Azure Network Security Demo Lab Environment with new updates. v2.1
Announcing our new Network Security Demo lab environment. This blog post provides information about the updated demo lab environment version 2.1 in our Github Repository. You can learn the new features and POC scenarios you can now set out to validate. This lab environment contains the recently GA Azure Firewall premium with Firewall Manager and Azure Frontdoor Premium.Improve your Azure Network Infrastructure Security with Complementary Services
For a while now, it’s been clear that securing only your network’s perimeter is simply not enough. The idea that we can inherently trust systems or users in “internal networks” is a recipe for disaster. Not to mention, it’s likely that many of your systems and users are not even in an internal network anymore.Azure Cloud Shell ile Azure Bastion Kurulumu ve Yapılandırması (tr-TR)
Uygulama Kurulum ve yapılandırma için ayrılan zamanları kısaltmak ve operasyonel süreçlere daha fazla vakit ayırmak için her zaman önceliğim olmuştur. Komutlar yada scriptlerle işlem süreçlerini kısaltabilir zaman kazanabilirsiniz. Zaman bizim gibi sistem yönetenler için çok kıymetlidir. Bu yüzden bugün de sizler için Azure Cloud Shell ile Azure Bastion kurulumu ve yapılandırmasını anlatıyor olacağım. Azure Cloud Shell'i başlatınız. Azure Cloud Shell üzerinden PowerShell modülüne geçiş yapınız ve aşağıdaki komutları kullanarak Bastion kurulum ve yapılandırmasını gerçekleştirebilirsiniz. Önemli olan Azure Bastion kurarken Azure Bastion için özel bir subnet ihtiyacınız olması ve bu networkun en az /27 olması gerekmektedir. ikinic altın kural ise VMleriniz ve Azure Bastion aynı lokasyon ve network içinde olması gerekmektedir. Ben aşağıdaki scriptimde önce sizeler için bir resource group oluşturacağım. ikinci olarak local network ve bu networklar için kullanılmak üzere subnetler oluşturup, son olarak da Azure BAstion kurulumu yaparak işlemi tamamlıyor olacağım. New-AzResourceGroup -Name PSAzureBootCampRG -Location westus $gatewaysubnet = New-AzVirtualNetworkSubnetConfig -Name PSGatewaySubnet -AddressPrefix "10.172.100.0/27" $virtualNetwork = New-AzVirtualNetwork -Name PSAzureBCVnet -ResourceGroupName PSAzureBootCampRG -Location westus -AddressPrefix "10.172.100.0/24" -Subnet $gatewaysubnet Add-AzVirtualNetworkSubnetConfig -Name PSAzureFirewallSubnet -VirtualNetwork $virtualNetwork -AddressPrefix "10.172.100.32/27" Add-AzVirtualNetworkSubnetConfig -Name AzureBastionSubnet -VirtualNetwork $virtualNetwork -AddressPrefix "10.172.100.64/27" Add-AzVirtualNetworkSubnetConfig -Name PSDMZSubnet -VirtualNetwork $virtualNetwork -AddressPrefix "10.172.100.96/27" $virtualNetwork | Set-AzVirtualNetwork $publicip = New-AzPublicIpAddress -ResourceGroupName "PSAzureBootCampRG" -name "PSAzureBastionIP" -location "westus" -AllocationMethod Static -Sku Standard $bastion = New-AzBastion -ResourceGroupName "PSAzureBootCampRG" -Name "PSBastion" -PublicIpAddress $publicip -VirtualNetworkName PSAzureBCVnet Komutu kendinize göre özelleştirebilir ve geliştirebilirsiniz. Kolay ve hızlı bir şekilde azure bastion kurulumunu kodun tamamını kopyala yapıştır yöntemi ile tamamlayabilirsiniz. Önemli Bilgi : Sanal suncularınzın, Azure Bastion ile aynı sanal ağ içinde olduğundan emin olun. Ben vmlere tanımlamak üzere PSDMZSubnet oluşturuyorum. AzureBastionSubnet olarak da en az ikinic bir subnet oluşturuyoruyum. Sanal sunucularınız için ikinci bir network oluşturup PSDMZSubnet bu subnet üzerinde konumlandırırsanız sorunsuz bir şekilde Azure Bastion kullanımını gerçekleştirebilirsiniz.Azure Bastion ön incelemesi (tr-TR)
Azure sanal netwokunuzda bulunan VMlerinize Browser üzerinden erişim sağlamanız için kullanılan PaaS dir. Bastion , azure sanal netwokunuzda bulunan VMlere güvenli RDP ve SSH bağlantısı sağlamak için tercih edilebilir. Azure Bastion, VMlerinizi RDP/SSH portlarını dünyaya açık bir şekilde bırakmaktan korurken güvenli erişiminizi sağlar. Azure Bastion ile VMlerinize doğrudan Azure portalından browser arayüzü yeni sekmede yada mevcut pencere ile bağlanırsınız. Azure Bastion kullanımı ve ücretlendirmesi, abonelik, hesap veya VM başına değildir. Sanal network başınadır. Sanal netwokunuzda bir Azure Bastion Subneti sağladıktan sonra, Bastion deneyimi resources altında bulunan tüm Sanal makinalarınız tarafından güvenle kullanılabilir. Azure Bastion ile ile RDP/SSH bağlantısı için internete açık bir port olmasına gerek yoktur. Aynı sanal ağınız içerisinde bulunan azure bastion subnetiniz sayesinde varsayılan RDP/SSH portları 3389/22 üzerinden bağlantı sağlar ve html5 tabanlı tarayıcınız üzerinden sunucunuza güvenli erişim imkanı sağlar. Azure bastion erişimi için öncelikle bastions kurulumu için sanal ağınız üzerinde yapılandırmanızı tamamlamanız ve bastion kurulumunu bitirdikten sonra bations servisini kullanabilirsiniz. Azure Bastion, azure’un güvenli RDP/SSH bağlantısı sağlamak için azure portalı içinde bulunan sanal makinalarınızın erişim hizmeti olarak servis ettiği yönetilen bir platform PaaS hizmetidir. Tek bir tıklama ile bastions deneyimini kullanarak doğrudan azure portalından RDP veya SSH oturumuna ulaşabilirsiniz. Azure sanal makinalarınızda public IP gerekmez, Azure Bastion, sanal makinalarınıza private IP kullanarak RDP/SSH bağlantısını açar. NSGler üzerinden SSH/RDP için kural yapılandırmanıza ihtiyaç yoktur. Tüm erişimi yapısını azure portalı içinde oluşturduğunuz sanal ağınız üzerindeki private IP üzerinden SSH/RDP portlarına güvenli bağlantı sağlayarak tamamlar. Güvenlik açıklarına karşı koruyun, Azure Bastion tamamen platform tarafından yönetilen bir PaaS hizmeti bu sebeple Sanal ağınızın içerisinde yer aldığı için, sanal ağınızdaki sanal makinelerin her biri için endişelenmenize gerek yoktur. Azure platformu, Azure bastion servisini her zaman sizin için güncel tutarak güvenlik açıklarına karşı koruma da sunar. Azure Basiton servisine HTML5 desteği olan tüm tarayıcılar tarafından erişim sağlayabilirsiniz.Connect to your on-prem server from anywhere!
Hello Folks, A few weeks ago, I wrote about upgrading my local network edge device with one capable of connecting to my Azure virtual network using a site-to-site VPN. I also mentioned that I would cover many other services and capabilities that this site-to-site VPN configuration enables for hybrid work and management. This week I’m covering the ability to connect to your on-premises, non-Azure, and Azure virtual machines via Azure Bastion over ExpressRoute or a VPN site-to-site connection using a specified private IP address over RDP and SSH. Over the years I have seen and heard many ITPros struggles to figure out a way to deploy and maintain a VPN infrastructure that would allow them to access the servers in their remote environments easily and cheaply without having to mess around with routing and remote access roles or port forwarding. And without having to manage VPN clients on their PC.Using Azure Bastion via through vWAN Virtual Hub
I have a feedback about Azure Bastion. I am using the ability to use Azure Bastion with multiple virtual networks via vNET Peering. I would like to extend this feature to use it via a Virtual WAN hub. However, the current Azure Bastion does not seem to detect peering through a virtual hub. I hope Azure Bastion to be able to connect to VM hosts on different virtual networks via a virtual hub.Azure Networking Portfolio Consolidation
Overview Over the past decade, Azure Networking has expanded rapidly, bringing incredible tools and capabilities to help customers build, connect, and secure their cloud infrastructure. But we've also heard strong feedback: with over 40 different products, it hasn't always been easy to navigate and find the right solution. The complexity often led to confusion, slower onboarding, and missed capabilities. That's why we're excited to introduce a more focused, streamlined, and intuitive experience across Azure.com, the Azure portal, and our documentation pivoting around four core networking scenarios: Network foundations: Network foundations provide the core connectivity for your resources, using Virtual Network, Private Link, and DNS to build the foundation for your Azure network. Try it with this link: Network foundations Hybrid connectivity: Hybrid connectivity securely connects on-premises, private, and public cloud environments, enabling seamless integration, global availability, and end-to-end visibility, presenting major opportunities as organizations advance their cloud transformation. Try it with this link: Hybrid connectivity Load balancing and content delivery: Load balancing and content delivery helps you choose the right option to ensure your applications are fast, reliable, and tailored to your business needs. Try it with this link: Load balancing and content delivery Network security: Securing your environment is just as essential as building and connecting it. The Network Security hub brings together Azure Firewall, DDoS Protection, and Web Application Firewall (WAF) to provide a centralized, unified approach to cloud protection. With unified controls, it helps you manage security more efficiently and strengthen your security posture. Try it with this link: Network security This new structure makes it easier to discover the right networking services and get started with just a few clicks so you can focus more on building, and less on searching. What you’ll notice: Clearer starting points: Azure Networking is now organized around four core scenarios and twelve essential services, reflecting the most common customer needs. Additional services are presented within the context of these scenarios, helping you stay focused and find the right solution without feeling overwhelmed. Simplified choices: We’ve merged overlapping or closely related services to reduce redundancy. That means fewer, more meaningful options that are easier to evaluate and act on. Sunsetting outdated services: To reduce clutter and improve clarity, we’re sunsetting underused offerings such as white-label CDN services and China CDN. These capabilities have been rolled into newer, more robust services, so you can focus on what’s current and supported. What this means for you Faster decision-making: With clearer guidance and fewer overlapping products, it's easier to discover what you need and move forward confidently. More productive sales conversations: With this simplified approach, you’ll get more focused recommendations and less confusion among sellers. Better product experience: This update makes the Azure Networking portfolio more cohesive and consistent, helping you get started quickly, stay aligned with best practices, and unlock more value from day one. The portfolio consolidation initiative is a strategic effort to simplify and enhance the Azure Networking portfolio, ensuring better alignment with customer needs and industry best practices. By focusing on top-line services, combining related products, and retiring outdated offerings, Azure Networking aims to provide a more cohesive and efficient product experience. Azure.com Before: Our original Solution page on Azure.com was disorganized and static, displaying a small portion of services in no discernable order. After: The revised solution page is now dynamic, allowing customers to click deeper into each networking and network security category, displaying the top line services, simplifying the customer experience. Azure Portal Before: With over 40 networking services available, we know it can feel overwhelming to figure out what’s right for you and where to get started. After: To make it easier, we've introduced four streamlined networking hubs each built around a specific scenario to help you quickly identify the services that match your needs. Each offers an overview to set the stage, key services to help you get started, guidance to support decision-making, and a streamlined left-hand navigation for easy access to all services and features. Documentation For documentation, we looked at our current assets as well as created new assets that aligned with the changes in the portal experience. Like Azure.com, we found the old experiences were disorganized and not well aligned. We updated our assets to focus on our top-line networking services, and to call out the pillars. Our belief is these changes will allow our customers to more easily find the relevant and important information they need for their Azure infrastructure. Azure Network Hub Before the updates, we had a hub page organized around different categories and not well laid out. In the updated hub page, we provided relevant links for top-line services within all of the Azure networking scenarios, as well as a section linking to each scenario's hub page. Scenario Hub pages We added scenario hub pages for each of the scenarios. This provides our customers with a central hub for information about the top-line services for each scenario and how to get started. Also, we included common scenarios and use cases for each scenario, along with references for deeper learning across the Azure Architecture Center, Well Architected Framework, and Cloud Adoption Framework libraries. Scenario Overview articles We created new overview articles for each scenario. These articles were designed to provide customers with an introduction to the services included in each scenario, guidance on choosing the right solutions, and an introduction to the new portal experience. Here's the Load balancing and content delivery overview: Documentation links Azure Networking hub page: Azure networking documentation | Microsoft Learn Scenario Hub pages: Azure load balancing and content delivery | Microsoft Learn Azure network foundation documentation | Microsoft Learn Azure hybrid connectivity documentation | Microsoft Learn Azure network security documentation | Microsoft Learn Scenario Overview pages What is load balancing and content delivery? | Microsoft Learn Azure Network Foundation Services Overview | Microsoft Learn What is hybrid connectivity? | Microsoft Learn What is Azure network security? | Microsoft Lea Improving user experience is a journey and in coming months we plan to do more on this. Watch out for more blogs over the next few months for further improvements.
Automated Deployment of Cross-Tenant Azure Virtual Hubs Virtual Networks Connection
In modern cloud infrastructure, interconnecting resources across different Azure tenants is essential for various business scenarios, such as mergers, acquisitions, or multi-departmental collaborations. This article will walk you through creating a Virtual Hub in a Virtual WAN and connecting to a Virtual Network in a different tenant from the hub using Bicep and Azure Pipelines. The pipeline will be using a Service Principal to create and access resources in the two Tenants. The client ID and secret need to be stored in a Key Vault, the details of which would be passed as parameters to the pipeline. Mutli-Tenant SPN Setup and Access As mentioned in the Azure Documentation, we would be using the below command in the pipeline to setup the connection between the hub and virtual network: az network vhub connection create --resource-group "[resource_group_name]" --name "[connection_name]" --vhub-name "[virtual_hub_name]" --remote-vnet "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/rgName/providers/Microsoft.Network/virtualNetworks/vnetName" Since a service principal is being used to run the pipelines, the SPN would need contributor access on the appropriate subscriptions on both the main tenant and the remote tenant. This can be achieved using the following steps: 1. Create Service Principal and Assign Roles We will use a single SPN for the creation of VWAN, Vhub and the connection to the remote virtual network. Create the service principal in the Tenant that will contain Virtual WAN and the hub and provide contributor access on the subscription level. 2. Setting Up Multi-Tenant SPN Run the URL below to create the SPN in the other tenant: https://login.microsoftonline.com/{organization}/adminconsent?client_id={client-id} Organization would be the Tenant ID of the remote Vnet, and client ID is the Application ID of the SPN. Assign the SPN Contributor access on the subscription where the Vnet resides. Note: The contributor access on the Subscription is the lowest possible access required for multi-tenant setup. Contributor access on the Resource Group level would not work. Code Explanation The code and parameter files can be found here. There are 3 main Azure Bicep files that manages the creation of the resources: Network.bicep The file retrieves the required modules to create a single VWAN and multiple hubs in the VWAN, along with a virtual network and resource group(s). The naming convention is fixed based on environment (TST, PROD etc.) and region of resource (west us, east us etc.) It also contains the following code to create a connection between the virtual network (either provide ID of the VNET or parameters for the creation of the VNET) in the same tenant as the hub. The parameter file used is ‘network.main.parameters.json’ The below code would only run if createHubVirtualNetworkConnection is set to True. By default, the parameter is set to False. module connectVnetHub '../Modules/VirtualHub/connectVnet.bicep' = if (createHubVirtualNetworkConnection){ name: 'connect-vnet-to-hub' scope: resourceGroup(vwan.subscriptionID, vwan.resourceGroupName) params: { vhubName: 'vwanhub-${env}-${stage}-${vnet.location}-001' virtualNetworkID: (createVnet) ? virtualnetwork.outputs.resourceId : vnet.id connectionName: '${purpose}-vnet-${env}' } dependsOn: [ vWan vwanHub virtualnetwork ] } The above module calls the below bicep file to create the connection: param vhubName string param virtualNetworkID string param connectionName string resource vhub 'Microsoft.Network/virtualHubs@2023-04-01' existing = { name: vhubName } resource connectVnet 'Microsoft.Network/virtualHubs/hubVirtualNetworkConnections@2023-04-01' = { name: connectionName parent: vhub properties: { remoteVirtualNetwork: { id: virtualNetworkID } } } RemoteVnetSubnet.bicep This Bicep file creates multiple Resource Groups, VNETs and Subnets as mentioned in the parameter file. Parameter file name is network.remote.parameters.json. VhubRemoteVnetMapping.bicep This file calls the module to connect the remote VNET(s) to the Vhub. The appropriate Virtual Hub is selected based on the region. For example, a VNET created in east us will be connected to the hub is east us. The multi-tenant SPN needs to be passed as a parameter which is required to run the PowerShell script in the module. The SPN details is stored in a Key Vault and the below code is used to retrieve the Client ID and secret: param keyVaultName string param keyVaultResourceGroup string param keyVaultSubscription string resource keyVault 'Microsoft.KeyVault/vaults@2023-02-01' existing = { name: keyVaultName scope: resourceGroup(keyVaultSubscription, keyVaultResourceGroup) } The following code can connect multiple VNETs to the right virtual hub: targetScope='subscription' param vnets object [] = [] param vwan object param env string = 'main' param stage string = 'prod' module connectRemoteVnetVhub '../Modules/VirtualHub/connectRemoteVnet.bicep' = [for i in range(0, length(vnets)): { name: 'connect-${vnets[i].vnetName}-to-vhub' scope: resourceGroup(vwan.subscriptionID, vwan.resourceGroupName) params: { remoteResourceGroup: vnets[i].resourceGroupName remoteSubscriptionID: vnets[i].subscriptionID remoteTenant: vnets[i].tenantID remoteVnetName: vnets[i].vnetName vhubName: 'vwanhub-${env}-${stage}-${vnets[i].location}-001' subscriptionID: vwan.SubscriptionID tenantID: vwan.tenantID clientID: keyVault.getSecret('clientid-Main') clientSecret: keyVault.getSecret('clientsecret-Main') connectionName: '${vnets[i].vnetName}-dns-connection' location: vnets[i].location } }] The module basically contains a deployment script resource that runs a bash script to connect the VNET and the hub. resource deploymentScript 'Microsoft.Resources/deploymentScripts@2023-08-01' = { name: 'connectRemote${remoteVnetName}toVhub' location: location kind: 'AzureCLI' properties: { arguments: '${tenantID} ${remoteTenant} ${remoteSubscriptionID} ${subscriptionID} ${remoteResourceGroup} ${remoteVnetName} ${connectionName} ${vhubName}' environmentVariables: [ { name: 'parentResourceGroupName' value: resourceGroup().name } { name: 'clientID' value: clientID } { name: 'clientSecret' value: clientSecret } ] azCliVersion: '2.54.0' scriptContent: ''' az login --service-principal -u $clientID -p $clientSecret --tenant $2 az account set --subscription $3 az login --service-principal -u $clientID -p $clientSecret --tenant $1 az account set --subscription $4 az extension add --name virtual-wan -y --version 0.3.0 az network vhub connection create --resource-group $parentResourceGroupName --name $7 --vhub-name $8 --remote-vnet "/subscriptions/${3}/resourceGroups/${5}/providers/Microsoft.Network/virtualNetworks/${6}" ''' retentionInterval: 'P1D' } } Azure Pipeline Explanation Even though the SPN created earlier has access to both the main and remote Tenant, it would be a much more secure option to minimize the use of the multi-tenant SPN to just create the VHUB VNET connection due to its elevated access. Hence, we need to create an additional SPN that has the required access only on the remote Tenant. This new SPN then should be used to deploy only the remote VNET(s) and subnets and use the Multi-tenant SPN to create the main tenant resources and the connection. The pipeline will retrieve the SPN Client ID and secret from the Key Vault, run a validation on the Bicep code and deploy the resources. Appropriate parameters need to be passed to the pipeline to run the appropriate bicep file. It has to be run 3 times by selecting the following values: Iteration 1 (To deploy VWAN, VHUB in Main Tenant): Tenant Name: Main Purpose of Deployment: Main Network Deployment Subscription ID: Details of the subscription where the VWAN, VHUB and VNET will reside in the Main Tenant. Iteration 2 (To deploy Remote VNET): Tenant Name: Remote Purpose of Deployment: Remote Network Deployment Subscription ID: Details of the subscription where the remote VNET will reside in the remote Tenant. Iteration 3 (To create the cross-tenant VHUB VNET Connection): Tenant Name: Main Purpose of Deployment: Vnet-Hub-Connection Subscription ID: Details of the subscription where the VWAN, VHUB and VNET will reside in the Main Tenant. Note: Ensure that the Tenant ID for the main and remote Tenant, Client ID and Client Secret of the SPNs created are stored in the Key Vault before running the pipeline. The below format should be followed while creating the secrets in the key vault: $clientIDSecretName = "clientid-${{ parameters.tenantName }}" $clientSecretSecretName = "clientsecret-${{ parameters.tenantName }}" $tenantIDSecretName = "tenantid-${{ parameters.tenantName }}" where the Parameter 'tenantName' would be either 'Main' or 'Remote'. All the above-mentioned code and parameter files can be found here. Azure Documentation References Process: https://learn.microsoft.com/en-us/azure/virtual-wan/cross-tenant-vnet-az-cli Multi-Tenant SPNs: https://learn.microsoft.com/en-us/entra/identity-platform/howto-convert-app-to-be-multi-tenant Tenant wide Admin Consent: Grant tenant-wide admin consent to an application - Microsoft Entra ID | Microsoft Learn
