Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit 3fd9f05

Browse files
vhornevhorne
committedMar 4, 2021
Freshness updates
1 parent 37f9b45 commit 3fd9f05

File tree

2 files changed

+150
-129
lines changed

2 files changed

+150
-129
lines changed
 

‎articles/firewall-manager/media/secure-hybrid-network/firewall-peering.png

157 KB
Loading

‎articles/firewall-manager/secure-hybrid-network.md

Lines changed: 150 additions & 129 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ services: firewall-manager
55
author: vhorne
66
ms.service: firewall-manager
77
ms.topic: tutorial
8-
ms.date: 06/30/2020
8+
ms.date: 03/03/2021
99
ms.author: victorh
1010
---
1111

@@ -74,22 +74,24 @@ If you don't have an Azure subscription, create a [free account](https://azure.m
7474
1. Select your subscription, and for Resource group, select **Create new** and create a resource group named **FW-Hybrid-Test**.
7575
2. For the policy name, type **Pol-Net01**.
7676
3. For Region, select **East US**.
77-
4. Select **Next:Rules**.
78-
5. Select **Add a rule collection**.
79-
6. For **Name**, type **RCNet01**.
80-
7. For **Rule collection type**, select **Network**.
81-
8. For **Priority**, type **100**.
82-
9. For **Action**, select **Allow**.
83-
10. Under **Rules**, for **Name**, type **AllowWeb**.
84-
11. For **Source Addresses**, type **192.168.1.0/24**.
85-
12. For **Protocol**, select **TCP**.
86-
13. For **Destination Ports**, type **80**.
87-
14. For **Destination Type**, select **IP Address**.
88-
15. For **Destination**, type **10.6.0.0/16**.
89-
16. On the next rule row, enter the following information:
77+
1. Select **Next : DNS Settings**.
78+
1. Select **Next : TLS inspection (preview)**
79+
1. Select **Next:Rules**.
80+
1. Select **Add a rule collection**.
81+
1. For **Name**, type **RCNet01**.
82+
1. For **Rule collection type**, select **Network**.
83+
1. For **Priority**, type **100**.
84+
1. For **Action**, select **Allow**.
85+
1. Under **Rules**, for **Name**, type **AllowWeb**.
86+
1. For **Source**, type **192.168.1.0/24**.
87+
1. For **Protocol**, select **TCP**.
88+
1. For **Destination Ports**, type **80**.
89+
1. For **Destination Type**, select **IP Address**.
90+
1. For **Destination**, type **10.6.0.0/16**.
91+
1. On the next rule row, enter the following information:
9092

9193
Name: type **AllowRDP**<br>
92-
Source IP address: type **192.168.1.0/24**.<br>
94+
Source: type **192.168.1.0/24**.<br>
9395
Protocol, select **TCP**<br>
9496
Destination Ports, type **3389**<br>
9597
Destination Type, select **IP Address**<br>
@@ -105,75 +107,81 @@ If you don't have an Azure subscription, create a [free account](https://azure.m
105107
> The size of the AzureFirewallSubnet subnet is /26. For more information about the subnet size, see [Azure Firewall FAQ](../firewall/firewall-faq.yml#why-does-azure-firewall-need-a--26-subnet-size).
106108
107109
1. From the Azure portal home page, select **Create a resource**.
108-
2. Under **Networking**, select **Virtual network**.
109-
4. For **Name**, type **VNet-hub**.
110-
5. For **Address space**, type **10.5.0.0/16**.
111-
6. For **Subscription**, select your subscription.
112-
7. For **Resource group**, select **FW-Hybrid-Test**.
113-
8. For **Location**, select **East US**.
114-
9. Under **Subnet**, for **Name** type **AzureFirewallSubnet**. The firewall will be in this subnet, and the subnet name **must** be AzureFirewallSubnet.
115-
10. For **Address range**, type **10.5.0.0/26**.
116-
11. Accept the other default settings, and then select **Create**.
110+
2. Search for **Virtual network** and then select **Virtual network**.
111+
1. Select **Create**.
112+
1. For **Subscription**, select your subscription.
113+
1. For **Resource group**, select **FW-Hybrid-Test**.
114+
1. For **Name**, type **VNet-hub**.
115+
1. For **Region**, select **East US**.
116+
1. Select **Next : IP Addresses**.
117+
118+
1. For **IPv4 address space**, type **10.5.0.0/16**.
119+
1. Under **Subnet name**, select **default**.
120+
1. Change the **Subnet name** to **AzureFirewallSubnet**. The firewall is in this subnet, and the subnet name **must** be AzureFirewallSubnet.
121+
1. For **Subnet address range**, type **10.5.0.0/26**.
122+
1. Accept the other default settings, and then select **Save**.
123+
1. Select **Review + create**.
124+
1. Select **Create**.
117125

118126
## Create the spoke virtual network
119127

120128
1. From the Azure portal home page, select **Create a resource**.
121-
2. Under **Networking**, select **Virtual network**.
122-
4. For **Name**, type **VNet-Spoke**.
123-
5. For **Address space**, type **10.6.0.0/16**.
124-
6. For **Subscription**, select your subscription.
125-
7. For **Resource group**, select **FW-Hybrid-Test**.
126-
8. For **Location**, select the same location that you used previously.
127-
9. Under **Subnet**, for **Name** type **SN-Workload**.
128-
10. For **Address range**, type **10.6.0.0/24**.
129-
11. Accept the other default settings, and then select **Create**.
129+
2. Search for **Virtual network** and then select **Virtual network**.
130+
1. Select **Create**.
131+
1. For **Subscription**, select your subscription.
132+
1. For **Resource group**, select **FW-Hybrid-Test**.
133+
1. For **Name**, type **VNet-Spoke**.
134+
1. For **Region**, select **East US**.
135+
1. Select **Next : IP Addresses**.
136+
137+
1. For **IPv4 address space**, type **10.6.0.0/16**.
138+
1. Under **Subnet name**, select **default**.
139+
1. Change the **Subnet name** to **SN-Workload**.
140+
1. For **Subnet address range**, type **10.6.0.0/24**.
141+
1. Accept the other default settings, and then select **Save**.
142+
1. Select **Review + create**.
143+
1. Select **Create**.
144+
130145

131146
## Create the on-premises virtual network
132147

133148
1. From the Azure portal home page, select **Create a resource**.
134-
2. Under **Networking**, select **Virtual network**.
135-
4. For **Name**, type **VNet-OnPrem**.
136-
5. For **Address space**, type **192.168.0.0/16**.
137-
6. For **Subscription**, select your subscription.
138-
7. For **Resource group**, select **FW-Hybrid-Test**.
139-
8. For **Location**, select the same location that you used previously.
140-
9. Under **Subnet**, for **Name** type **SN-Corp**.
141-
10. For **Address range**, type **192.168.1.0/24**.
142-
11. Accept the other default settings, and then select **Create**.
143-
144-
After the virtual network is deployed, create a second subnet for the gateway.
149+
2. Search for **Virtual network** and then select **Virtual network**.
150+
1. Select **Create**.
151+
1. For **Subscription**, select your subscription.
152+
1. For **Resource group**, select **FW-Hybrid-Test**.
153+
1. For **Name**, type **VNet-OnPrem**.
154+
1. For **Region**, select **East US**.
155+
1. Select **Next : IP Addresses**.
156+
157+
1. For **IPv4 address space**, type **192.168.0.0/16**.
158+
1. Under **Subnet name**, select **default**.
159+
1. Change the **Subnet name** to **SN-Corp**.
160+
1. For **Subnet address range**, type **192.168.1.0/24**.
161+
1. Accept the other default settings, and then select **Save**.
162+
2. Select **Add Subnet**.
163+
3. For **Subnet name**, type **GatewaySubnet**.
164+
4. For **Subnet address range** type **192.168.2.0/24**.
165+
5. Select **Add**.
166+
1. Select **Review + create**.
167+
1. Select **Create**.
145168

146-
1. On the **VNet-Onprem** page, select **Subnets**.
147-
2. Select **+Subnet**.
148-
3. For **Name**, type **GatewaySubnet**.
149-
4. For **Address range (CIDR block)** type **192.168.2.0/24**.
150-
5. Select **OK**.
151169

152-
### Create a public IP address
153170

154-
This is the public IP address used for the on-premises gateway.
155-
156-
1. From the Azure portal home page, select **Create a resource**.
157-
2. In the search text box, type **public IP address** and press **Enter**.
158-
3. Select **Public IP address** and then select **Create**.
159-
4. For the name, type **VNet-Onprem-GW-pip**.
160-
5. For the resource group, type **FW-Hybrid-Test**.
161-
6. For **Location**, select select **East US**.
162-
7. Accept the other defaults, and then select **Create**.
163171

164172
## Configure and deploy the firewall
165173

166-
When security policies are associated with a hub, it is referred to as a *hub virtual network*.
174+
When security policies are associated with a hub, it's referred to as a *hub virtual network*.
167175

168176
Convert the **VNet-Hub** virtual network into a *hub virtual network* and secure it with Azure Firewall.
169177

170178
1. In the Azure portal search bar, type **Firewall Manager** and press **Enter**.
171179
3. On the Azure Firewall Manager page, under **Add security to virtual networks**, select **View hub virtual networks**.
172-
4. Select **Convert virtual networks**.
173-
5. Select **VNet-hub** and then select **Next : Azure Firewall**.
174-
6. For the **Firewall Policy**, select **Pol-Net01**.
175-
7. Select **Next " Review + confirm**
176-
8. Review the details and then select **Confirm**.
180+
1. Under **Virtual Networks**, select the check box for **VNet-hub**.
181+
1. Select **Manage Security**, and then select **Deploy a Firewall with Firewall Policy**.
182+
1. On the **Convert virtual networks** page, under **Firewall Policy**, select the check box for **Pol-Net01**.
183+
1. Select **Next : Review + confirm**
184+
1. Review the details and then select **Confirm**.
177185

178186

179187
This takes a few minutes to deploy.
@@ -214,20 +222,20 @@ Now create the VPN gateway for the on-premises virtual network. Network-to-netwo
214222
7. For **VPN type**, select **Route-based**.
215223
8. For **SKU**, select **Basic**.
216224
9. For **Virtual network**, select **VNet-Onprem**.
217-
10. For **Public IP address**, select **Use existing*, and select **VNet-Onprem-GW-pip** for the name.
225+
10. For **Public IP address**, select **Create new**, and type **VNet-Onprem-GW-pip** for the name.
218226
11. Accept the remaining defaults and then select **Review + create**.
219227
12. Review the configuration, then select **Create**.
220228

221229
### Create the VPN connections
222230

223231
Now you can create the VPN connections between the hub and on-premises gateways.
224232

225-
In this step, you create the connection from the hub virtual network to the on-premises virtual network. You'll see a shared key referenced in the examples. You can use your own values for the shared key. The important thing is that the shared key must match for both connections. Creating a connection can take a short while to complete.
233+
In this step, you create the connection from the hub virtual network to the on-premises virtual network. You'll see a shared key referenced in the examples. You can use your own values for the shared key. The important thing is that the shared key must match for both connections. It takes some time to create the connection.
226234

227235
1. Open the **FW-Hybrid-Test** resource group and select the **GW-hub** gateway.
228236
2. Select **Connections** in the left column.
229237
3. Select **Add**.
230-
4. The the connection name, type **Hub-to-Onprem**.
238+
4. For the connection name, type **Hub-to-Onprem**.
231239
5. Select **VNet-to-VNet** for **Connection type**.
232240
6. For the **Second virtual network gateway**, select **GW-Onprem**.
233241
7. For **Shared key (PSK)**, type **AzureA1b2C3**.
@@ -258,21 +266,31 @@ Now peer the hub and spoke virtual networks.
258266
1. Open the **FW-Hybrid-Test** resource group and select the **VNet-hub** virtual network.
259267
2. In the left column, select **Peerings**.
260268
3. Select **Add**.
261-
4. For **Name**, type **HubtoSpoke**.
262-
5. For the **Virtual network**, select **VNet-spoke**
263-
6. For the name of the peering from VNetSpoke to VNet-hub, type **SpoketoHub**.
264-
7. Select **Allow gateway transit**.
265-
8. Select **OK**.
266-
267-
### Configure additional settings for the SpoketoHub peering
268-
269-
You'll need to enable the **Allow forwarded traffic** on the SpoketoHub peering.
270-
271-
1. Open the **FW-Hybrid-Test** resource group and select the **VNet-Spoke** virtual network.
272-
2. In the left column, select **Peerings**.
273-
3. Select the **SpoketoHub** peering.
274-
4. Under **Allow forwarded traffic from VNet-hub to VNet-Spoke**, select **Enabled**.
275-
5. Select **Save**.
269+
4. Under **This virtual network**:
270+
271+
272+
|Setting name |Value |
273+
|---------|---------|
274+
|Peering link name| HubtoSpoke|
275+
|Traffic to remote virtual network| Allow (default) |
276+
|Traffic forwarded from remote virtual network | Allow (default) |
277+
|Virtual network gateway or route server | Use this virtual network's gateway |
278+
279+
5. Under **Remote virtual network**:
280+
281+
|Setting name |Value |
282+
|---------|---------|
283+
|Peering link name | SpoketoHub|
284+
|Virtual network deployment model| Resource Manager|
285+
|Subscription|\<your subscription\>|
286+
|Virtual network| VNet-Spoke
287+
|Traffic to remote virtual network | Allow (default) |
288+
|Traffic forwarded from remote virtual network | Allow (default) |
289+
|Virtual network gateway | Use the remote virtual network's gateway |
290+
291+
5. Select **Add**.
292+
293+
:::image type="content" source="media/secure-hybrid-network/firewall-peering.png" alt-text="Vnet peering":::
276294

277295
## Create the routes
278296

@@ -285,18 +303,19 @@ Next, create a couple routes:
285303
2. In the search text box, type **route table** and press **Enter**.
286304
3. Select **Route table**.
287305
4. Select **Create**.
288-
5. For the name, type **UDR-Hub-Spoke**.
289-
6. Select the **FW-Hybrid-Test** for the resource group.
290-
8. For **Location**, select **(US) East US)**.
291-
9. Select **Create**.
292-
10. After the route table is created, select it to open the route table page.
293-
11. Select **Routes** in the left column.
294-
12. Select **Add**.
295-
13. For the route name, type **ToSpoke**.
296-
14. For the address prefix, type **10.6.0.0/16**.
297-
15. For next hop type, select **Virtual appliance**.
298-
16. For next hop address, type the firewall's private IP address that you noted earlier.
299-
17. Select **OK**.
306+
1. Select the **FW-Hybrid-Test** for the resource group.
307+
1. For **Region**, select **East US**.
308+
1. For the name, type **UDR-Hub-Spoke**.
309+
1. Select **Review + Create**.
310+
1. Select **Create**.
311+
1. After the route table is created, select it to open the route table page.
312+
1. Select **Routes** in the left column.
313+
1. Select **Add**.
314+
1. For the route name, type **ToSpoke**.
315+
1. For the address prefix, type **10.6.0.0/16**.
316+
1. For next hop type, select **Virtual appliance**.
317+
1. For next hop address, type the firewall's private IP address that you noted earlier.
318+
1. Select **OK**.
300319

301320
Now associate the route to the subnet.
302321

@@ -312,19 +331,20 @@ Now create the default route from the spoke subnet.
312331
2. In the search text box, type **route table** and press **Enter**.
313332
3. Select **Route table**.
314333
5. Select **Create**.
315-
6. For the name, type **UDR-DG**.
316334
7. Select the **FW-Hybrid-Test** for the resource group.
317-
8. For **Location**, select **(US) East US)**.
318-
4. For **Virtual network gateway route propagation**, select **Disabled**.
335+
8. For **Region**, select **East US**.
336+
1. For the name, type **UDR-DG**.
337+
4. For **Propagate gateway routes**, select **No**.
338+
1. Select **Review + create**.
319339
1. Select **Create**.
320-
2. After the route table is created, select it to open the route table page.
321-
3. Select **Routes** in the left column.
322-
4. Select **Add**.
323-
5. For the route name, type **ToHub**.
324-
6. For the address prefix, type **0.0.0.0/0**.
325-
7. For next hop type, select **Virtual appliance**.
326-
8. For next hop address, type the firewall's private IP address that you noted earlier.
327-
9. Select **OK**.
340+
1. After the route table is created, select it to open the route table page.
341+
1. Select **Routes** in the left column.
342+
1. Select **Add**.
343+
1. For the route name, type **ToHub**.
344+
1. For the address prefix, type **0.0.0.0/0**.
345+
1. For next hop type, select **Virtual appliance**.
346+
1. For next hop address, type the firewall's private IP address that you noted earlier.
347+
1. Select **OK**.
328348

329349
Now associate the route to the subnet.
330350

@@ -345,20 +365,21 @@ Create a virtual machine in the spoke virtual network, running IIS, with no publ
345365
1. From the Azure portal home page, select **Create a resource**.
346366
2. Under **Popular**, select **Windows Server 2016 Datacenter**.
347367
3. Enter these values for the virtual machine:
348-
- **Resource group** - Select **FW-Hybrid-Test**.
349-
- **Virtual machine name**: *VM-Spoke-01*.
350-
- **Region** - *(US) East US)*.
351-
- **User name**: *azureuser*.
352-
- **Password**: type your password
368+
- **Resource group** - Select **FW-Hybrid-Test**
369+
- **Virtual machine name**: *VM-Spoke-01*
370+
- **Region** - *(US) East US*
371+
- **User name**: type a user name
372+
- **Password**: type a password
353373

354374
4. Select **Next:Disks**.
355375
5. Accept the defaults and select **Next: Networking**.
356376
6. Select **VNet-Spoke** for the virtual network and the subnet is **SN-Workload**.
357-
7. For **Public IP**, select **None**.
358377
8. For **Public inbound ports**, select **Allow selected ports**, and then select **HTTP (80)**, and **RDP (3389)**
359-
9. Select **Next:Management**.
360-
10. For **Boot diagnostics**, Select **Off**.
361-
11. Select **Review+Create**, review the settings on the summary page, and then select **Create**.
378+
1. Select **Next : Disks**.
379+
1. Select **Next : Networking**.
380+
1. Select **Next:Management**.
381+
1. For **Boot diagnostics**, Select **Disable**.
382+
1. Select **Review + Create**, review the settings on the summary page, and then select **Create**.
362383

363384
### Install IIS
364385

@@ -384,19 +405,19 @@ This is a virtual machine that you use to connect using Remote Desktop to the pu
384405
1. From the Azure portal home page, select **Create a resource**.
385406
2. Under **Popular**, select **Windows Server 2016 Datacenter**.
386407
3. Enter these values for the virtual machine:
387-
- **Resource group** - Select existing, and then select **FW-Hybrid-Test**.
388-
- **Virtual machine name** - *VM-Onprem*.
389-
- **Region** - *(US) East US)*.
390-
- **User name**: *azureuser*.
391-
- **Password**: type your password.
408+
- **Resource group** - Select existing, and then select **FW-Hybrid-Test**
409+
- **Virtual machine name** - *VM-Onprem*
410+
- **Region** - *(US) East US*
411+
- **User name**: type a user name
412+
- **Password**: type your password
392413

393414
4. Select **Next:Disks**.
394415
5. Accept the defaults and select **Next:Networking**.
395416
6. Select **VNet-Onprem** for virtual network and verify the subnet is **SN-Corp**.
396417
7. For **Public inbound ports**, select **Allow selected ports**, and then select **RDP (3389)**
397418
8. Select **Next:Management**.
398-
9. For **Boot diagnostics**, select **Off**.
399-
10. Select **Review+Create**, review the settings on the summary page, and then select **Create**.
419+
9. For **Boot diagnostics**, select **Disable**.
420+
10. Select **Review + Create**, review the settings on the summary page, and then select **Create**.
400421

401422
## Test the firewall
402423

@@ -423,17 +444,17 @@ So now you've verified that the firewall rules are working:
423444

424445
Next, change the firewall network rule collection action to **Deny** to verify that the firewall rules work as expected.
425446

426-
1. Open the **FW-Hybrid-Test** resource group and select the **Pol-Net01**firewall policy.
427-
2. Under **Settings**, select **Rules**.
428-
3. Under **Network rules**, select the **RCNet01** rule collection, select the ellipses (...), and select **Edit**.
429-
4. For **Rule collection action**, select **Deny**.
430-
5. Select **Save**.
447+
1. Open the **FW-Hybrid-Test** resource group and select the **Pol-Net01** firewall policy.
448+
2. Under **Settings**, select **Rule Collections**.
449+
1. Select the **RCNet01** rule collection.
450+
1. For **Rule collection action**, select **Deny**.
451+
1. Select **Save**.
431452

432-
Close any existing remote desktops and browsers on **VM-Onprem** before testing the changed rules. After the rule collection update is complete, run the tests again. They should all fail this time.
453+
Close any existing remote desktops and browsers on **VM-Onprem** before testing the changed rules. After the rule collection update is complete, run the tests again. They should all fail to connect this time.
433454

434455
## Clean up resources
435456

436-
You can keep your firewall resources for the next tutorial, or if no longer needed, delete the **FW-Hybrid-Test** resource group to delete all firewall-related resources.
457+
You can keep your firewall resources for further investigation, or if no longer needed, delete the **FW-Hybrid-Test** resource group to delete all firewall-related resources.
437458

438459
## Next steps
439460

0 commit comments

Comments
 (0)
Please sign in to comment.