You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: azure-local/concepts/firewall-requirements.md
+16-16Lines changed: 16 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ description: This topic provides guidance on firewall requirements for the Azure
4
4
author: alkohli
5
5
ms.author: alkohli
6
6
ms.topic: how-to
7
-
ms.date: 01/02/2025
7
+
ms.date: 02/14/2025
8
8
---
9
9
10
10
# Firewall requirements for Azure Local
@@ -18,7 +18,7 @@ This article also describes how to optionally use a highly locked-down firewall
18
18
If your network uses a proxy server for internet access, see [Configure proxy settings for Azure Local](../manage/configure-proxy-settings-23h2.md).
19
19
20
20
> [!IMPORTANT]
21
-
> Azure Express Route and Azure Private Link are not supported for Azure Local, version 23H2 or any of its components as it is not possible to access the public endpoints required for Azure Local, version 23H2.
21
+
> Azure Express Route and Azure Private Link are not supported for Azure Localor any of its components as it is not possible to access the public endpoints required for Azure Local.
22
22
23
23
## Firewall requirements for outbound endpoints
24
24
@@ -37,33 +37,33 @@ As shown in the following diagram, Azure Local can access Azure using more than
37
37
38
38
:::image type="content" source="./media/firewall-requirements/firewalls-diagram.png" alt-text="Diagram shows Azure Local accessing service tag endpoints through Port 443 (HTTPS) of firewalls." lightbox="./media/firewall-requirements/firewalls-diagram.png":::
39
39
40
-
## Required firewall URLs for Azure Local, version 23H2 deployments
40
+
## Required firewall URLs for Azure Local deployments
41
41
42
-
Starting with Azure Local, version 23H2, all the clusters automatically enables Azure Resource Bridge and AKS infrastructure and uses the Arc for Servers agent to connect to Azure control plane. Along with the list of HCI specific endpoints on the following table, the [Azure Resource Bridge on Azure Local](/azure/azure-arc/resource-bridge/network-requirements) endpoints, the [AKS on Azure Local](/azure/aks/hybrid/aks-hci-network-system-requirements#firewall-url-exceptions) endpoints and the [Azure Arc-enabled servers](/azure/azure-arc/servers/network-requirements) endpoints must be included in the allow list of your firewall.
42
+
Azure Local instances automatically enables Azure Resource Bridge and AKS infrastructure and uses the Arc for Servers agent to connect to Azure control plane. Along with the list of HCI specific endpoints on the following table, the [Azure Resource Bridge on Azure Local](/azure/azure-arc/resource-bridge/network-requirements) endpoints, the [AKS on Azure Local](/azure/aks/hybrid/aks-hci-network-system-requirements#firewall-url-exceptions) endpoints and the [Azure Arc-enabled servers](/azure/azure-arc/servers/network-requirements) endpoints must be included in the allow list of your firewall.
43
43
44
44
For a consolidated list of endpoints for East US that includes Azure Local, Arc-enabled servers, ARB, and AKS, use:
45
-
-[Required endpoints in East US for Azure Local, version 23H2](https://github.com/Azure/AzureStack-Tools/blob/master/HCI/EastUSendpoints/eastus-hci-endpoints.md)
45
+
-[Required endpoints in East US for Azure Local](https://github.com/Azure/AzureStack-Tools/blob/master/HCI/EastUSendpoints/eastus-hci-endpoints.md)
46
46
47
47
For a consolidated list of endpoints for West Europe that includes Azure Local, Arc-enabled servers, ARB, and AKS, use:
48
-
-[Required endpoints in West Europe for Azure Local, version 23H2](https://github.com/Azure/AzureStack-Tools/blob/master/HCI/WestEuropeendpoints/westeurope-hci-endpoints.md)
48
+
-[Required endpoints in West Europe for Azure Local](https://github.com/Azure/AzureStack-Tools/blob/master/HCI/WestEuropeendpoints/westeurope-hci-endpoints.md)
49
49
50
50
For a consolidated list of endpoints for Australia East that includes Azure Local, Arc-enabled servers, ARB, and AKS, use:
51
-
-[Required endpoints in Australia East for Azure Local, version 23H2](https://github.com/Azure/AzureStack-Tools/blob/master/HCI/AustraliaEastendpoints/AustraliaEast-hci-endpoints.md)
51
+
-[Required endpoints in Australia East for Azure Local](https://github.com/Azure/AzureStack-Tools/blob/master/HCI/AustraliaEastendpoints/AustraliaEast-hci-endpoints.md)
52
52
53
53
For a consolidated list of endpoints for Canada Central that includes Azure Local, Arc-enabled servers, ARB, and AKS, use:
54
-
-[Required endpoints in Canada Central for Azure Local, version 23H2](https://github.com/Azure/AzureStack-Tools/blob/master/HCI/CanadaCentralEndpoints/canadacentral-hci-endpoints.md)
54
+
-[Required endpoints in Canada Central for Azure Local](https://github.com/Azure/AzureStack-Tools/blob/master/HCI/CanadaCentralEndpoints/canadacentral-hci-endpoints.md)
55
55
56
56
For a consolidated list of endpoints for India Central that includes Azure Local, Arc-enabled servers, ARB, and AKS, use:
57
-
-[Required endpoints in India Central for Azure Local, version 23H2](https://github.com/Azure/AzureStack-Tools/blob/master/HCI/IndiaCentralEndpoints/IndiaCentral-hci-endpoints.md)
57
+
-[Required endpoints in India Central for Azure Local](https://github.com/Azure/AzureStack-Tools/blob/master/HCI/IndiaCentralEndpoints/IndiaCentral-hci-endpoints.md)
58
58
59
59
For a consolidated list of endpoints for SouthEast Asia that includes Azure Local, Arc-enabled servers, ARB, and AKS, use:
60
-
-[Required endpoints in SouthEast Asia for Azure Local, version 23H2](https://github.com/Azure/AzureStack-Tools/blob/master/HCI/SouthEastAsiaEndpoints/southeastasia-hci-endpoints.md)
60
+
-[Required endpoints in SouthEast Asia for Azure Local](https://github.com/Azure/AzureStack-Tools/blob/master/HCI/SouthEastAsiaEndpoints/southeastasia-hci-endpoints.md)
61
61
62
62
For a consolidated list of endpoints for Japan East that includes Azure Local, Arc-enabled servers, ARB, and AKS, use:
63
-
-[Required endpoints in Japan East for Azure Local, version 23H2](https://github.com/Azure/AzureStack-Tools/blob/master/HCI/JapanEastEndpoints/japaneast-hci-endpoints.md)
63
+
-[Required endpoints in Japan East for Azure Local](https://github.com/Azure/AzureStack-Tools/blob/master/HCI/JapanEastEndpoints/japaneast-hci-endpoints.md)
64
64
65
65
For a consolidated list of endpoints for South Central US that includes Azure Local, Arc-enabled servers, ARB, and AKS, use:
66
-
-[Required endpoints in South Central US for Azure Local, version 23H2](https://github.com/Azure/AzureStack-Tools/blob/master/HCI/SouthCentralUSEndpoints/southcentralus-hci-endpoints.md)
66
+
-[Required endpoints in South Central US for Azure Local](https://github.com/Azure/AzureStack-Tools/blob/master/HCI/SouthCentralUSEndpoints/southcentralus-hci-endpoints.md)
67
67
68
68
## Firewall requirements for additional Azure services
69
69
@@ -82,7 +82,7 @@ Depending on additional Azure services you enable for Azure Local, you may need
82
82
83
83
## Firewall requirements for internal rules and ports
84
84
85
-
Ensure that the proper network ports are open between all nodes, both within a site and between sites for stretched instances (stretched instance functionality is only available in Azure Local, version 22H2.). You'll need appropriate firewall rules to allow ICMP, SMB (port 445, plus port 5445 for SMB Direct if using iWARP RDMA), and WS-MAN (port 5985) bi-directional traffic between all nodes in the cluster.
85
+
Ensure that the proper network ports are open between all nodes, both within a site and between sites for stretched instances (stretched instance functionality is only available in Azure Stack HCI, version 22H2). You'll need appropriate firewall rules to allow ICMP, SMB (port 445, plus port 5445 for SMB Direct if using iWARP RDMA), and WS-MAN (port 5985) bi-directional traffic between all nodes in the cluster.
86
86
87
87
When using the **Creation wizard** in Windows Admin Center to create the cluster, the wizard automatically opens the appropriate firewall ports on each server in the cluster for Failover Clustering, Hyper-V, and Storage Replica. If you're using a different firewall on each machine, open the ports as described in the following sections:
88
88
@@ -92,7 +92,7 @@ Ensure that the following firewall rules are configured in your on-premises fire
| Allow inbound/outbound traffic to and from the Azure Local service on Azure Local instance machines | Allow | Instance nodes | Instance nodes | TCP | 30301 |
95
+
| Allow inbound/outbound traffic to and from the Azure Local service on Azure Local machines | Allow | Instance nodes | Instance nodes | TCP | 30301 |
96
96
97
97
### Windows Admin Center
98
98
@@ -197,5 +197,5 @@ This section shows how to configure Microsoft Defender firewall to allow IP addr
197
197
198
198
For more information, see also:
199
199
200
-
- The Windows Firewall and WinRM 2.0 ports section of [Installation and configuration for Windows Remote Management](/windows/win32/winrm/installation-and-configuration-for-windows-remote-management#windows-firewall-and-winrm-20-ports)
201
-
- See [About Azure Local, version 23H2 deployment](../deploy/deployment-introduction.md)
200
+
- The Windows Firewall and WinRM 2.0 ports section of [Installation and configuration for Windows Remote Management](/windows/win32/winrm/installation-and-configuration-for-windows-remote-management#windows-firewall-and-winrm-20-ports).
@@ -36,7 +36,7 @@ For more information, see [Manage security defaults on Azure Local](../manage/ma
36
36
37
37
## Application Control
38
38
39
-
Application Control is a software-based security layer that reduces attack surface by enforcing an explicit list of software that is allowed to run. Application Control is enabled by default and limits the applications and code that you can run on the core platform. For more information, see [Manage Application Control for Azure Local, version 23H2](../manage/manage-wdac.md#manage-application-control-settings-with-powershell).
39
+
Application Control is a software-based security layer that reduces attack surface by enforcing an explicit list of software that is allowed to run. Application Control is enabled by default and limits the applications and code that you can run on the core platform. For more information, see [Manage Application Control for Azure Local](../manage/manage-wdac.md#manage-application-control-settings-with-powershell).
40
40
41
41
Application Control provides two main operation modes, Enforcement mode and Audit mode. In Enforcement mode, untrusted code is blocked and events are recorded. In Audit mode, untrusted code is allowed to run and events are recorded. To learn more about Application Control-related events, see [List of Events](/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations).
42
42
@@ -140,7 +140,7 @@ For more information, see [Manage secrets rotation](../manage/manage-secrets-rot
140
140
141
141
## Syslog forwarding of security events
142
142
143
-
For customers and organizations that require their own local security information and event management (SIEM) system, Azure Local, version 23H2 includes an integrated mechanism that enables you to forward security-related events to a SIEM.
143
+
For customers and organizations that require their own local security information and event management (SIEM) system, Azure Local includes an integrated mechanism that enables you to forward security-related events to a SIEM.
144
144
145
145
Azure Local has an integrated syslog forwarder that, once configured, generates syslog messages defined in RFC3164, with the payload in Common Event Format (CEF).
@@ -96,14 +96,14 @@ To ensure adequate support and diagnosability for large memory Azure Local insta
96
96
97
97
In addition to Microsoft Azure Local updates, many OEMs also release regular updates for your Azure Local hardware, such as driver and firmware updates. To ensure that OEM package update notifications, reach your organization check with your OEM about their specific notification process.
98
98
99
-
Before deploying Azure Local, version 23H2, ensure that your hardware is up to date by:
99
+
Before deploying Azure Local, ensure that your hardware is up to date by:
100
100
101
101
- Determining the current version of your Solution Builder Extension (SBE) package.
102
102
- Finding the best method to download, install, and update your SBE package.
103
103
104
104
### OEM information
105
105
106
-
This section contains OEM contact information and links to OEM Azure Local, version 23H2 reference material.
106
+
This section contains OEM contact information and links to OEM Azure Local reference material.
107
107
108
108
| Azure Local Solution provider | Solution platform | How to configure BIOS settings | How to update firmware | How to update drivers | How to update the system after it's running |
@@ -117,11 +117,11 @@ For a comprehensive list of all OEM contact information, download the [Azure Loc
117
117
118
118
### BIOS setting
119
119
120
-
Check with your OEM regarding the necessary generic BIOS settings for Azure Local, version 23H2. These settings may include hardware virtualization, TPM enabled, and secure core.
120
+
Check with your OEM regarding the necessary generic BIOS settings for Azure Local. These settings may include hardware virtualization, TPM enabled, and secure core.
121
121
122
122
## Driver
123
123
124
-
Check with your OEM regarding the necessary drivers that need to be installed for Azure Local, version 23H2. Additionally, your OEM can provide you with their preferred installation steps.
124
+
Check with your OEM regarding the necessary drivers that need to be installed for Azure Local. Additionally, your OEM can provide you with their preferred installation steps.
125
125
126
126
### Driver installation steps
127
127
@@ -230,11 +230,11 @@ You should always follow the OEM's recommended installation steps. If the OEM's
230
230
231
231
## Firmware
232
232
233
-
Check with your OEM regarding the necessary firmware that needs to be installed for Azure Local, version 23H2. Additionally, your OEM can provide you with their preferred installation steps.
233
+
Check with your OEM regarding the necessary firmware that needs to be installed for Azure Local. Additionally, your OEM can provide you with their preferred installation steps.
234
234
235
235
## Drivers and firmware via the Windows Admin Center extension
236
236
237
-
You should always follow the OEM's recommended installation steps. With Azure Local, version 23H2, Windows Admin Center plugins can be used to install drivers and firmware. For a comprehensive list of all OEM contact information, download the [Azure Local OEM Contact](https://github.com/Azure/AzureStack-Tools/raw/master/HCI/azure-stack-hci-oem-contact-and-material.xlsx) spreadsheet.
237
+
You should always follow the OEM's recommended installation steps. With Azure Local, Windows Admin Center plugins can be used to install drivers and firmware. For a comprehensive list of all OEM contact information, download the [Azure Local OEM Contact](https://github.com/Azure/AzureStack-Tools/raw/master/HCI/azure-stack-hci-oem-contact-and-material.xlsx) spreadsheet.
Copy file name to clipboardExpand all lines: azure-local/manage/azure-arc-vm-management-prerequisites.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -44,7 +44,7 @@ For Arc VM images to be used on Azure Local, make sure to satisfy the following
44
44
45
45
## Firewall requirements
46
46
47
-
Make sure the requirements as listed in [Required firewall URLs for Azure Local deployments](../concepts/firewall-requirements.md#required-firewall-urls-for-azure-local-version-23h2-deployments) are satisfied to allow communication between the Arc VMs running on Azure Local and Azure Arc.
47
+
Make sure the requirements as listed in [Required firewall URLs for Azure Local deployments](../concepts/firewall-requirements.md#required-firewall-urls-for-azure-local-deployments) are satisfied to allow communication between the Arc VMs running on Azure Local and Azure Arc.
0 commit comments