on how to properly assign permissions to managed applications or NVA orchestration software, see instructions [here](https://aka.ms/nvadeployment).
65
158
66
-
|Resource | Required Azure permissions |
159
+
|Resource | Required Azure permissions due to resource references |
@@ -83,6 +176,12 @@ For more information, see [Scope levels](../role-based-access-control/scope-over
83
176
> [!NOTE]
84
177
> Allow sufficient time for [Azure Resource Manager cache](../role-based-access-control/troubleshooting.md) to refresh after role assignment changes.
85
178
179
+
## Permissions Error
180
+
181
+
If you see an error in the following format, then please make sure you have the above permissions properly configured.
182
+
183
+
Error message format: "The client with object id {} does not have authorization to perform action {} over scope {} or the scope is invalid. If access was recently granted, please refresh your credentials."
184
+
86
185
## Additional services
87
186
88
187
To view roles and permissions for other services, see the following links:
Copy file name to clipboardExpand all lines: articles/virtual-wan/virtual-wan-faq.md
+6Lines changed: 6 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -32,6 +32,12 @@ Virtual WAN partners provide automation for connectivity, which is the ability t
32
32
33
33
Virtual WAN comes in two flavors: Basic and Standard. In Basic Virtual WAN, hubs aren't meshed. In a Standard Virtual WAN, hubs are meshed and automatically connected when the virtual WAN is first set up. The user doesn't need to do anything specific. The user also doesn't have to disable or enable the functionality to obtain meshed hubs. Virtual WAN provides you with many routing options to steer traffic between any spoke (VNet, VPN, or ExpressRoute). It provides the ease of fully meshed hubs, and also the flexibility of routing traffic per your needs.
34
34
35
+
### Why am I seeing an error about invalid scope and authorization to perform operations on Virtual WAN resources?
36
+
37
+
If you see an error in the below format, then please make sure you have the following permissions configured: [Virtual WAN Roles and Permissions](roles-permissions.md#required-permissions)
38
+
39
+
Error message format: "The client with object id {} does not have authorization to perform action {} over scope {} or the scope is invalid. If access was recently granted, please refresh your credentials."
40
+
35
41
### How are Availability Zones and resiliency handled in Virtual WAN?
36
42
37
43
Virtual WAN is a collection of hubs and services made available inside the hub. The user can have as many Virtual WAN per their need. In a Virtual WAN hub, there are multiple services like VPN, ExpressRoute etc. Each of these services is automatically deployed across Availability Zones (except Azure Firewall), if the region supports Availability Zones. If a region becomes an Availability Zone after the initial deployment in the hub, the user can recreate the gateways, which will trigger an Availability Zone deployment. All gateways are provisioned in a hub as active-active, implying there's resiliency built in within a hub. Users can connect to multiple hubs if they want resiliency across regions.
0 commit comments