|
2 | 2 | title: Provision a pool in a virtual network
|
3 | 3 | description: Learn how to create a Batch pool in an Azure virtual network so that compute nodes can communicate securely with other VMs in the network, such as a file server.
|
4 | 4 | ms.topic: how-to
|
5 |
| -ms.date: 12/06/2023 |
| 5 | +ms.date: 06/27/2024 |
6 | 6 | ---
|
7 | 7 |
|
8 | 8 | # Create an Azure Batch pool in a virtual network
|
@@ -37,10 +37,6 @@ To allow compute nodes to communicate securely with other virtual machines, or w
|
37 | 37 |
|
38 | 38 | * Multiple pools can be created in the same virtual network or in the same subnet (as long as it has sufficient address space). A single pool can't exist across multiple virtual networks or subnets.
|
39 | 39 |
|
40 |
| -Other virtual network requirements differ, depending on whether the Batch pool is in the `VirtualMachineConfiguration` |
41 |
| -or `CloudServiceConfiguration`. `VirtualMachineConfiguration` for Batch pools is recommended, because `CloudServiceConfiguration` |
42 |
| -pools are [deprecated](https://azure.microsoft.com/updates/azure-batch-cloudserviceconfiguration-pools-will-be-retired-on-29-february-2024/). |
43 |
| - |
44 | 40 | > [!IMPORTANT]
|
45 | 41 | > Batch pools can be configured in one of two node communication modes. Classic node communication mode is
|
46 | 42 | > where the Batch service initiates communication to the compute nodes.
|
@@ -110,41 +106,6 @@ You can also disable default remote access on these ports through configuring [p
|
110 | 106 |
|
111 | 107 | Outbound to BatchNodeManagement.*region* service tag is required in `classic` pool communication mode if you're using Job Manager tasks or if your tasks must communicate back to the Batch service. For outbound to BatchNodeManagement.*region* in `simplified` pool communication mode, the Batch service currently only uses TCP protocol, but UDP might be required for future compatibility. For [pools without public IP addresses](simplified-node-communication-pool-no-public-ip.md) using `simplified` communication mode and with a node management private endpoint, an NSG isn't needed. For more information about outbound security rules for the BatchNodeManagement.*region* service tag, see [Use simplified compute node communication](simplified-compute-node-communication.md).
|
112 | 108 |
|
113 |
| -## Pools in the Cloud Services Configuration |
114 |
| - |
115 |
| -> [!WARNING] |
116 |
| -> Cloud Services Configuration pools are [deprecated](https://azure.microsoft.com/updates/azure-batch-cloudserviceconfiguration-pools-will-be-retired-on-29-february-2024/). Use Virtual Machine Configuration pools instead. |
117 |
| -
|
118 |
| -Requirements: |
119 |
| - |
120 |
| -- Supported Virtual Networks: Classic Virtual Networks only. |
121 |
| -- Subnet ID: when specifying the subnet using the Batch APIs, use the *resource identifier* of the subnet. The subnet identifier is of the form: |
122 |
| - |
123 |
| - `/subscriptions/{subscription}/resourceGroups/{group}/providers/Microsoft.ClassicNetwork/virtualNetworks/{network}/subnets/{subnet}` |
124 |
| - |
125 |
| -- Permissions: the `Microsoft Azure Batch` service principal must have the `Classic Virtual Machine Contributor` Azure role for the specified Virtual Network. |
126 |
| - |
127 |
| -### Network security groups for Cloud Services Configuration pools |
128 |
| - |
129 |
| -The subnet must allow inbound communication from the Batch service to be able to schedule tasks on the compute nodes, and it must allow outbound communication to communicate with Azure Storage or other resources. |
130 |
| - |
131 |
| -You don't need to specify an NSG, because Batch configures inbound communication only from Batch IP addresses to the pool nodes. However, If the specified subnet has associated NSGs and/or a firewall, configure the inbound and outbound security rules as shown in the following tables. If communication to the compute nodes in the specified subnet is denied by an NSG, the Batch service sets the state of the compute nodes to **unusable**. |
132 |
| - |
133 |
| -Configure inbound traffic on port 3389 for Windows if you need to permit RDP access to the pool nodes. This rule isn't required for the pool nodes to be usable. |
134 |
| - |
135 |
| -**Inbound security rules** |
136 |
| - |
137 |
| -| Source IP addresses | Source ports | Destination | Destination ports | Protocol | Action | |
138 |
| -| --- | --- | --- | --- | --- | --- | |
139 |
| -| Any <br /><br />Although this rule effectively requires *allow all*, the Batch service applies an ACL rule at the level of each node that filters out all non-Batch service IP addresses. | * | Any | 10100, 20100, 30100 | TCP | Allow | |
140 |
| -| Optional, to allow RDP access to compute nodes. | * | Any | 3389 | TCP | Allow | |
141 |
| - |
142 |
| -**Outbound security rules** |
143 |
| - |
144 |
| -| Source | Source ports | Destination | Destination ports | Protocol | Action | |
145 |
| -| --- | --- | --- | --- | --- | --- | |
146 |
| -| Any | * | Any | 443 | Any | Allow | |
147 |
| - |
148 | 109 | ## Create a pool with a Virtual Network in the Azure portal
|
149 | 110 |
|
150 | 111 | After you've created your Virtual Network and assigned a subnet to it, you can create a Batch pool with that Virtual Network. Follow these steps to create a pool from the Azure portal:
|
|
0 commit comments