Secure network access to Azure resources — AZ-104 Hoofdstuk 10

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Vaardigheden in dit hoofdstuk

Toegang beveiligen met NSG's, Bastion en private endpoints

Filter traffic with NSGs

A network security group is a list of allow/deny rules (by source, destination, port, protocol), checked by priority (lowest number first). Attach it to a subnet or a NIC.

$az network nsg create -g rg-net -n nsg-web
$az network nsg rule create -g rg-net --nsg-name nsg-web -n allow-https --priority 100 \
    --direction Inbound --access Allow --protocol Tcp --source-address-prefixes Internet --destination-port-ranges 443
$az network nsg rule create -g rg-net --nsg-name nsg-web -n allow-lb-probe --priority 110 \
    --source-address-prefixes AzureLoadBalancer --destination-port-ranges 80 --access Allow --protocol Tcp
$az network vnet subnet update -g rg-net --vnet-name vnet-prod -n snet-web --nsg nsg-web
$az network nsg rule list -g rg-net --nsg-name nsg-web --include-default -o table

Default inbound rule	Effect
AllowVnetInBound (65000)	Traffic inside the VNet (and peered VNets) is allowed
AllowAzureLoadBalancerInBound (65001)	Health probes are allowed
DenyAllInBound (65500)	Everything else is blocked

Onthoud

Priorities go from 100 to 4096; the first matching rule wins. Service tags (Internet, VirtualNetwork, AzureLoadBalancer, Storage.WestEurope …) replace long IP lists.

10.2

Group servers with ASGs

An application security group is a label for NICs ("web servers", "db servers"). Rules then say "web → db on 5432" instead of IP lists.

$az network asg create -g rg-net -n asg-web
$az network asg create -g rg-net -n asg-db
$az network nic ip-config update -g rg-net --nic-name vm-db1VMNic -n ipconfig1 --application-security-groups asg-db
$az network nsg rule create -g rg-net --nsg-name nsg-app -n web-to-db --priority 200 \
    --source-asgs asg-web --destination-asgs asg-db --destination-port-ranges 5432 --protocol Tcp --access Allow

10.3

Check the effective rules

A NIC can be under two NSGs (subnet and NIC). The effective security rules show the result.

$az network nic list-effective-nsg -g rg-net -n vm-web1VMNic
$az network watcher test-ip-flow -g rg-net --vm vm-web1 --direction Inbound --protocol TCP --local 10.20.1.4:22 --remote 203.0.113.50:50000

Examentip

Traffic must be allowed by both NSGs (subnet and NIC). A deny in one of them is enough to block it.

10.4

Log in to VMs with Azure Bastion

Bastion gives SSH and RDP in the browser (or with the CLI) over TLS — the VMs need no public IP and no open port 22.

$az network bastion create -g rg-net -n bas-prod --vnet-name vnet-prod --public-ip-address pip-bastion --sku Standard --enable-tunneling true
$az network bastion ssh -g rg-net -n bas-prod --target-resource-id VM_ID --auth-type ssh-key --username azureuser --ssh-key ~/.ssh/id_ed25519

SKU	Gives
Developer	Free, one connection at a time, for tests
Basic	Browser SSH / RDP
Standard / Premium	Native client (CLI tunnel), file copy, scaling, session recording (Premium)

10.5

Keep PaaS traffic private

Service endpoints let a subnet reach a PaaS service over the Azure backbone. Private endpoints give the service a private IP inside your VNet — the strongest option.

$az network vnet subnet update -g rg-net --vnet-name vnet-prod -n snet-app --service-endpoints Microsoft.Storage
$az network private-endpoint create -g rg-net -n pe-stshop --vnet-name vnet-prod --subnet snet-app \
    --private-connection-resource-id STORAGE_ID --group-id blob --connection-name pec-stshop
$az network private-dns zone create -g rg-net -n privatelink.blob.core.windows.net
$az network private-dns link vnet create -g rg-net -z privatelink.blob.core.windows.net -n link-prod -v vnet-prod --registration-enabled false
$az network private-endpoint dns-zone-group create -g rg-net --endpoint-name pe-stshop -n default \
    --private-dns-zone privatelink.blob.core.windows.net --zone-name blob

	Service endpoint	Private endpoint
IP of the service	Public	Private, in your subnet
Reachable from the office over VPN	No	Yes
DNS change needed	No	Yes (private DNS zone)
Cost	Free	Per hour + per GB

Let op

Without the private DNS zone, the name still resolves to the public IP, and traffic does not use the private endpoint.

Alle commando's in dit hoofdstuk

az