Skip to content

Commit fdd4b97

Browse files
PMEds28PMEds28
authored
Merge pull request #98537 from HeidiSteen/heidist-vnet
Azure Cognitive Search - private endpoint VNET connection
2 parents 5138db1 + adcdcfb commit fdd4b97

File tree

3 files changed

+232
-0
lines changed

3 files changed

+232
-0
lines changed

‎articles/search/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,8 @@
113113
items:
114114
- name: Security overview
115115
href: search-security-overview.md
116+
- name: Create a private endpoint
117+
href: service-create-private-endpoint.md
116118
- name: Service key management
117119
href: search-security-api-keys.md
118120
- name: Role-based admin access

‎articles/search/service-create-private-endpoint.md

Lines changed: 228 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,228 @@
1+
---
2+
title: Create a Private Endpoint for secure connections
3+
titleSuffix: Azure Cognitive Search
4+
description: Currently in preview, you can restrict access to a search service endpoint using Private Endpoint and a secure VNet connection.
5+
6+
manager: nitinme
7+
author: mrcarter8
8+
ms.author: mcarter
9+
ms.service: cognitive-search
10+
ms.topic: conceptual
11+
ms.date: 01/09/2020
12+
---
13+
14+
# Restrict access to Azure Cognitive Search using Private Endpoint and a virtual network connection.
15+
16+
> [!IMPORTANT]
17+
> Support for Private Endpoint is currently available as a limited-access preview. This preview is only available for search services on the **Basic tier**.
18+
> This preview version is provided without a service level agreement, and it's not recommended for production workloads. For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
19+
> The [REST API version 2019-10-01-Preview](search-api-preview.md) provides this feature. There is no portal or .NET SDK support at this time.
20+
21+
In this article, learn how to create a new search service that is accessible over secure connections, with no access from public IP addresses. Client connections are allowed from Azure virtual machines deployed in the same virtual network as the service.
22+
23+
## About Private Endpoint support
24+
25+
[Private Endpoints](../private-link/private-endpoint-overview.md) for Azure Cognitive Search allow a client on a virtual network to securely access data over a [Private Link](../private-link/private-link-overview.md). The private endpoint uses an IP address from the [virtual network address space](../virtual-network/virtual-network-ip-addresses-overview-arm.md#private-ip-addresses) for your search service. Network traffic between the client and the search service traverses over the virtual network and a private link on the Microsoft backbone network, eliminating exposure to the public internet. For a list of PaaS services that support Private Link, check the [availability section](../private-link/private-link-overview.md#availability) in the product documentation.
26+
27+
A private endpoint for your search service enables you to:
28+
29+
+ Block all connections on the public endpoint for your search service.
30+
+ Increase security for the virtual network by enabling you to block exfiltration of data from the virtual network.
31+
+ Securely connect to your search service from on-premises networks that connect to the virtual network using [VPN](../vpn-gateway/vpn-gateway-about-vpngateways.md) or [ExpressRoutes](../expressroute/expressroute-locations.md) with private-peering.
32+
33+
> [!NOTE]
34+
> When the service endpoint is private, some portal features are disabled. You'll be able to view and manage service level information, but portal access to index data and the various components in the service, such as the index, indexer, and skillset definitions, is restricted for security reasons.
35+
36+
## Request access
37+
38+
Click [request access](https://aka.ms/SearchPrivateLinkRequestAccess) to sign up for this preview feature. The form requests information about you, your company, and general network topology. Once we review your request, you'll receive a confirmation email with additional instructions.
39+
40+
## Create a VM
41+
In this section, you will create a virtual network and subnet to host the VM that will be used to access your search service's private endpoint.
42+
43+
### Set up the virtual network
44+
1. Sign in to the [Azure portal](https://portal.azure.com).
45+
1. On the top left, select **Create a resource** > **Networking** > **Virtual network**.
46+
1. In **Create virtual network**, enter or select this information:
47+
48+
| Setting | Value |
49+
| ------- | ----- |
50+
| Name | Enter *MyVirtualNetwork* |
51+
| Address space | Enter *10.1.0.0/16* |
52+
| Subscription | Select your subscription|
53+
| Resource group | Select **Create new**, enter *myResourceGroup*, then select **OK** |
54+
| Location | Select **West US** or whatever region you are using|
55+
| Subnet - Name | Enter *mySubnet* |
56+
| Subnet - Address range | Enter *10.1.0.0/24* |
57+
|||
58+
59+
1. Leave the rest as default and select **Create**.
60+
61+
62+
### Create a virtual machine
63+
64+
1. On the top left of main portal page, select **Create a resource** > **Compute** > **Virtual machine**.
65+
66+
1. In **Create a virtual machine - Basics**, enter or select this information:
67+
68+
| Setting | Value |
69+
| ------- | ----- |
70+
| **PROJECT DETAILS** | |
71+
| Subscription | Select your subscription. |
72+
| Resource group | Select **myResourceGroup**. You created this in the previous section. |
73+
| **INSTANCE DETAILS** | |
74+
| Virtual machine name | Enter *myVm*. |
75+
| Region | Select **West US** or whatever region you are using. |
76+
| Availability options | Leave the default **No infrastructure redundancy required**. |
77+
| Image | Select **Windows Server 2019 Datacenter**. |
78+
| Size | Leave the default **Standard DS1 v2**. |
79+
| **ADMINISTRATOR ACCOUNT** | |
80+
| Username | Enter a username of your choosing. |
81+
| Password | Enter a password of your choosing. The password must be at least 12 characters long and meet the [defined complexity requirements](../virtual-machines/windows/faq.md?toc=%2fazure%2fvirtual-network%2ftoc.json#what-are-the-password-requirements-when-creating-a-vm).|
82+
| Confirm Password | Reenter password. |
83+
| **INBOUND PORT RULES** | |
84+
| Public inbound ports | Leave the default **None**. |
85+
| **SAVE MONEY** | |
86+
| Already have a Windows license? | Leave the default **No**. |
87+
|||
88+
89+
1. Select **Next: Disks**.
90+
91+
1. In **Create a virtual machine - Disks**, leave the defaults and select **Next: Networking**.
92+
93+
1. In **Create a virtual machine - Networking**, select this information:
94+
95+
| Setting | Value |
96+
| ------- | ----- |
97+
| Virtual network | Leave the default **MyVirtualNetwork**. |
98+
| Address space | Leave the default **10.1.0.0/24**.|
99+
| Subnet | Leave the default **mySubnet (10.1.0.0/24)**.|
100+
| Public IP | Leave the default **(new) myVm-ip**. |
101+
| Public inbound ports | Select **Allow selected ports**. |
102+
| Select inbound ports | Select **HTTP** and **RDP**.|
103+
||
104+
105+
1. Select **Review + create**. You're taken to the **Review + create** page where Azure validates your configuration.
106+
107+
1. When you see the **Validation passed** message, select **Create**.
108+
109+
110+
## Create your search service with a private endpoint
111+
112+
In this section, you will create a new Azure Cognitive Search service with a Private Endpoint.
113+
114+
1. On the top left of main portal page, select **Create a resource** > **Web** > **Azure Cognitive Search**.
115+
116+
1. In **New Search Service - Basics**, enter or select this information:
117+
118+
| Setting | Value |
119+
| ------- | ----- |
120+
| **PROJECT DETAILS** | |
121+
| Subscription | Select your subscription. |
122+
| Resource group | Select **myResourceGroup**. You created this in the previous section.|
123+
| **INSTANCE DETAILS** | |
124+
| URL | Enter a unique name. |
125+
| Location | Select the region that you specified when requesting access to this preview feature. |
126+
| Pricing tier | Select **Change Pricing Tier** and choose **Basic**. This tier is required for the preview. |
127+
|||
128+
129+
1. Select **Next: Scale**.
130+
131+
1. Leave the values as default and select **Next: Networking**.
132+
133+
1. In **New Search Service - Networking**, select **Private** for **Endpoint connectivity(data)**.
134+
135+
1. In **New Search Service - Networking**, select **+ Add** under **Private endpoint**.
136+
137+
1. In **Create Private Endpoint**, enter or select this information:
138+
139+
| Setting | Value |
140+
| ------- | ----- |
141+
| Subscription | Select your subscription. |
142+
| Resource group | Select **myResourceGroup**. You created this in the previous section.|
143+
| Location | Select **West US**.|
144+
| Name | Enter *myPrivateEndpoint*. |
145+
| Target sub-resource | Leave the default **searchService**. |
146+
| **NETWORKING** | |
147+
| Virtual network | Select *MyVirtualNetwork* from resource group *myResourceGroup*. |
148+
| Subnet | Select *mySubnet*. |
149+
| **PRIVATE DNS INTEGRATION** | |
150+
| Integrate with private DNS zone | Leave the default **Yes**. |
151+
| Private DNS zone | Leave the default ** (New) privatelink.search.windows.net**. |
152+
|||
153+
154+
1. Select **OK**.
155+
156+
1. Select **Review + create**. You're taken to the **Review + create** page where Azure validates your configuration.
157+
158+
1. When you see the **Validation passed** message, select **Create**.
159+
1. Once the service is created, browse to the resource that you just created.
160+
1. Select **Keys** from the left content menu.
161+
1. Copy the **Primary admin key** for use in the next step.
162+
163+
164+
## Connect to a VM from the internet
165+
166+
Connect to the VM *myVm* from the internet as follows:
167+
168+
1. In the portal's search bar, enter *myVm*.
169+
170+
1. Select the **Connect** button. After selecting the **Connect** button, **Connect to virtual machine** opens.
171+
172+
1. Select **Download RDP File**. Azure creates a Remote Desktop Protocol (*.rdp*) file and downloads it to your computer.
173+
174+
1. Open the downloaded.rdp* file.
175+
176+
1. If prompted, select **Connect**.
177+
178+
1. Enter the username and password you specified when creating the VM.
179+
180+
> [!NOTE]
181+
> You may need to select **More choices** > **Use a different account**, to specify the credentials you entered when you created the VM.
182+
183+
1. Select **OK**.
184+
185+
1. You may receive a certificate warning when signing in. If you receive a certificate warning, select **Yes** or **Continue**.
186+
187+
1. Once the VM desktop appears, minimize it to go back to your local desktop.
188+
189+
190+
## Access the search service privately from the VM
191+
192+
In this section, you will verify private network access to the search service and connect privately to the storage account using the Private Endpoint.
193+
194+
1. In the Remote Desktop of *myVM*, open PowerShell.
195+
196+
1. Enter 'nslookup [search service name].search.windows.net'
197+
198+
You'll receive a message similar to this:
199+
```azurepowershell
200+
Server: UnKnown
201+
Address: 168.63.129.16
202+
Non-authoritative answer:
203+
Name: [search service name].privatelink.search.windows.net
204+
Address: 10.0.0.5
205+
Aliases: [search service name].search.windows.net
206+
```
207+
1. Follow this [Quickstart](search-get-started-postman.md) from the VM to create a new search index in your service in Postman using the REST API.
208+
209+
1. Try several of these same requests in Postman on your local workstation.
210+
211+
1. If you are able to complete the Quickstart from the VM, but receive an error that the remote server does not exist on your local workstation, you have successfully configured a private endpoint for your search service.
212+
213+
1. Close the remote desktop connection to *myVM*.
214+
215+
## Clean up resources
216+
217+
When you're done using the Private Endpoint, search service account, and the VM, delete the resource group and all of the resources it contains:
218+
219+
1. Enter *myResourceGroup* in the **Search** box at the top of the portal and select *myResourceGroup* from the search results.
220+
1. Select **Delete resource group**.
221+
1. Enter *myResourceGroup* for **TYPE THE RESOURCE GROUP NAME** and select **Delete**.
222+
223+
## Next steps
224+
225+
In this article, you created a VM on a virtual network and a search service with a Private Endpoint. You connected to the VM from the internet and securely communicated to the search service using Private Link.
226+
227+
> [!div class="nextstepaction"]
228+
> [What is Azure Private Endpoint?](../private-link/private-endpoint-overview.md).

‎articles/search/whats-new.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@ API versions, Nuget packages, namespaces, and endpoints are unchanged. Your exis
3434

3535
+ [Create app (preview)](search-create-app-portal.md) is a new wizard in the portal that generates a downloadable HTML file. The file comes with embedded script that renders an operational "localhost"-style web app, bound to an index on your search service. Pages are configurable in the wizard and can contain a search bar, results area, sidebar navigation, and typeahead query support. You can modify the HTML offline to extend or customize the workflow or appearance.
3636

37+
+ [Create a private endpoint for secure connections (preview)](service-create-private-endpoint.md) explains how to set up a Private Link for secure connections to your search service. This preview feature is available upon request and uses [Azure Private Link](../private-link/private-link-overview.md) and [Azure Virtual Network](../virtual-network/virtual-networks-overview.md) as part of the solution.
38+
3739
### November 2019 - Ignite Conference
3840

3941
+ [Incremental enrichment (preview)](cognitive-search-incremental-indexing-conceptual.md) adds caching and statefullness to an enrichment pipeline so that you can work on specific steps or phases without losing content that is already processed. Previously, any change to an enrichment pipeline required a full rebuild. With incremental enrichment, the output of costly analysis, especially image analysis, is preserved.

0 commit comments

Comments
 (0)