az group create –name myRGNetwork –location eastus

Create virtual network

Use the az network vnet create command to create a virtual network. In this example, the network is named mvVNet and is given an address prefix of 10.0.0.0/16. A subnet is also created with a name of myFrontendSubnet and a prefix of 10.0.1.0/24. Later in this tutorial a front-end VM is connected to this subnet.

Azure CLI

az network vnet create –resource-group myRGNetwork –name myVNet –address-prefix 10.0.0.0/16 –subnet-name myFrontendSubnet –subnet-prefix 10.0.1.0/24

Create subnet

A new subnet is added to the virtual network using the az network vnet subnet create command. In this example, the subnet is named myBackendSubnet and is given an address prefix of 10.0.2.0/24. This subnet is used with all back-end services.

Azure CLI

az network vnet subnet create –resource-group myRGNetwork –vnet-name myVNet –name myBackendSubnet –address-prefix 10.0.2.0/24

At this point, a network has been created and segmented into two subnets, one for front-end services, and another for back-end services. In the next section, virtual machines are created and connected to these subnets.

az network public-ip create –resource-group myRGNetwork –name myPublicIPAddress

When creating a VM with the az vm create command, the default public IP address allocation method is dynamic. When creating a virtual machine using the az vm create command, include the --public-ip-address-allocation static argument to assign a static public IP address. This operation is not demonstrated in this tutorial, however in the next section a dynamically allocated IP address is changed to a statically allocated address.

The IP address allocation method can be changed using the az network public-ip update command. In this example, the IP address allocation method of the front-end VM is changed to static.

First, deallocate the VM.

Azure CLI

 

az vm deallocate –resource-group myRGNetwork –name myFrontendVM

 

Use the az network public-ip update command to update the allocation method. In this case, the --allocation-method is being set to static.

Azure CLI

az network public-ip update –resource-group myRGNetwork –name myPublicIPAddress –allocation-method static

Start the VM.

Azure CLI

az vm start –resource-group myRGNetwork –name myFrontendVM –no-wait

No public IP address

Often, a VM does not need to be accessible over the internet. To create a VM without a public IP address, use the --public-ip-address "" argument with an empty set of double quotes.

Create a front-end VM

Use the az vm create command to create the VM named myFrontendVM using myPublicIPAddress.

Azure CLI

az vm create –resource-group myRGNetwork –name myFrontendVM –vnet-name myVNet –subnet myFrontendSubnet –nsg myFrontendNSG –public-ip-address myPublicIPAddress –image UbuntuLTS –generate-ssh-keys

Secure network traffic

A network security group (NSG) contains a list of security rules that allow or deny network traffic to resources connected to Azure Virtual Networks (VNet). NSGs can be associated to subnets or individual network interfaces. When an NSG is associated with a network interface, it applies only the associated VM. When an NSG is associated to a subnet, the rules apply to all resources connected to the subnet.

Network security group rules

NSG rules define networking ports over which traffic is allowed or denied. The rules can include source and destination IP address ranges so that traffic is controlled between specific systems or subnets. NSG rules also include a priority (between 1—and 4096). Rules are evaluated in the order of priority. A rule with a priority of 100 is evaluated before a rule with priority 200.

All NSGs contain a set of default rules. The default rules cannot be deleted, but because they are assigned the lowest priority, they can be overridden by the rules that you create.

The default rules for NSGs are:

• Virtual network – Traffic originating and ending in a virtual network is allowed both in inbound and outbound directions.
• Internet – Outbound traffic is allowed, but inbound traffic is blocked.
• Load balancer – Allow Azure’s load balancer to probe the health of your VMs and role instances. If you are not using a load balanced set, you can override this rule.

Create network security groups

A network security group can be created at the same time as a VM using the az vm create command. When doing so, the NSG is associated with the VMs network interface and an NSG rule is auto created to allow traffic on port 22 from any source. Earlier in this tutorial, the front-end NSG was auto-created with the front-end VM. An NSG rule was also auto created for port 22.

In some cases, it may be helpful to pre-create an NSG, such as when default SSH rules should not be created, or when the NSG should be attached to a subnet.

Use the az network nsg create command to create a network security group.

az network nsg rule create –resource-group myRGNetwork –nsg-name myFrontendNSG –name http –access allow –protocol Tcp –direction Inbound –priority 200 –source-address-prefix “*” –source-port-range “*” –destination-address-prefix “*” –destination-port-range 80

az network nsg rule list –resource-group myRGNetwork –nsg-name myFrontendNSG –output table

Secure VM to VM traffic

az network nsg rule create –resource-group myRGNetwork –nsg-name myBackendNSG –name SSH –access Allow –protocol Tcp –direction Inbound –priority 100 –source-address-prefix 10.0.1.0/24 –source-port-range “*” –destination-address-prefix “*” –destination-port-range “22”

Now add a rule for MySQL traffic on port 3306.

az network nsg rule create –resource-group myRGNetwork –nsg-name myBackendNSG –name MySQL –access Allow –protocol Tcp –direction Inbound –priority 200 –source-address-prefix 10.0.1.0/24 –source-port-range “*” –destination-address-prefix “*” –destination-port-range “3306”

Finally, because NSGs have a default rule allowing all traffic between VMs in the same VNet, a rule can be created for the back-end NSGs to block all traffic. Notice here that the --priority is given a value of 300, which is lower that both the NSG and MySQL rules. This configuration ensures that SSH and MySQL traffic is still allowed through the NSG.

Azure CLI

az network nsg rule create –resource-group myRGNetwork –nsg-name myBackendNSG –name denyAll –access Deny –protocol Tcp –direction Inbound –priority 300 –source-address-prefix “*” –source-port-range “*” –destination-address-prefix “*” –destination-port-range “*”

Create back-end VM

az network nsg rule list –resource-group myRGNetwork –nsg-name myBackendNSG –output table