Skip to content

Commit 8bb978a

Browse files
Jak-MSJak-MS
authored
Merge pull request MicrosoftDocs#76228 from vhorne/fw-deploy-cli
start firewall cli article
2 parents a1bbff2 + d39c231 commit 8bb978a

File tree

2 files changed

+296
-0
lines changed

2 files changed

+296
-0
lines changed

‎articles/firewall/deploy-cli.md

+294
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,294 @@
1+
---
2+
title: Deploy and configure Azure Firewall using Azure CLI
3+
description: In this article, you learn how to deploy and configure Azure Firewall using the Azure CLI.
4+
services: firewall
5+
author: vhorne
6+
ms.service: firewall
7+
ms.date: 06/11/2019
8+
ms.author: victorh
9+
ms.topic: article
10+
#Customer intent: As an administrator new to this service, I want to control outbound network access from resources located in an Azure subnet.
11+
---
12+
13+
# Deploy and configure Azure Firewall using Azure CLI
14+
15+
Controlling outbound network access is an important part of an overall network security plan. For example, you may want to limit access to web sites. Or, you may want to limit the outbound IP addresses and ports that can be accessed.
16+
17+
One way you can control outbound network access from an Azure subnet is with Azure Firewall. With Azure Firewall, you can configure:
18+
19+
* Application rules that define fully qualified domain names (FQDNs) that can be accessed from a subnet.
20+
* Network rules that define source address, protocol, destination port, and destination address.
21+
22+
Network traffic is subjected to the configured firewall rules when you route your network traffic to the firewall as the subnet default gateway.
23+
24+
For this article, you create a simplified single VNet with three subnets for easy deployment. For production deployments, a [hub and spoke model](https://docs.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/hub-spoke) is recommended. The firewall is in its own VNet. The workload servers are in peered VNets in the same region with one or more subnets.
25+
26+
* **AzureFirewallSubnet** - the firewall is in this subnet.
27+
* **Workload-SN** - the workload server is in this subnet. This subnet's network traffic goes through the firewall.
28+
* **Jump-SN** - The "jump" server is in this subnet. The jump server has a public IP address that you can connect to using Remote Desktop. From there, you can then connect to (using another Remote Desktop) the workload server.
29+
30+
![Tutorial network infrastructure](media/tutorial-firewall-rules-portal/Tutorial_network.png)
31+
32+
In this article, you learn how to:
33+
34+
> [!div class="checklist"]
35+
> * Set up a test network environment
36+
> * Deploy a firewall
37+
> * Create a default route
38+
> * Configure an application rule to allow access to www.google.com
39+
> * Configure a network rule to allow access to external DNS servers
40+
> * Test the firewall
41+
42+
If you prefer, you can complete this procedure using the [Azure portal](tutorial-firewall-deploy-portal.md) or [Azure PowerShell](deploy-ps.md).
43+
44+
If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
45+
46+
[!INCLUDE [cloud-shell-try-it.md](../../includes/cloud-shell-try-it.md)]
47+
48+
## Prerequisites
49+
50+
### Azure CLI
51+
52+
If you choose to install and use the CLI locally, run Azure CLI version 2.0.4 or later. To find the version, run **az --version**. For information about installing or upgrading, see [Install Azure CLI]( /cli/azure/install-azure-cli).
53+
54+
## Set up the network
55+
56+
First, create a resource group to contain the resources needed to deploy the firewall. Then create a VNet, subnets, and test servers.
57+
58+
### Create a resource group
59+
60+
The resource group contains all the resources for the deployment.
61+
62+
```azurecli-interactive
63+
az group create --name Test-FW-RG --location eastus
64+
```
65+
66+
### Create a VNet
67+
68+
This virtual network has three subnets.
69+
70+
> [!NOTE]
71+
> The minimum size of the AzureFirewallSubnet subnet is /26.
72+
73+
```azurecli-interactive
74+
az network vnet create \
75+
--name Test-FW-VN \
76+
--resource-group Test-FW-RG \
77+
--location eastus \
78+
--address-prefix 10.0.0.0/16 \
79+
--subnet-name AzureFirewallSubnet \
80+
--subnet-prefix 10.0.1.0/24
81+
az network vnet subnet create \
82+
--name Workload-SN \
83+
--resource-group Test-FW-RG \
84+
--vnet-name Test-FW-VN \
85+
--address-prefix 10.0.2.0/24
86+
az network vnet subnet create \
87+
--name Jump-SN \
88+
--resource-group Test-FW-RG \
89+
--vnet-name Test-FW-VN \
90+
--address-prefix 10.0.3.0/24
91+
```
92+
93+
### Create virtual machines
94+
95+
Now create the jump and workload virtual machines, and place them in the appropriate subnets.
96+
When prompted, type a password for the virtual machine.
97+
98+
Create the Srv-Jump virtual machine.
99+
100+
```azurecli-interactive
101+
az vm create \
102+
--resource-group Test-FW-RG \
103+
--name Srv-Jump \
104+
--location eastus \
105+
--image win2016datacenter \
106+
--vnet-name Test-FW-VN \
107+
--subnet Jump-SN \
108+
--admin-username azureadmin
109+
az vm open-port --port 3389 --resource-group Test-FW-RG --name Srv-Jump
110+
```
111+
112+
113+
114+
Create a NIC for Srv-Work with specific DNS server IP addresses and no public IP address to test with.
115+
116+
```azurecli-interactive
117+
az network nic create \
118+
-g Test-FW-RG \
119+
-n Srv-Work-NIC \
120+
--vnet-name Test-FW-VN \
121+
--subnet Workload-SN \
122+
--public-ip-address "" \
123+
--dns-servers 209.244.0.3 209.244.0.4
124+
```
125+
126+
Now create the workload virtual machine.
127+
When prompted, type a password for the virtual machine.
128+
129+
```azurecli-interactive
130+
az vm create \
131+
--resource-group Test-FW-RG \
132+
--name Srv-Work \
133+
--location eastus \
134+
--image win2016datacenter \
135+
--nics Srv-Work-NIC \
136+
--admin-username azureadmin
137+
```
138+
139+
## Deploy the firewall
140+
141+
Now deploy the firewall into the virtual network.
142+
143+
```azurecli-interactive
144+
az network firewall create \
145+
--name Test-FW01 \
146+
--resource-group Test-FW-RG \
147+
--location eastus
148+
az network public-ip create \
149+
--name fw-pip \
150+
--resource-group Test-FW-RG \
151+
--location eastus \
152+
--allocation-method static \
153+
--sku standard
154+
az network firewall ip-config create \
155+
--firewall-name Test-FW01 \
156+
--name FW-config \
157+
--public-ip-address fw-pip \
158+
--resource-group Test-FW-RG \
159+
--vnet-name Test-FW-VN
160+
az network firewall update \
161+
--name Test-FW01 \
162+
--resource-group Test-FW-RG
163+
az network public-ip show \
164+
--name fw-pip \
165+
--resource-group Test-FW-RG
166+
fwprivaddr="$(az network firewall ip-config list -g Test-FW-RG -f Test-FW01 --query "[?name=='FW-config'].privateIpAddress" --output tsv)"
167+
```
168+
169+
Note the private IP address. You'll use it later when you create the default route.
170+
171+
## Create a default route
172+
173+
Create a table, with BGP route propagation disabled
174+
175+
```azurecli-interactive
176+
az network route-table create \
177+
--name Firewall-rt-table \
178+
--resource-group Test-FW-RG \
179+
--location eastus \
180+
--disable-bgp-route-propagation true
181+
```
182+
183+
Create the route.
184+
185+
```azurecli-interactive
186+
az network route-table route create \
187+
--resource-group Test-FW-RG \
188+
--name DG-Route \
189+
--route-table-name Firewall-rt-table \
190+
--address-prefix 0.0.0.0/0 \
191+
--next-hop-type VirtualAppliance \
192+
--next-hop-ip-address $fwprivaddr
193+
```
194+
195+
Associate the route table to the subnet
196+
197+
```azurecli-interactive
198+
az network vnet subnet update \
199+
-n Workload-SN \
200+
-g Test-FW-RG \
201+
--vnet-name Test-FW-VN \
202+
--address-prefixes 10.0.2.0/24 \
203+
--route-table Firewall-rt-table
204+
```
205+
206+
## Configure an application rule
207+
208+
The application rule allows outbound access to www.google.com.
209+
210+
```azurecli-interactive
211+
az network firewall application-rule create \
212+
--collection-name App-Coll01 \
213+
--firewall-name Test-FW01 \
214+
--name Allow-Google \
215+
--protocols Http=80 Https=443 \
216+
--resource-group Test-FW-RG \
217+
--target-fqdns www.google.com \
218+
--source-addresses 10.0.2.0/24 \
219+
--priority 200 \
220+
--action Allow
221+
```
222+
223+
Azure Firewall includes a built-in rule collection for infrastructure FQDNs that are allowed by default. These FQDNs are specific for the platform and can't be used for other purposes. For more information, see [Infrastructure FQDNs](infrastructure-fqdns.md).
224+
225+
## Configure a network rule
226+
227+
The network rule allows outbound access to two IP addresses at port 53 (DNS).
228+
229+
```azurecli-interactive
230+
az network firewall network-rule create \
231+
--collection-name Net-Coll01 \
232+
--destination-addresses 209.244.0.3 209.244.0.4 \
233+
--destination-ports 53 \
234+
--firewall-name Test-FW01 \
235+
--name Allow-DNS \
236+
--protocols UDP \
237+
--resource-group Test-FW-RG \
238+
--priority 200 \
239+
--source-addresses 10.0.2.0/24 \
240+
--action Allow
241+
```
242+
243+
## Test the firewall
244+
245+
Now, test the firewall to confirm that it works as expected.
246+
247+
1. Note the private IP address for the **Srv-Work** virtual machine:
248+
249+
```azurecli-interactive
250+
az vm list-ip-addresses \
251+
-g Test-FW-RG \
252+
-n Srv-Work
253+
```
254+
255+
1. Connect a remote desktop to **Srv-Jump** virtual machine, and sign in. From there, open a remote desktop connection to the **Srv-Work** private IP address and sign in.
256+
257+
3. On **SRV-Work**, open a PowerShell window and run the following commands:
258+
259+
```
260+
nslookup www.google.com
261+
nslookup www.microsoft.com
262+
```
263+
264+
Both commands should return answers, showing that your DNS queries are getting through the firewall.
265+
266+
1. Run the following commands:
267+
268+
```
269+
Invoke-WebRequest -Uri https://www.google.com
270+
Invoke-WebRequest -Uri https://www.google.com
271+
272+
Invoke-WebRequest -Uri https://www.microsoft.com
273+
Invoke-WebRequest -Uri https://www.microsoft.com
274+
```
275+
276+
The www.google.com requests should succeed, and the www.microsoft.com requests should fail. This demonstrates that your firewall rules are operating as expected.
277+
278+
So now you've verified that the firewall rules are working:
279+
280+
* You can resolve DNS names using the configured external DNS server.
281+
* You can browse to the one allowed FQDN, but not to any others.
282+
283+
## Clean up resources
284+
285+
You can keep your firewall resources for the next tutorial, or if no longer needed, delete the **Test-FW-RG** resource group to delete all firewall-related resources:
286+
287+
```azurecli-interactive
288+
az group delete \
289+
-n Test-FW-RG
290+
```
291+
292+
## Next steps
293+
294+
* [Tutorial: Monitor Azure Firewall logs](./tutorial-diagnostics.md)

‎articles/firewall/toc.yml

+2
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,8 @@
3939
items:
4040
- name: Deploy using Azure PowerShell
4141
href: deploy-ps.md
42+
- name: Deploy using Azure CLI
43+
href: deploy-cli.md
4244
- name: Deploy using a template
4345
href: deploy-template.md
4446
- name: Integrate with load balancer

0 commit comments

Comments
 (0)